System, method, and computer readable medium for measuring network latency from flow records

摘要

The disclosure presents a system, method, and computer readable medium for computing network latencies. Network devices using flow processors create network traffic summary information in the form of flow records. A harvester may gather, process, and analyze flow records to find matching flows. Using matching flows, a harvester computes the latency, either one-way or round-trip, between two devices on the network. This information may be exported or stored on other devices on the network. The teachings of the present disclosure enable wide network coverage through the use of existing network traffic summary records. Further, the present disclosure mitigates network slowdowns associated with monitoring equipment. The present disclosure also reduces or eliminates the need for clock synchronization between devices on the network.

主权项

1. A passive method for computing network latency through the use of flow records wherein the network comprises at least two endpoint devices and at least one network infrastructure device, the method comprising the step of:
receiving flow records from at least one device, said flow records comprising at least two flows associated with a first transmission sent from a first communications device and a second transmission from a second communications device, said first transmission comprising a connection set-up indicator and said second transmission comprising a connection set-up acknowledgment indicator; wherein the flow records comprise at least a start time stamp and an end time stamp of the flow associated with said first transmission and at least a start time stamp and an end time stamp of the flow associated with said second transmission; matching said at least two flows; wherein said step of matching said at least two flows comprises the steps of:
matching said at least two flows based on source IP addresses and destination IP addresses associated with each of said at least two flows;matching said at least two flows based on the IP protocol associated with each of said at least two flows;matching said at least two flows based on source ports and destination ports associated with each of said at least two flows;verifying that the start time stamp of the flow associated with said first transmission occurs prior to the start time stamp of the flow associated with said second transmission;verifying that the end time stamp of the flow associated with said first transmission occurs after the start time stamp of the flow associated with said second transmission; determining a intermediate-to-endpoint latency measure based on said time stamps; and storing said intermediate-to-endpoint latency measure on a computer readable storage medium.