Abstract: For example, as indicated in the Incorporated Disclosures, rapid change from relatively little use of network bandwidth, to heavy overuse of network bandwidth (combined with a large number of endpoints attempting to access that network bandwidth) can often indicate an email virus or other maladjusted use of the system. In such cases, it could be appropriate to generate an alert, and bring the change to the attention of a human expert, or otherwise escalate the problem. Best practices In this Application, the phrase “best practices,” and variants thereof, can generally refer to business preferences (and to business rules imposed by management, or law or regulation), such as high utilization preferences often expressed by management. In such cases, one or more operators can enter descriptors of rules the system that it is desired the system follow, such as “processor cycle utilization >90%.

Abstract: A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Abstract: A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Abstract: One network monitoring system maintains information regarding historical activity and emergent activity of the network. Comparison of recent with historical activity allows the system to determine whether recent activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Another network monitoring device includes data structures for maintaining information regarding historical and emergent activity of a network. This network monitoring device maintains those data structures including information regarding historical and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful.

Abstract: A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Abstract: A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling a differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

Abstract: A network monitoring device includes a data structure for maintaining information about endpoints involved in network flows. Each endpoint, either a source or a destination for a network flow, has information maintained in a modified binary trie, having a branch for each bit of the source or destination address, but with interior nodes having only a single child node elided. A pruning thread is given a limited amount of time for operation, with the effect that the data structure is maintained available for use except for only that limited amount of time. In the event that the pruning thread is unable to prune the entire data structure, it maintains a marker indicating where last it left off, and returns to that location in the data structure at a later pruning operation.

Abstract: A network monitoring system maintains both information regarding historical activity of a network, and information regarding emergent activity of the network. Comparison of historical activity of the network with emergent activity of the network allows the system to determine whether network activity is changing over time. The network monitoring system maintains data structures representing a p.d.f. for observable values of network parameters. Recent activity of the network can be compared with both the p.d.f. for historical activity and for emergent activity to aid in determining whether that recent activity is within the realm of normal, and whether network activity is changing over time. The network monitoring system adjusts that information regarding historical activity of a network in response to emergent activity of that network.

Abstract: A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling at differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

Abstract: A network monitoring system includes devices receiving network traffic information, and generating at least partial results relating to network symptoms. Those partial results are forwarded to devices processing those partial results and generating information relating to problems in response to those symptoms. Problems are reported to users or sent as notifications. In one embodiment, information relating to network traffic is monitored both by a first set of devices associated with source addresses for that network traffic and a second set of devices associated with destination addresses for that network traffic. Information received by that first set of devices includes information relating to both the source address and destination address of network traffic. That first set of devices processes information relating to the source address of network traffic and forwards information relating to the destination address of network traffic to that second set of devices.

Abstract: Apparatus, methods, and articles of manufacture consistent with the present invention provide a check validation scheme wherein a payor's signature is digitized, encrypted and embedded on the front of the check using glyphs. When the payor seeks to convert a blank check into a negotiable instrument, the user fills out the check and signs it. When the check is presented to a bank for payment, a teller using a decoding device, decodes and decrypts the digitized signature such that a human-readable image of the digitized signature can be seen on a screen for comparison with the payor's scripted signature. If the two signatures are identical, the check is honored.

Abstract: Apparatus, methods, and articles of manufacture consistent with the present invention provide a check validation scheme wherein a payor's signature is digitized, encrypted and embedded on the front of the check using glyphs. When the payor seeks to convert a blank check into a negotiable instrument, the user fills out the check and signs it. When the check is presented to a bank for payment, a teller using a decoding device, decodes and decrypts the digitized signature such that a human-readable image of the digitized signature can be seen on a screen for comparison with the payor's scripted signature. If the two signatures are identical, the check is honored.