Identifying related network traffic data for monitoring and analysis

摘要

Network traffic information from multiple sources, at multiple time scales, and at multiple levels of detail are integrated so that users may more easily identify relevant network information. The network monitoring system stores and manipulates low-level and higher-level network traffic data separately to enable efficient data collection and storage. Packet traffic data is collected, stored, and analyzed at multiple locations. The network monitoring locations communicate summary and aggregate data to central modules, which combine this data to provide an end-to-end description of network traffic at coarser time scales. The network monitoring system enables users to zoom in on high-level, coarse time scale network performance data to one or more lower levels of network performance data at finer time scales. When high-level network performance data of interest is selected, corresponding low-level network performance data is retrieved from the appropriate distributed network monitoring locations to provide additional detailed information.

主权项

1. A method of identifying related network traffic, the method comprising:
receiving a selection of first network traffic data; identifying a network destination associated with the selected first network traffic data; retrieving at least one previously stored first data fingerprint attribute associated with the selected first network traffic data; identifying second network traffic data originating at the network destination; searching the second network traffic data to identify a subset of the second network traffic data having a previously stored second data fingerprint attribute matching the first data fingerprint attribute, wherein the searching comprises:
accessing a first portion of the second network traffic data including at least one reference to a second portion of the second network traffic data, wherein the first portion of the second network traffic data is stored at a first network location and the second portion of the second network traffic data is stored at a second network location, and wherein the first portion of the second network traffic data is at a first time scale and the second portion of the second network traffic data is at a second time scale coarser than the first time scale;using the reference, accessing the second portion of the second network traffic to retrieve the second data fingerprint attribute; andcomparing the second data fingerprint attribute with the first data fingerprint attribute; adding the subset of the second network traffic data to related network traffic data; and returning the related network traffic data.