Abstract: A cluster load balancer can be coupled to a network for monitoring network traffic. The cluster load balancer can include one or more computing devices. The one or more computing devices can be configured to receive a data packet, the data packet comprising a device identifier of a first device connected to a network for a communication session, wherein the data packet is a user plane data packet or a control plane data packet; generate a probe identification based on the device identifier of the first device in the data packet; add the probe identification to the data packet; and transmit the data packet with the probe identification to a second device in communication with a plurality of network probes. The second device can be configured to forward the data packet to a network probe of the plurality of network probes based on the probe identification in the data packet.

Abstract: A method is disclosed. A first data packet is received. Data is extracted from the first data packet. A first synthetic data packet is generated from data of the first data packet. A second data packet is received. Data is extracted from the second data packet. A key performance indicator is generated from data of the first and second synthetic data packets.

Abstract: Method for monitoring network performance in a telecommunication network coupled with a plurality of Virtual Machines (VM) arranged in a cluster format is disclosed. A packet is received at a VM smart cluster device. Metadata is extracted from the packet. The packet can be distributed to one of the plurality of VMs. Key performance indicator (KPI) session related data associated with a subscriber in one of the plurality of VMs that receives the distributed packet can be generated.

Abstract: Method for monitoring network performance in a telecommunication network coupled with a plurality of Virtual Machines (VM) arranged in a cluster format is disclosed. A packet is received at a VM smart cluster device. Metadata is extracted from the packet. The packet can be distributed to one of the plurality of VMs. Key performance indicator (KPI) session related data associated with a subscriber in one of the plurality of VMs that receives the distributed packet can be generated.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria.

Abstract: A system for selective user plane (UP) monitoring includes a service gateway (SGW) having a plurality of units. The system further includes a network packet broker (NPB) configured to receive packets including UP data from tunnels created to enable transmission of the UP packets from UE to the plurality of SGW units. The NPB is also configured to receive packets including control plane (CP) data from channels enabling transmission of the CP packets from a base transceiver station to the SGW. The system also includes a plurality of probes operatively coupled to the NPB. The probes are configured to generate first metrics associated with the received CP packets and to selectively generate second metrics associated with the received UP packets based on one or more identifiers. The NPB is configured to forward UP packets being processed by a particular SGW unit to a particular probe of the plurality of probes.

Abstract: A system and method to aggregate subscriber-perspective data from live data packets of network traffic. The method includes inspecting live packets of network traffic exchanged with a plurality of subscriber end devices. Network traffic exchanged with a subscriber end device can include network traffic exchanged with a different subscriber end device or with an application server. The packet inspection is performed at a location of interception of the live packets, each subscriber end device being an end device correlated with a subscriber. The method further includes selecting, at the location, content data of the inspected packets that correspond to packets exchanged with a selected subscriber end device of the plurality of subscriber end devices, aggregating, at the location, the content data selected, wherein the content data has not been previously aggregated, and outputting, at the location, results of the aggregation.

Abstract: A system and method is provided for calculating session initiation protocol (SIP) key performance indicators (KPIs) for multimedia communication in a network accessing network packets monitored over time. The method includes accessing network packets monitored over time, detecting a SIP response message of the monitored network packets, and accounting for the detected SIP response message in a time window of a series of consecutive time windows that includes the SIP response message's associated observed time. The SIP response message has an associated observed time at which the monitored SIP message was observed during monitoring. The method further includes pairing a SIP request message expected to be paired with the detected SIP response message with the detected SIP response message and accounting for the paired SIP request message in the time window with which the detected SIP response message is accounted.

Abstract: A system having a network monitor communicating with U and C probes monitoring SGW-U and SGW-Cs. The U probes buffer captured user plane packets from which they determine new sessions and send new session data to the network monitor, the new session data including an IP address pair of the corresponding U probe and SGW-U. The C probes inspect captured control plane packets, determine control plane packets having a same IP address as an SGW-U in the new session data, and send associated control data to a particular U probe having the IP address paired with the IP address of the SGW-U, wherein the particular U probe correlates the control data with buffered user plane packets and generates associated monitoring data.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria.

Abstract: A computer implemented method for determining the identity of an Over-the Top (OTT) application or service being accessed over the Internet from a HTTP, HTTPS or QUIC connection request received in a network monitoring device. Determine if one or more entries are present in the received connection request have an IP address that matches a known server IP address. A determination is then made as to whether if the received connection request is one of a HTTP, HTTPS or QUIC connection request, and if this cannot be determined than determine if a subject field in the received connection request is available. And determine if a candidate domain name is available from IP cache created from one or more of the above steps if a subject field is not available in the received connection request.

Abstract: A computer implemented method for determining the identity of an Over-the Top (OTT) application or service being accessed over the Internet from a HTTP, HTTPS or QUIC connection request received in a network monitoring device. Determine if one or more entries are present in the received connection request have an IP address that matches a known server IP address. A determination is then made as to whether if the received connection request is one of a HTTP, HTTPS or QUIC connection request, and if this cannot be determined than determine if a subject field in the received connection request is available. And determine if a candidate domain name is available from IP cache created from one or more of the above steps if a subject field is not available in the received connection request.

Abstract: A system having a network monitor communicating with U and C probes monitoring SGW-U and SGW-Cs. The U probes buffer captured user plane packets from which they determine new sessions and send new session data to the network monitor, the new session data including an IP address pair of the corresponding U probe and SGW-U. The C probes inspect captured control plane packets, determine control plane packets having a same IP address as an SGW-U in the new session data, and send associated control data to a particular U probe having the IP address paired with the IP address of the SGW-U, wherein the particular U probe correlates the control data with buffered user plane packets and generates associated monitoring data.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria.

Abstract: A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria.

Abstract: A system for selective user plane (UP) monitoring includes a service gateway (SGW) having a plurality of units. The system further includes a network packet broker (NPB) configured to receive packets including UP data from tunnels created to enable transmission of the UP packets from UE to the plurality of SGW units. The NPB is also configured to receive packets including control plane (CP) data from channels enabling transmission of the CP packets from a base transceiver station to the SGW. The system also includes a plurality of probes operatively coupled to the NPB. The probes are configured to generate first metrics associated with the received CP packets and to selectively generate second metrics associated with the received UP packets based on one or more identifiers. The NPB is configured to forward UP packets being processed by a particular SGW unit to a particular probe of the plurality of probes.

Abstract: A system for selective user plane (UP) monitoring includes a service gateway (SGW) having a plurality of units. The system further includes a network packet broker (NPB) configured to receive packets including UP data from tunnels created to enable transmission of the UP packets from UE to the plurality of SGW units. The NPB is also configured to receive packets including control plane (CP) data from channels enabling transmission of the CP packets from a base transceiver station to the SGW. The system also includes a plurality of probes operatively coupled to the NPB. The probes are configured to generate first metrics associated with the received CP packets and to selectively generate second metrics associated with the received UP packets based on one or more identifiers. The NPB is configured to forward UP packets being processed by a particular SGW unit to a particular probe of the plurality of probes.

Abstract: A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.