Abstract: The disclosed systems and methods can provide a closed-loop system that enables network operators to perform streaming analytics for network monitoring applications at scale. The disclosed systems and methods can allow operators to express network monitoring queries as operations over tuples, and can allow them to partition the queries across both switches and a stream processor, and, through iterative refinement, attempt to extract only the traffic that pertains to the query, thus ensuring that the stream processor can scale to satisfy a large number of queries for traffic at very high rates. According to an example method, network monitoring queries are partitioned between components in a network and iteratively refined based on output of the network monitoring query. The network components can include a data plane component (e.g., a switch) and a stream processor component. The network monitoring queries can be refined based on output from the stream processor component.

Abstract: A method, computer-readable storage device, and an apparatus for determining a localized service quality in a wireless network are disclosed. For example, the method constructs a tensor comprising a plurality of dimensions to represent data for the localized service quality, receives data for the wireless network that is gathered at a coarse granularity level, populates the tensor in accordance with the data that is gathered, applies an unfolding mechanism to construct a plurality of two dimensional matrices from the tensor, determines for each respective two dimensional matrix of the plurality of two dimensional matrices an approximation for a pre-determined level of accuracy, and populating all entries of each respective two dimensional matrix that are not populated in accordance with the approximation of the respective two dimensional matrix, and determines the localized service quality by applying a folding mechanism across the plurality of two dimensional matrices.

Abstract: A method, computer-readable storage device, and an apparatus for determining a localized service quality in a wireless network are disclosed. For example, the method constructs a tensor comprising a plurality of dimensions to represent data for the localized service quality, receives data for the wireless network that is gathered at a coarse granularity level, populates the tensor in accordance with the data that is gathered, applies an unfolding mechanism to construct a plurality of two dimensional matrices from the tensor, determines for each respective two dimensional matrix of the plurality of two dimensional matrices an approximation for a pre-determined level of accuracy, and populating all entries of each respective two dimensional matrix that are not populated in accordance with the approximation of the respective two dimensional matrix, and determines the localized service quality by applying a folding mechanism across the plurality of two dimensional matrices.

Abstract: A packet trace is received. Transmitted bytes and retransmitted bytes are identified in the packet trace. Upon identifying the transmitted bytes and the retransmitted bytes in the packet trace, one or more time-rate pairs are determined from the packet trace. The time-rate pairs are plotted on a rate tracking graph.

Abstract: A packet trace is received. Inter-arrival times between the multiple packets in the packet trace are determined. An inter-arrival time in the inter-arrival times that is greater than a threshold is identified. An order number of the inter-arrival time is identified. A determination is made as to whether a size of each of at least a portion of the multiple packets is equal to a maximum segment size. When a determination is made that the size of each of at least a portion of the multiple packets is equal to the maximum segment size, a size of the ICW as a product of the order number and the maximum segment size is returned.

Abstract: A packet trace is received. The packet trace is transformed into a sequence of pulse signals in a temporal domain. The sequence of pulse signals in the temporal domain is transformed into a sequence of pulse signals in a frequency domain. Peaks are detected within relevant frequency bands in the sequence of pulse signals in the frequency domain. A fundamental frequency is identified within the peaks. The fundamental frequency, which represents the TCP flow clock, is returned.

Abstract: A technique for examining the relationships of autonomous systems (ASes) participating in an Internet Exchange Point (IXP) utilizes packet tracing servers proximate the IXPs. Where such packet tracing servers cannot be found in the participating ASes, the methodology identifies additional vantage points by looking at a list of ASes that are one hop away from the ASes at the IXP. The choice of one-hop away ASes is made judiciously by picking ones that have better connectivity, based on past-data. Plural-hop ASes may also be used where necessary.

Abstract: Certain exemplary embodiments can provide a method, which can comprise, based upon a quantified completeness of a determined topology of an interconnected set of Autonomous Systems of the Internet, at a user interface of an information device, automatically rendering a determined identity of a customer to which telecommunications products will be offered.

Abstract: A technique for examining the relationships of autonomous systems (ASes) participating in an Internet Exchange Point (IXP) utilizes packet tracing servers proximate the IXPs. Where such packet tracing servers cannot be found in the participating ASes, the methodology identifies additional vantage points by looking at a list of ASes that are one hop away from the ASes at the IXP. The choice of one-hop away ASes is made judiciously by picking ones that have better connectivity, based on past-data. Plural-hop ASes may also be used where necessary.

Abstract: A packet trace is received. Inter-arrival times between the multiple packets in the packet trace are determined. An inter-arrival time in the inter-arrival times that is greater than a threshold is identified. An order number of the inter-arrival time is identified. A determination is made as to whether a size of each of at least a portion of the multiple packets is equal to a maximum segment size. When a determination is made that the size of each of at least a portion of the multiple packets is equal to the maximum segment size, a size of the ICW as a product of the order number and the maximum segment size is returned.

Abstract: A packet trace is received. Inter-arrival times between the multiple packets in the packet trace are determined. An inter-arrival time in the inter-arrival times that is greater than a threshold is identified. An order number of the inter-arrival time is identified. A determination is made as to whether a size of each of at least a portion of the multiple packets is equal to a maximum segment size. When a determination is made that the size of each of at least a portion of the multiple packets is equal to the maximum segment size, a size of the ICW as a product of the order number and the maximum segment size is returned.

Abstract: A technique for examining the relationships of autonomous systems (ASes) participating in an Internet Exchange Point (IXP) utilizes packet tracing servers proximate the IXPs. Where such packet tracing servers cannot be found in the participating ASes, the methodology identifies additional vantage points by looking at a list of ASes that are one hop away from the ASes at the IXP. The choice of one-hop away ASes is made judiciously by picking ones that have better connectivity, based on past-data. Plural-hop ASes may also be used where necessary.

Abstract: A packet trace is received. Transmitted bytes and retransmitted bytes are identified in the packet trace. Upon identifying the transmitted bytes and the retransmitted bytes in the packet trace, one or more time-rate pairs are determined from the packet trace. The time-rate pairs are plotted on a rate tracking graph.

Abstract: A packet trace is received. Inter-arrival times between the multiple packets in the packet trace are determined. An inter-arrival time in the inter-arrival times that is greater than a threshold is identified. An order number of the inter-arrival time is identified. A determination is made as to whether a size of each of at least a portion of the multiple packets is equal to a maximum segment size. When a determination is made that the size of each of at least a portion of the multiple packets is equal to the maximum segment size a size of the ICW as a product of the order number and the maximum segment size is returned.

Abstract: A packet trace is received. The packet trace is transformed into a sequence of pulse signals in a temporal domain. The sequence of pulse signals in the temporal domain is transformed into a sequence of pulse signals in a frequency domain. Peaks are detected within relevant frequency bands in the sequence of pulse signals in the frequency domain. A fundamental frequency is identified within the peaks. The fundamental frequency, which represents the TCP flow clock, is returned.

Abstract: A technique for examining the relationships of autonomous systems (ASes) participating in an Internet Exchange Point (IXP) utilizes packet tracing servers proximate the IXPs. Where such packet tracing servers cannot be found in the participating ASes, the methodology identifies additional vantage points by looking at a list of ASes that are one hop away from the ASes at the IXP. The choice of one-hop away ASes is made judiciously by picking ones that have better connectivity, based on past-data. Plural-hop ASes may also be used where necessary.

Abstract: Methods and apparatus to infer the status of BGP sessions are disclosed. A disclosed example method comprises querying a configuration file of a router of a first AS to identify a BGP session to a second AS, querying the file to determine whether the BGP session is a single hop, when the BGP session is a single hop, setting a status flag to a first value, querying the file to determine whether there is a valid IP configuration for the BGP session, when there is a valid IP configuration, setting the status flag to a second value, querying a router syslog file for the router to identify a syslog message associated with the BGP session, determining whether the session is stale, and when the session is not stale and the status flag is set to the second value, adding the second AS to a list of actual AS neighbors.

Abstract: A technique for examining the relationships of autonomous systems (ASes) participating in an Internet Exchange Point (IXP) utilizes packet tracing servers proximate the IXPs. Where such packet tracing servers cannot be found in the participating ASes, the methodology identifies additional vantage points by looking at a list of ASes that are one hop away from the ASes at the IXP. The choice of one-hop away ASes is made judiciously by picking ones that have better connectivity, based on past-data. Plural-hop ASes may also be used where necessary.

Abstract: Methods and apparatus to infer the status of BGP sessions are disclosed. A disclosed example method comprises querying a configuration file of a router of a first AS to identify a BGP session to a second AS, querying the file to determine whether the BGP session is a single hop, when the BGP session is a single hop, setting a status flag to a first value, querying the file to determine whether there is a valid IP configuration for the BGP session, when there is a valid IP configuration, setting the status flag to a second value, querying a router syslog file for the router to identify a syslog message associated with the BGP session, determining whether the session is stale, and when the session is not stale and the status flag is set to the second value, adding the second AS to a list of actual AS neighbors.