Abstract: A method for controlling large flows in a network includes asynchronously calculating a traffic rate associated with a network flow by a controller device based on a randomly sampled packet, comparing the calculated traffic rate with a threshold value, and generating a notification of a large flow when the rate exceeds the threshold value. The method further includes creating a filter in response to the notification, assigning an action to the filter, and installing the filter and the action in a network device. In addition, the method includes removes the installed filter and action from the network device after a time interval has elapsed.

Abstract: A network traffic controller includes components adapted to receive traffic from a multitude of switches and to compare the traffic data to one or more threshold values. The threshold values may represent usage quotas. If the traffic generated by a host is detected as exceeding such usage quota, a traffic control signal is sent to the switch connecting the host to the network. The control signal may instruct the switch to mark the associated host's traffic as low priority, or rate limit the interface so as to limit the amount of traffic that is allowed onto the network, or block the traffic altogether.

Abstract: A method for calculating rates based on random sampling includes updating at least one state variable when sampled information is received. The method further includes calculating a rate value based on the state variable and the elapsed time since the state variable was previously updated.

Abstract: A method of optimizing network traffic includes, in part, measuring amounts of traffic exchange between each of a multitude of hosts disposed in the network, identifying a network domain to which each of the multitude of hosts is connected, calculating a net increase or decrease in inter-domain traffic associated with moving each of the multitude of hosts among the network domains in order to generate a list, and ranking the list of moves by net saving in the inter-domain traffic. The highest ranked move may be automatically applied so as to change the network domain to which the host associated with the highest ranked move is connected. The hosts may be virtual machines. Optionally, a change in the inter-domain traffic as a result of moving a first host in accordance with the list occurs only if one or more conditions are met.

Abstract: A method for controlling large flows in a network includes asynchronously calculating a traffic rate associated with a network flow by a controller device based on a randomly sampled packet, comparing the calculated traffic rate with a threshold value, and generating a notification of a large flow when the rate exceeds the threshold value. The method further includes creating a filter in response to the notification, assigning an action to the filter, and installing the filter and the action in a network device. In addition, the method includes removes the installed filter and action from the network device after a time interval has elapsed.

Abstract: Disclosed are a method, system, and computer program product for determining a common factor contributing to network activity with reduced computational resource utilization. In some embodiments of the present invention, the method or the system determines one or more factors by examining one or more information transmitted across the network. The method or the system stores a number of information attributable to each of the factors and determines whether the number exceeds a threshold requirement. Where the number for a factor exceeds the threshold requirement, the method or the system then determines a summary statistic for the number of information. Thereafter, the method or the System updates the data structure corresponding to the factor being analyzed based upon the summary statistic. Once the data structure is updated based upon the summary statistic, the method or the system determine one or more common factors for the network activities.

Abstract: A method for calculating rates based on random sampling includes updating at least one state variable when sampled information is received. The method further includes calculating a rate value based on the state variable and the elapsed time since the state variable was previously updated.

Abstract: To generate performance statistics of a host, a physical or virtual component of the host is associated with network interface information corresponding to one or more physical or virtual network interface devices disposed in the host. The performance statistics of the physical or virtual component together with the associated network interface information are periodically transmitted. The network interface information may be a MAC address or an SNMP ifIndex associated with the physical or virtual network interface devices. The SNMP ifIndex may be used to retrieve a corresponding MAC address. The transmitted network interface information is used to analyze the performance statistics of the associated physical or virtual component. The performance statistic may represent a CPU usage, a memory usage, a disk usage, an I/O usage, power consumption, or temperature of the physical or virtual component.

Abstract: Disclosed are a method, system, and computer program product for identifying one or more common factors or causes which explain the one or more network threshold violations. In one embodiment, the method or the system identifies one or more network components within a network and then identifies which of the one or more network components is overloaded. The method or the system then identifies one or more simple factors for the identified network components where the one or more simple factors constitute one or more causes for overloaded network activity. The method or the system then determines a scaled composite weight for a simple factor to determine whether the scaled composite weight exceeds a second threshold. If certain simple factors are determined to exceed the second threshold, such simple factors are added to a list of common factors which are in turn stored in a tangible computer accessible medium.

Abstract: To monitor networked application transactions, the application transactions are sampled and data related thereto are collected. The collected data is associated with a global network identifier corresponding to one or more physical or virtual network interface devices. One or more subsets of the collected data are transmitted in packets. The global network identifier may be a layer 4 socket, one or more MAC address associated with one or more physical or virtual interface devices, or one or more SNMP ifIndex associated with one or more physical or virtual interface devices. Data related to network components are optionally collected and combined with the data related to network components that share the global network identifier associated with the application transaction. The combined data is analyzed to determine one or more network resources associated with the application or at least one statistical characteristic of the networked application.

Abstract: A method of optimizing network traffic includes, in part, measuring amounts of traffic exchange between each of a multitude of hosts disposed in the network, identifying a network domain to which each of the multitude of hosts is connected, calculating a net increase or decrease in inter-domain traffic associated with moving each of the multitude of hosts among the network domains in order to generate a list, and ranking the list of moves by net saving in the inter-domain traffic. The highest ranked move may be automatically applied so as to change the network domain to which the host associated with the highest ranked move is connected. The hosts may be virtual machines. Optionally, a change in the inter-domain traffic as a result of moving a first host in accordance with the list occurs only if one or more conditions are met.

Abstract: A method and system for monitoring traffic flow includes assigning a subset of sampling points to a node or unique pair of nodes. The sampling points are determined to be the most likely to monitor data traffic, and preferably all data traffic, associated with the node or node pair. The sampling point subset may automatically be determined and assigned to the node or node pair, based, for example, on historical traffic within the network. The method further includes collecting diagnostic network traffic data from the sampling points, and obtaining sampled traffic flow counts for a flow associated with a node pair from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes of the node pair. The method further includes performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the respective flow.

Abstract: To generate performance statistics of a host, a physical or virtual component of the host is associated with network interface information corresponding to one or more physical or virtual network interface devices disposed in the host. The performance statistics of the physical or virtual component together with the associated network interface information are periodically transmitted. The network interface information may be a MAC address or an SNMP ifIndex associated with the physical or virtual network interface devices. The SNMP ifIndex may be used to retrieve a corresponding MAC address. The transmitted network interface information is used to analyze the performance statistics of the associated physical or virtual component. The performance statistic may represent a CPU usage, a memory usage, a disk usage, an I/O usage, power consumption, or temperature of the physical or virtual component.

Abstract: Embodiments of the present invention include a system and method for making it safe to execute downloaded code. The method includes accessing an application, the application making a system call to a library of a computer system for a resource, establishing a requesting thread. The method further includes the library sending a request message to a local security filter; the local security filter validating the requesting thread and returning a digital signature, that uniquely identifies the requesting thread, to the application. The application making a system call to a kernel of the computer system wherein the kernel uses the digital signature from the security filter to validate the requesting thread before allowing access to the requested resource.

Abstract: Disclosed are a method, system, and computer program product for identifying one or more common factors or causes which explain the one or more network threshold violations. In one embodiment, the method or the system identifies one or more network components within a network and then identifies which of the one or more network components is overloaded. The method or the system then identifies one or more simple factors for the identified network components where the one or more simple factors constitute one or more causes for overloaded network activity. The method or the system then determines a scaled composite weight for a simple factor to determine whether the scaled composite weight exceeds a second threshold. If certain simple factors are determined to exceed the second threshold, such simple factors are added to a list of common factors which are in turn stored in a tangible computer accessible medium.

Abstract: Disclosed are a method, system, and computer program product for determining a common factor contributing to network activity with reduced computational resource utilization. In some embodiments of the present invention, the method or the system determines one or more factors by examining one or more information transmitted across the network. The method or the system stores a number of information attributable to each of the factors and determines whether the number exceeds a threshold requirement. Where the number for a factor exceeds the threshold requirement, the method or the system then determines a summary statistic for the number of information. Thereafter, the method or the System updates the data structure corresponding to the factor being analyzed based upon the summary statistic. Once the data structure is updated based upon the summary statistic, the method or the system determine one or more common factors for the network activities.

Abstract: The network monitoring system includes a monitor device coupling to a network switch through a mirror port interface of the network switch. The network switch supports a number of regular port interfaces connected to different network components and the mirror port connected to the monitor device. The mirror port mirrors all network traffic of any selected regular port interfaces of the network switch. When the monitor device receives a data packet from the network switch, the monitor device extracts the network address information from such as the source and destination address from the data packet. The monitor device then examines internal lookup tables to determine whether there are corresponding physical port interface for the network address information. If the corresponding physical port interfaces for the network address information are not available in the lookup table, the monitor device interrogates the network switch for the corresponding physical port interface.

Abstract: A network monitoring system and method for analyzing network traffic is provided. This network monitoring system and method employ flow monitoring to analyze the traffic flow inside a switching device. All message packets entering the switching device are filtered and then sampled. After message packets are sampled, the switching device generates reporting packets containing network information related to the sampled packets. These reporting packets are then transmitted to a monitor server for analysis. Generally, the monitor server is coupled to a number of the switching devices so that the overall performance of the network can be gathered and presented to the users.

Abstract: A method of monitoring traffic flow within a network of nodes, and a recordable medium containing a computer program with instructions that, when executed, performs such method, is provided. The method comprises assigning sampling points to a node or unique pair of nodes. In one method, the sampling points contained within the assigned subset are determined to be the most likely to monitor data traffic, and preferably all data traffic, associated with the node or node pair. The sampling point subset may automatically be determined and assigned to the node or node pair, and such assignment can be based on historical traffic within the network. The method further comprises collecting diagnostic network traffic data from the sampling points, and obtaining sampled traffic flow counts for a flow associated with a node pair from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes of the node pair.

Abstract: A network monitoring system and method for analyzing network traffic is provided. This network monitoring system and method employ flow monitoring to analyze the traffic flow inside a switching device. All message packets entering the switching device are filtered and then sampled. After message packets are sampled, the switching device generates reporting packets containing network information related to the sampled packets. These reporting packets are then transmitted to a monitor server for analysis. Generally, the monitor server is coupled to a number of the switching devices so that the overall performance of the network can be gathered and presented to the users.