Ulllted States Patent
`
`[19]
`
`[11] Patent Number:
`
`6,115,393
`
`Engel et al.
`
`[45] Date of Patent:
`
`Sep. 5, 2000
`
`US006115393A
`
`5,142,528
`5,142,622
`5,150,464
`5,347,524
`
`[54] NETWORK MONITORING
`
`[75]
`
`Inventors: Ferdinand Engel, Northborough;
`Kendal] s_ Jones, Newton Center;
`Kary Robertson, Bedford, all Of Mass.;
`David M. Thompson, Redmond,
`Wash.; Gerard White, Tyngsborough,
`Mass"
`
`[73] Assignee: COIlCOI‘d COIIlIl1llIliC3ti0IlS, IIIC-,
`Marlboro, Mass.
`
`[21] App]. No; 08/505,083
`.
`F1199:
`
`[221
`
`Jul‘ 219 1995
`Related U'S' Application Data
`[60] Division of application No. 07/761,269, Sep. 17, 1991,
`abandoned, which is a continuation—in—part of application
`No. 07/684,695, Apr. 12, 1991, abandoned.
`
`Int. Cl.7 ................................ .. H04J 3/16; H04] 3/22
`[51]
`[52] US. Cl.
`............................................................ .. 370/469
`[58] Field of Search .............................. .. 370/94.1, 85.13,
`370/85.14, 94.2, 110.1, 79, 241, 252, 254,
`465, 464, 466, 467, 469; 395/200, 183.15,
`189.01, 189.04, 200.54, 285, 831; 371/20.1
`
`W0 88/06822
`
`9/1988 WIPO -
`OTHER PUBLICATIONS
`
`Hewlett—Packard brochure regarding local area network
`protocol analyzer (HP 4972A), Jun. 1987.
`F. Kaplan et al., “Application of Expert Systems to Trans-
`mission Maintenance”, IEEE, 1986, pp. 449-453.
`D.M. Chiu et al., “Studying the User and Application
`Behaviour of a Large Network”, Jun. 30, 1988, pp. 1-23.
`R. Sd
`1., “Th D '
`f
`R 1'
`DEC
`Perfo1:ma2:11:eel\t/I:nitor” Tul 151g1l98)8 app
`1:82t13me
`net
`EHL'AHfiS°“’;Kn°IjV1(:dge_B§‘§ed Iiilongofiing. andfcommlz
`pproac
`to ”n erstan mg t e
`e avlor 0 TCP/IP
`Network Protocols ,ACM, 1988, pP~ 210-221
`A.T. Dahbura et al., “Formal Methods for Generating Pro-
`toeol Conformance Test Sequences”, Proceedings of the
`IEEE, vol. 78, N0. 8, Aug. 1990, pp. 1317_1326.
`HeW]e[[_paCkard Datasheet brochure, “Analyzing Tcp/[p
`Networks with the HP 4972A”, Sep. 1989, pp. 1-8.
`.
`.
`N
`firlmary Zxaml"€r—FAJ1t3:t?1h & R. h d
`PC
`ttorney,
`gent, or
`Lrm
`1S
`1c ar son .
`
`.
`
`[56]
`
`References Cited
`
`[57]
`
`ABSTRACT
`
`Us’ PATENT DOCUMENTS
`3/1987 Foster ............................... .. 340/825.06
`4,648,061
`3/1989 Soha.
`4,817,080
`4,887,260 12/1989 Cordell et a1- -
`4>930>159
`5/1990 Kr9V1tZ 91 91-
`-
`5,021,949
`6/1991 Morten et al.
`........................ .. 364/200
`5,025,491
`6/1991 Tsuchiya et al.
`.
`5,038,345
`8/1991 Roth ................................... 340/825.15
`5,060,228 10/1991 Tsutsui et al.
`....................... 370/85.13
`5,097,469
`3/1992 Douglas .
`.
`5,101,402
`3/1992 Chiu et al.
`5,136,580
`8/1992 Videlock et al.
`
`.................. .. 370/85.13
`
`Monitoring is done of communications which occur in a
`network of nodes, each communication being effected by a
`transmission of one or more packets among two or more
`communicating nodes, each communication complying with
`a predefined communication protocol selected from among
`protocols available in the network. The Contents of packets
`d t
`t d
`.
`1
`d .
`1
`t.
`.
`t.
`V: 6696 passlveg “.1
`1“ re?‘ me’ C°mH.1“m°a. 1°“
`1“ 9999999 955991919 W119 91919919 P19199915 15 99“"99
`from the packet contents.
`
`25 Claims, 38 Drawing Sheets
`
`MANAGEMENT
`ws
`
`14
`
`9
`
`2
`
`
`
`2
`
`2
`
`PC
`I‘
`
`PC
`I
`COMPUTE senven
`
`2
`
`2
`
`ws
`I
`
`10
`
`14
`
`MONITORH
`
`BRIDGE
`4
`
`
`
`2
`
`
`
`3
`
`
`
`ROUTER
`4
`
`4
`
`ROUTER
`
`
`
`
`NODE A
`
`NODE B
`
`LAYER n > LAYER n
`.
`.
`O
`C
`
`°
`PACKETS
`°
`LAYER1M» LAYER1
`
` 14
`
`Petitioners‘ EX1007 Page 1
`
`..
`
`8/1992 Kobayashietal.
`8/1992 Owens ........... ..
`9/1992 Sidhu et a1-
`~~
`9/1994 I’Ans0n eta1.
`
`.... .. 370/79
`395/200
`395/200
`...................... .. 371/20.1
`
`
`
`Petitioners' EX1007 Page 1
`
`

`
`tHCtaP3U
`
`Sep. 5, 2000
`
`Sheet 1 of 38
`
`393,511,6
`
`mEEisN3EEEE 3OFNNN
`
`mm5n_s_oox<>w
`
`
`
`motzos.mm>mmm5....EEN
`
`9NNN3VNNN
`
`VN
`
`NNmmhaomEmm>mm_mm:_n_EN.
`maniaEE5.22ENNENVENN
`
`es
`
`3NNN..
`For.J:m@535EEmmfizomEEIOCZOEEVNNSN
`
`NNN
`
`Petitioners‘ EX1007 Page 2
`
`Petitioners' EX1007 Page 2
`
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 2 of 38
`
`6,115,393
`
`APPL';{$Q;'ON
`
`SNMP
`
`SMTP TELNET xwmoows
`
`PRESENTATION
`LAYER
`
`SESSION
`LAYER
`
`TRANSPORT
`
`LAYER
`
`LAYER
`
`LINK
`
`LAYER
`
`PHYSICAL
`LAYER
`
`UDP
`
`TCP
`
`L.
`
`MAC
`ETHERNET
`
`
`
`
`FIG 2
`
`Petitioners‘ EX1007 Page 3
`
`Petitioners' EX1007 Page 3
`
`

`
`U.S. Patent
`
`0025,FeS
`
`3teehS
`
`0n:
`
`»mzmm:»m
`
`8“H3..I.feoP
`
`
`
`&OH.5
`
`Hn.D
`
`E
`
`
`
`19W6349awmo_.._WHP
`
`
`
`Petitioners' EX1007 Page 4
`
`

`
`U.S. Patent
`
`Sep. 5, 2000
`
`Sheet 4 of 38
`
`6,115,393
`
`NODE A
`
`NODE B
`
`LAYER n <—£flg£E—T-S;'P' LAYER n
`
`O
`
`O
`
`O
`
`O
`
`LAYER 1
`
`—"'".-"""
`PACKETS
`LAYER 1
`
`FIG 4
`
`Petitioners‘ EX1007 Page 5
`
`Petitioners' EX1007 Page 5
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 5 of 38
`
`6,115,393
`
`KERNEL ;Q
`
`TEST g6_
`
`BOOT/LOAD gz
`
`STATS 3_§
`
`
`
`
`
`(»Jl\)O®
`
`'
`
`RTP
`
`3.2
`
`
`
`
`CONTROL £2
`
`FIG 5
`
`Petitioners‘ EX1007 Page 6
`
`
`
`EVENT TIMING
`MODULE $Q
`
`ADDRESS TRACKER
`
`
`
`43
`
`
`
`Petitioners' EX1007 Page 6
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 6 of 38
`
`6,115,393
`
`
`
`LAN
`
`REC'V
`
`ISR
`
`LAN
`
`XMIT
`
`ISR
`
`
`
`32
`
`34
`
`FIG 6
`
`Petitioners‘ EX1007 Page 7
`
`Petitioners' EX1007 Page 7
`
`

`
`U.S. Patent
`
`Sep. 5, 2000
`
`Sheet 7 of 38
`
`6,115,393
`
`/-1 30
`
`DLL SEG STATS
`
`frames;
`frameRate;
`frameBuckets:
`
`bytes;
`bytefiate;
`byteBuckets;
`
`
`
`errors;
`
`
`
`
`
`errorRate;
`errorBuckets;
`
`
`
`
`
`
`
`
`’j/-134
`
`rcvOffSegs;
`rcvOffSegRate;
`rcvOffSegBuckets;
`
`
`
` xmtOffSegs;
`xmtOftSeg Rate;
`xmtOffSegBuckets:
`
`136
`
`138
`140
`142
`144
`
`
`
`
`
`
`
`
`DLL PROTOCOL STATS 1
`
`IUNKIIIIIIIIIII
`PROTOCOL
`FRAMES
`FRAM ERATE
`
`transits;
`transitFtate;
`transitBuckets;
`
`
`
`boasts ;
`bcastRate ;
`bcastBuckets;
`
`
`
`
`
`
`DLL PROTOCOL STATS 2
`
`
`
`
`
`
`LINK
`
`PROTOCOL
`FRAMES
`
`FRAMERATE
`
`
`
`
`
`
`DLL PROTOCOL STATS n
`
`IMMIIIIIIIIII
`
`PROTOCOL
`
`FRAMES
`
`FRAMERATE
`
`36
`
`
`
`
`
`
`1
`
`FIG 7A
`
`132
`
` mcasts;
`mcastFtate;
`mcastBuckets;
`
`collisions;
`coliisonfiate;
`
`
`alignment Errors;
`alignment ErrorRate;
`
`enetFrames;
`ene’(FrameRate;
`
`
`
`IIcFrames;
`l|cFrameRate;
`
`
`
`runtFrames;
`runtFrameRate;
`
`
`
`
`
`Petitioners‘ EX1007 Page 8
`
`DLL see ADDR1 /T
`IINKIIIIIIIIIII
`lflflfllflflklllllll
`IHHEHEEEIIIIII
`EEAEEIIIIIIIIII
`INHEIIIIIIII
`EHEEEEENWENMI
`EIMGDNIHDLIII
`ISIIHIIHNHEIIIII
`Iflflsiiflfifllllll
`IIMHESEENIIIII
`ENMHIHIEIIIIIIE 126
`
`102
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Petitioners' EX1007 Page 8
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 8 of 38
`
`6,115,393
`
`/'-146
` MAC ADDR 1
`
`
`
`
`
`
`
`
`152
`
`
`
`
`
`
`
`DLL ADDR1 STATS
`frames;
`frameRate;
`frameBuckets;
`rcvFrames;
`rcvFrameRate;
`xmtFrames;
`xmtFrame Rate;
`
`
`
`
`
`
`
`STATS-PTR
`
`148
`
`0 I
`
`
`
`
`“AC ADD” '
`
`
`
`
`'°"°”S°9S‘
`rcvOffSeg Rate;
`rcvOffSegBuckets;
`
`
`
`
`
`
`
`O *"“°”Se93;
`STATSHH
`xmtOffSegRate:
`xmtOffSegBuckets;
`
`TO DLL DIALOG
`
`RECORD
`
`/'150
`DLL DIALOG LINK1
`
`
`‘58
`
`
`170
`
`I
`
`,
`
`DLL DIALOG LINK 9.
`
`LINK
`
`
`
`168
`170
`
`158
`
`52
`
`//1
`
`EM_CONTFlOL
`START_TIME
`F|FlST.SEEN
`
`LAST_SEEN
`
`mes;
`byteRate;
`by1eBuckets;
`
`rcvBytes;
`rCVBY1eRate:
`xmtBytes;
`
`
`
`
`
`errors‘
`errorRate;
`
`
`
`
`
`
`
`
`
`
`
`errorBuckets;
`rcvErrors;
`rcvErrorRate;
`xmtErrors;
`xmtErrorRate;
`
`
`
`
`
`XmIBCaStS;
`xmtBcastRate;
`xmtBcastBuckets.
`
`xmtMcasts;
`xmtMcastRate;
`xmtMcastBuckets;
`
`
`
`enetFrames;
`enetFrameRate;
`
`||cFrames;
`||cFrameRate;
`
`FIG 7B
`
`154
`
`155
`
`:::iE::2::a.e.
`’
`
`
`
`
`diaIogQ:
`protoco|O
`
`
`DLL PROTOCOL STATS :
`UNK
`PROTOCOL
`
`FRAMES
`FRAMERATE
`.
`
`154
`
`
`
`°
`.
`
`DLL PROTOCOL STATS rn
`LINK
`PROTOCOL
`FRAMES
`FRAMERATE
`
`
`
`
`
`
`
`
`
`
`
`Petitioners‘ EX1007 Page 9
`
`Petitioners' EX1007 Page 9
`
`

`
`U.S. Patent
`
`Sep. 5, 2000
`
`Sheet 9 of 38
`
`6,115,393
`
`
`
`
`
`
`DLL DIALOG 1
`
`
`
`
`LAST_SEEN
`
`
`
`
`
`
`
`175
`172
`
`
`
`180
`182
`
`DLL DIALOG STATS
`
`protocolEntries;
`protocols [10]
`star1Time;
`lastTume;
`alarmssent;
`
`packets;
`nacketfiate:
`bytes;
`byteRate:
`errors;
`
`errorRate;
`fragments;
`fragmentRate;
`rexmts;
`rexmtRate;
`fIowCtrls;
`fIowCtr| Rate;
`
`transpor1Protocol;
`application Protocol;
`
`51319:
`close Reason;
`statePointer;
`
`DIALOGS
`
`FIG 7C
`
`Petitioners‘ EX1007 Page 10
`
`
`
`DLL DIALOGZ
`
`
`
`,7-j
`LL
`
`'
`'
`0
`
`UNK
`
`IHI
`
`STATS‘Pm
`
`1 5
`
`172
`
`176
`
`Petitioners' EX1007 Page 10
`
`

`
`
`
`22222222222222
`++mmodEr:
`2262222um
`
`m>:o<z_
`
`Emod
`
`U.S.Patent
`
`025040<35oz:om_zzoo226222:
`
`
`
`
`
`u2_Bm228"mc2:8228um2262222um225222:Am2:8228ummoommSmzzoo
`
`
`
`:Eo2o.._Oso2o_5m_228mzoBmzzoo
`
`52:mmodEfim
`
`Enosum
`
`225222:um
`
`2262222um
`
`Sep.5,2000
`
`
`ImmodRE.‘E2:wmod:25$2:mmodE25$2:$90E25$2:mmod:25
`Immod$5$595noSo:228m>_8<:Emaz>mmopom
`
`..2282252..2282282:228B2:
`
`885um88:um885um
`
`E228.32
`
`22om<
`
`2202222um226222:um
`
`Sheet10of38
`:528209E05:22822o22oS28van:
`azaodum2252222umo2_m9oumozaodumozaosummocmmmwfidm
`
`IfiomonosoE25Immod5:2E25<53E252:3
`
`:mmod$52$2:macs:25$2:$90E25$2:#90E252:mo»cm
`
`..ZZOQm>_._.O<
`
`mmmixm
`
`E52o2282E2555E25«:5¢_o<no»am.
`E25:mmodE5..
`
`285.25.2o9E92::v_OO;_
`282092829:
`
`2%<5.
`
`:22822:2
`
`6,115,393
`
`$22882,:
`
`
`
`
`
`£282£982mzenmmm_._o>ommm:o>omEm:o>om_mE2:m>:o<z_
`
`
`
`
`
`
`
`Petitioners‘ EX1007 Page 11
`
`Petitioners' EX1007 Page 11
`
`
`
`
`
`
`
`
`
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 11 of 38
`
`6,115,393
`
`f2oo
`
`202
`
`204
`
`206
`
`208
`
`210
`
`
`
`
`
` 212
`
` CURRENT STATE: NODE 1
`
`
`OTHER DATA: NODE 1
`
`CURRENT STATE: NODE 2
`
`OTHER DATA: NODE 2
`
`INDEX OF NEXT ENTRY IN HISTORY TABLE
`
`
`
`HISTORY TABLE
`
`FIG 9A
`
`215
`
`HISTORY TABLE ENTRY
`
`
`
`VENT
`DATA LENGTH
`SEQUENCE NO.
`ACK. SEQ. NO.
`INITIATOR
`
`218
`
`22°
`222
`224
`225
`223
`
`FIG 9B
`
`Petitioners‘ EX1007 Page 12
`
`Petitioners' EX1007 Page 12
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 12 of 38
`
`6,115,393
`
`SEARCH BACK THROUGH HISTORY
`
`230
`
`232 47
`
`D0 NODES 1 AND 2 EACH HAVE AT LEAST
`TWO DATA OR ACK COMBINATIONS WITH
`NO CONNECT/DISCONNECT/ABORT
`
`INTERSPERSE BETWEEN THEM?
`
`234
`
`YES
`
`DO NOT CHANGE STATE
`
`42
`
`ENTER DATA STATE FOR BOTH NODES
`
`236
`
`ACTIVE CONNECTIONS++
`
`233
`
`24° H310
`
`242
`
`SEARCH BACK THROUGH HISTORY
`
`DID NODES 1 & 2 EACH SEND
`CONNECT-RELATED PACKETS
`
`248
`
`
`
`
`CONNECTION
`INITIATOR
`
`UNKNOWN
`
`
`
`
`YES
`
`CONNECTION INITIATOR IS
`FIRST NODE IN HISTORY
`
`EXIT
`
`EXIT
`
`Petitioners‘ EX1007 Page 13
`
`
`
`
`
` FIG 11
`
`
`Petitioners' EX1007 Page 13
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 13 of 38
`
`6,115,393
`
`SEARCH BACK THROUGH HISTORY
`
`250
`
`252 7
`
`DID SAME INITIATOR NODE
`
`SEND DATA TWICE?
`
`258
`
`
`
`
`
`
`NO RETRANSMISSION
`
`HAS OCCURRED
`
`RETRANSMISSION HAS OCCURED
`
`256
`
`RETRANSMISSION ++
`
`EXIT
`
`FIG 12
`
`Petitioners‘ EX1007 Page 14
`
`Petitioners' EX1007 Page 14
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 14 of 38
`
`6,115,393
`
`SEQ.
`
`ISR
`
`RTP
`
`STATS
`
`TR
`
`— — — — — — — —p-
`
`————-up
`
`.__.j
`
`— — -— — — >
`
`1
`
`2
`
`3
`
`4
`
`5
`
`FIG 1 3
`
`SEQ.
`
`STATS
`
`EM
`
`MTM Xmit
`
`WORKSTATION
`
`— — —- — — p
`
`— — — — — — — ->
`
`_ . _ _ _ _ .. — —u.
`
`1
`
`2
`
`3 4
`
`5
`
`6 7
`
`Petitioners‘ EX1007 Page 15
`
`Petitioners' EX1007 Page 15
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 15 of 38
`
`6,115,393
`
`SEQ.
`
`LanlSR
`
`RTP MTM Recv
`
`EM
`
`STATS
`
`MTM Xmit WS
`
`SEQ.
`
`LanISR
`
`RTP MTM Recv
`
`EM CONTROL MTM Xmit WS
`
`Petitioners‘ EX1007 Page 16
`
`Petitioners' EX1007 Page 16
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 16 of 38
`
`6,115,393
`
`
`
`FIG 17
`
`Petitioners‘ EX1007 Page 17
`
`Petitioners' EX1007 Page 17
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 17 of 38
`
`6,115,393
`
`SUMMARY TOOL
`
`Type:
`
`
`
`—QL———Rin
`
`Update *"*e~a'= N°"e~
`mm
`
`_
`Dialogs / Connections
`
`FIG ‘I8
`
`602
`
`604
`
`606
`
`Petitioners‘ EX1007 Page 18
`
`Petitioners' EX1007 Page 18
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 18 of 38
`
`6,115,393
`
`0
`
`Protocol Tree: <Seg. or Node Name>
`
`Protocol: E UDP
`
`oven
`
`
`
`
`
`TFTP
`
`Application ................................................................................. -.
`
`
`
`Presentation ............................................................................... --
`
`
`
` TOP
`
`-EEK
`
`
`
`Petitioners‘ EX1007 Page 19
`
`Petitioners' EX1007 Page 19
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 19 of 38
`
`6,115,393
`
`Data Link
`
`Current
`
`5 Min.
`
`15 Min.
`
`10 Min. Max 60 Min. Max Accum.VaI.
`
`Frame Rate:
`
`nn,nnn ls
`
`nn,nnn /s
`
`nn,nnn /s
`
`nn,nnn /s
`
`nn,nnn /s
`
`n,nnn,nnn
`
`Byte Rate:
`Errors:
`Broadcast Frm. Rate:
`MuIticastFrm. Rate:
`
`nn,nnn Is
`nnn,nnn
`nn,nnn /s
`nn,nnn /s
`
`nn,nnn Is
`nnn,nnn
`nn,nnn /s
`nn,nnn /s
`
`nn,nnn /s
`nnn,nnn
`nn,nnn /s
`nn,nnn /s
`
`nn,nnn /s
`—
`nn,nnn /s
`nn,nnn /s
`
`nn,nnn /s
`-
`nn,nnn /s
`nn,nnn /s
`
`n,nnn,nnn
`n.nnn,nnn
`n,nnn,nnn
`n,nnn,nnn
`
`Off Segment Frames
`In:
`Out:
`"Transit:
`
`nnn °/o
`nnn °/.
`nnn %
`
`nnn %
`nnn %
`nnn %
`
`nnn °/9
`nnn %
`nnn %
`
`nnn °/a
`nnn °/c
`nnn °/o
`
`nnn % n,nnn,nnn
`nnn °/o
`n.nnn,nnn
`nnn °/o
`n.nnn,nnn
`
`Most Active Protocois (Frm. Rate)
`
`Most Active Nodes (Frm. Rate)
`
`1234567890123456
`
`nnn °/o
`
`1234567890123456
`
`nnn %
`
`<protocoi>
`<protocol>
`<protocoi>
`<PV°t°C°'>
`
`nnn %
`nnn °/0
`nnn °/o
`“"9 °/°
`
`<node>
`<node>
`<node>
`<node>
`
`nnn %
`nnn °/0
`nnn %
`nnn %
`
`Total Segment Bandwidth:
`
`nnn %
`
`Total Active Dialogs:
`
`nn. nnn
`
`IP
`
`Current
`
`5 Min.
`
`15 Min.
`
`10 Min. Max 60 Min. Max Accum.Val.
`
`Packet Ratei
`
`nn,nnn /s
`
`nn,nnn /s
`
`nn,nnn /s
`
`nn,nnn /s
`
`nn,nnn /s
`
`n,nnn,nnn
`
`nn,nnn /s
`nnn,nnn
`nn,nnn /s
`
`nn,nnn /s
`nnn,nnn
`nn,nnn /s
`
`nn,nnn /s
`-
`nn,nnn Is
`
`nn,nnn /s
`-
`nn,nnn /s
`
`n,nnn,nnn
`n.nnn,nnn
`n.nnn,nnn
`
`Byte Rate:
`ENOFSI
`Broadcasipkt. Ratei
`
`nn,nnn /s
`nnn,nnn
`nn,nnn /s
`
`MUWCSSIPKT. Ratei
`Flow COFIITOISI
`
`nn,nnn /s
`nnn,nnn
`
`nn,nnn /s
`nnn,nnn
`
`nn,nnn /s
`nnn,nnn
`
`nn,nnn /s
`-
`
`nn,nnn /s
`-
`
`Fragments:
`
`nnn,nnn
`
`nnn,nnn
`
`nnn,nnn
`
`-
`
`-
`
`n.nnn,nnn
`n.nnn,nnn
`
`n,nnn,nnn
`
`Off Segment Packets
`In:
`
`Out:
`
`"Transit:
`
`nnn "/9
`
`nnn %
`
`nnn %
`
`nnn °/o
`
`nnn ‘/0
`
`nnn %
`
`nnn °/2
`
`nnn %
`
`nnn %
`
`nnn %
`
`nnn %
`
`nnn %
`
`nnn % n,nnn,nnn
`
`nnn % n,nnn,nnn
`
`nnn °/o
`
`n,nnn,nnn
`
`Most Active Protocois (Pkt. Rate)
`
`Most Active Nodes (Pkt. Rate)
`
`1234567890123456
`
`nnn °/o
`
`1234557890123456
`
`nnn °/o
`
`<P'°1°C°'>
`
`<Pf°*°C°'>
`<P'0t°°°'>
`
`<P"°t°°°'>
`
`nnn °/o
`
`nnn ‘Va
`""71 "/0
`
`“W1 ‘’/=
`
`<node>
`
`<node>
`<node>
`
`<node>
`
`nnn %
`
`nnn %
`nnn %
`
`nnn %
`
`Total Segment Bandwidth:
`
`nnn %
`
`T013|AC1iV€ Dialog?-3
`
`“WW1
`
`FIG 20B
`
`Petitioners‘ EX1007 Page 20
`
`Petitioners' EX1007 Page 20
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 20 of 38
`
`6,115,393
`
`UDP
`Packet Rate:
`
`Current
`nn.nnn /s
`
`5 Min.
`nn,nnn/s
`
`15 Min.
`nn.nnn /s
`
`10 Min. Max 60 Min. Max Accum.Va|.
`nn.nnn /s
`nn.nnn /s
`n,nnn,nnn
`
`nn,nnn/s
`ByteRate:
`ETTOTSI nnn,nnn
`Flow Controls: nnn,nnn
`
`nn,nnn/s
`nnn,nnn
`nnn,nnn
`
`nn,nnn/s
`nnn,nnn
`nnn,nnn
`
`nn,nnn/s
`-
`-
`
`nn,nnn/s
`-
`-
`
`n,nnn,nnn
`n,nnn,nnn
`n,nnn,nnn
`
`Off Segment Packets
`|n;
`out
`"Transit;
`
`nnn °/s
`nnn °/o
`nnn °/o
`
`nnn %
`nnn °/o
`nnn °/o
`
`nnn %
`nnn %
`nnn °/o
`
`nnn %
`nnn °/o
`nnn °/o
`
`nnn % n,nnn,nnn
`nnn °/o
`n,nnn,nnn
`nnn % n,nnn,nnn
`
`Most Active Protocols (Pkt. Rate)
`
`Most Active Nodes (Pkt. Rate)
`
`1234567890123456
`
`nnn %
`
`1234567890123456
`
`nnn °/o
`
`<protocol>
`<protocol>
`<protocol>
`<protocoi>
`
`nnn %
`nnn °/o
`nnn °/o
`nnn °/o
`
`<node>
`<node>
`<node>
`<node>
`
`nnn °/o
`nnn °/o
`nnn %
`nnn °/o
`
`Total Segment Bandwidth:
`
`nnn °/o
`
`Total Active Dialogs:
`
`nn.nnn
`
`FIG 20C
`
`TCP
`
`Current
`
`5 Min.
`
`15 Min.
`
`to Min. Max 60 Min. Max Accum.VaI.
`
`PBCKGIRBTGI
`BY19 Ratei
`EFTOFSI
`Flow Controls:
`Retfansmissiflnsi
`
`nn.nnn/s
`nn,nnn/s
`nnn,nnn
`nnn,nnn
`nnn,nnn
`
`nn.nnn /s
`nn,nnn/s
`nnn.nnn
`nnn,nnn
`nnn,nnn
`
`nn,nnn/s
`nn,nnn/s
`nnn,nnn
`nnn,nnn
`nnn,nnn
`
`nn.nnn/s
`nn,nnn/s
`-
`-
`-
`
`nn.nnn /s
`nn.nnn/s
`-
`-
`-
`
`n,nnn,nnn
`n,nnn,nnn
`n,nnn,nnn
`n,nnn,nnn
`n,nnn,nnn
`
`Off Segment Packets
`In:
`Out:
`"Transit:
`
`nnn %
`nnn °/o
`nnn %
`
`nnn %
`nnn %
`nnn %
`
`nnn °/o
`nnn °/u
`nnn %
`
`nnn %
`nnn °/o
`nnn %
`
`nnn % n,nnn,nnn
`nnn % n,nnn,nnn
`nnn % n,nnn,nnn
`
`Most Active Protocols (Pkt. Rate)
`
`Most Active Nodes (Pkt. Rate)
`
`1234567890123456
`
`nnn °/o
`
`1234567890123456
`
`nnn °/o
`
`<protoco|>
`<protocoI>
`<protocoi>
`<protocoi>
`
`nnn %
`nnn °/o
`nnn °/o
`nnn °/o
`
`Tomi Segment Bandwidth;
`
`nnn 0/0
`
`<node>
`<node>
`<node>
`<node>
`
`nnn °/o
`nnn °/o
`nnn %
`nnn %
`
`nn,nnn
`Total Active Connections:
`FIG 20D
`
`Petitioners‘ EX1007 Page 21
`
`Petitioners' EX1007 Page 21
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 21 of 38
`
`6,115,393
`
`ICMP
`
`Current
`
`5 Min.
`
`15 Min.
`
`10 Min. Max 60 Min. Max Accum.Va|.
`
`F’acketRate:
`
`nn,nnn /s
`
`nn,nnn /s
`
`nn,nnn/s
`
`nn,nnn/s
`
`nn,nnn/s
`
`n,nnn,nnn
`
`nn,nnn /s
`ByteRate:
`Errors: nnn,nnn
`
`nn,nnn /s
`nnn,nnn
`
`nn,nnn/s
`nnn,nnn
`
`nn,nnn Is
`-
`
`nn.nnn ls
`—
`
`n,nnn.nnn
`n,nnn,nnn
`
`Off Segment Packets
`mg
`out;
`"Transit;
`
`nnn %
`nnn °/o
`nnn %
`
`nnn °/o
`nnn ‘/o
`nnn %
`
`nnn °/o
`nnn %
`nnn %
`
`nnn °/o
`nnn °/o
`nnn %
`
`n,nnn,nnn
`nnn °/o
`n,nnn.nnn
`nnn °/9
`nnn % n,nnn.nnn
`
`ICMP Types Seen (Count)
`
`Most Active Nodes (Pkt. Rate)
`
`Address Mask: nnn,nnn
`Dst. Unreachabie: nnn,nnn
`Echo: nnn,nnn
`Param. Problem: nnn,nnn
`
`Redirect: nnn,nnn
`Source Quencn: nnn,nnn
`fime Exceeded: nnn,nnn
`fime Stamp: nnn,nnn
`
`Total Segment Bandwidth:
`
`nnn °/o
`
`1234567B90123456
`<node>
`<node>
`<node>
`<node>
`
`nnn °/o
`nnn %
`nnn %
`nnn o/C,
`nnn °/o
`
`FIG 20E
`
`NFS
`
`Current
`
`5 Min.
`
`15 Min.
`
`10 Min. Max 60 Min. Max Accum.Va|.
`
`PacketRate:
`
`nn,nnn/s
`
`nn,nnn /s
`
`nn,nnn/s
`
`nn,nnn/s
`
`nn,nnn/s
`
`n,nnn,nnn
`
`nn,nnn/s
`By1eFiate:
`Errors: nnn,nnn
`
`nn.nnn /s
`nnn,nnn
`
`nn,nnn/s
`nnn,nnn
`
`nn,nnn /s
`-
`
`nn,nnn/s
`-
`
`Flow Controls: nnn,nnn
`
`nnn,nnn
`
`nnn,nnn
`
`-
`
`-
`
`n,nnn,nnn
`n,nnn,nnn
`
`n,nnn,nnn
`
`Off Segment Packets
`In:
`
`Out:
`
`"Transit:
`
`nnn %
`
`nnn %
`
`nnn %
`
`nnn °/o
`
`nnn °/o
`
`nnn %
`
`nnn °/..
`
`nnn %
`
`nnn %
`
`nnn %
`
`nnn °/o
`
`nnn %
`
`nnn % n,nnn.nnn
`
`nnn °/o
`
`n,nnn,nnn
`
`nnn °/o
`
`r_1,nnn,nnn
`
`Total Segment Bandwidth:
`
`nnn °/0
`
`Most Active Nodes (Pkt. Rate)
`
`1234567890123456
`
`nnn %
`
`<node>
`
`<node>
`<node>
`
`<node>
`
`nnn %
`
`nnn °/o
`nnn °/o
`
`nnn °/o
`
`Total Active Dialogs:
`nn. nnn
`FIG 20F
`
`Petitioners‘ EX1007 Page 22
`
`Petitioners' EX1007 Page 22
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 22 of 38
`
`6,115,393
`
`A /Rrp
`arp
`Packetflatez
`
`Current
`nn,nnn /s
`
`5 Min.
`nn,nnn /s
`
`15 Min.
`nn,nnn /s
`
`10 Min. Max 60 Min. Max Accum.Val.
`nn,nnn /s
`nn,nnn /s
`n,nnn,nnn
`
`nn,nnn /s
`Byte Rate:
`Errors: nnn,nnn
`
`nn,nnn /s
`nnn,nnn
`
`nn,nnn/s
`nnn.nnn
`
`nn.nnn /s
`-
`
`nn,nnn /s
`—
`
`n,nnn,nnn
`n,nnn,nnn
`
`Off Segment Packets
`|n;
`
`out
`
`"Transit;
`
`nnn %
`
`nnn %
`
`nnn °/.
`
`nnn %
`
`nnn %
`
`nnn %
`
`nnn °/.
`
`nnn %
`
`nnn °/o
`
`nnn %
`
`nnn °/o
`
`nnn °/.
`
`nnn % n,nnn,nnn
`
`nnn °/o
`
`n,nnn,nnn
`
`nnn °/.
`
`n,nnn,nnn
`
`Total Segment Bandwidth:
`
`nnn %
`
`Most Active Nodes (Pkt. Hate)
`
`1234567890123456
`
`nnn %
`
`<node>
`<node>
`<node>
`<node>
`
`nnn %
`nnn %
`nnn °/o
`nnn °/o
`
`FIG 20G
`
`Packets
`
`Last
`Stan
`Hate
`Protocols
`Panner Node
`Dir.
`Seen
`Time
`hhzmmzss hh:mm:ss1234 1234567890123456 1234567890123456 nn,nnn /s
`
`Summary
`Count
`°/.
`nnn ‘/9 n,nnn,nnn
`
`Errors
`nnn,nnn
`
`1023204
`07:21:38
`
`robin
`15:31:47 To
`1:325:51 From hawk
`
`XNS,XEROX-PUP
`DOD-IP. X25
`
`325/5
`87/5
`
`6%
`3%
`
`10/31/90 082230 ?
`
`hawk
`
`BBN-SIMNET
`APPLETALK
`
`13/5
`
`1%
`
`2,641
`127
`
`P
`24,192
`
`0
`1
`
`4
`
`FIG 21
`
`Petitioners‘ EX1007 Page 23
`
`Petitioners' EX1007 Page 23
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 23 of 38
`
`6,115,393
`
`@
`
`Data Tool
`“Wale Rate‘ “°"e
`Tvr>e= snammL——— __
`99+
`
`Current
`
`T "cal
`
`Hi
`
`-
`
`Hi9“
`Threshold
`
`Sampling
`Flate
`
`6390GOOGOO
`
`6696G93G66
`
`
`
`CODECJGCGOO
`
`620
`
`,
`
`622
`
`Rate Values
`
`Frame lilate (Is)
`n
`Out
`Total
`Ofl Seg. Frame Rate (Is)
`ln
`Out
`Total
`Local Frame Rate (Is)
`In
`Out
`Total
`Byte Ra|te (Is)
`n
`
`Count Values
`
`I.‘-an
`
`Frames
`
`ln
`Out
`Total
`Oll Seg. Frames
`In
`
`W
`Total
`Local Frames
`In
`Out
`Total
`Bytes
`
`In
`
`Protocols Seen
`
`—————— Count
`Della
`Ha Delta
`
`-—~~——--
`Low Delta
`
`DOD IF
`ARP
`
`Total
`
`31.678
`205
`
`Currem
`
`0 /s
`
`FIG 22
`
`Petitioners‘ EX1007 Page 24
`
`Petitioners' EX1007 Page 24
`
`

`
`U.S. Patent
`
`Sep. 5, 2000
`
`Sheet 24 of 38
`
`6,115,393
`
`Seg2
`
`Seg3
`
`frame
`
`trame
`
`byte
`GITOT
`
`frame
`
`byte
`GITOI’
`
`FIG 23
`
`Petitioners‘ EX1007 Page 25
`
`Petitioners' EX1007 Page 25
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 25 of 38
`
`6,115,393
`
`SEND LEARNING COMMAND
`TO MONITOR
`
`302
`
`O4
`
`
`
`PERFORMANCE
`HISTORY
`
`PERIODICALLY SAMPLE & STORE
`SNAPSHOTS OF RELEVANT
`PERFORMANCE PARAMETERS
`
`— - — -
`
`DATABASE
`
`:
`
`308
`
`I
`
`E
`
`AFTER LEARNING PERIOD HAS
`EXPIRED, SEND STOP LEARNING
`COMMAND TO MONITOR
`
`COMPUTE STATISTICS FOR
`RELEVANT PERFORMANCE
`PARAMETERS
`
`
`
`ESTABLISH NEW SET OF
`THRESHOLDS FOR RELEVANT
`
`PARAMETERS
`
`SEND NEW SET OF
`THRESHOLDS TO MONITOR
`
`314
`
`EXIT
`
`FIG 24
`
`Petitioners‘ EX1007 Page 26
`
`Petitioners' EX1007 Page 26
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 26 of 38
`
`6,115,393
`
`32°
`322 0
`
`ROUTER
`
`324
`
`24
`
`324
`
`ROUTER
`
`«:2
`
`FIG 25
`
`SEGMENT S1
`
`SEGMENT S2
`
`SEGMENT S3
`
`Petitioners‘ EX1007 Page 27
`
`Petitioners' EX1007 Page 27
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 27 of 38
`
`6,115,393
`
`/\ 400
`
`402
`
`IS THERE TCP PROBLEM AT NODE A (SOURCE)?
`YES
`
`TELL USER THERE S A HIGH
`PROBABILITY PROBLEM AT
`NODE A (SOURCE) AND REPORT
`DETAILS OF INVESTIGATION
`
`
`
`
`404
`
`
`
`IS THERE TOP PROBLEM AT NODE B (SINK)?
`YES
`
`406
`
`4
`
`Em
`
`Em
`
`NO
`
`No
`
`
`
`
`TELL USER THERE IS A HIGH
`
`PROBABILITY PROBLEM AT
`NODE B (SINK) AND REPORT
`DETAILS OF INVESTIGATION
`
`08
`
`
`
`IS THERE TCP PROBLEM ON LINK?
`YES
`
`410
`
`No
`
`TELL USER THERE IS A HIGH
`PROBABILITY OF PROBLEM ON
`LINK AND REPORT DETAILS OF
`INVESTIGATION
`
`
`
`412
`
`Em
`
`IS THERE TCP PROBLEM AT NODE B (SOURCE)?
`
`414
`
`No
`
`YES
`
`TELL USER THERE IS A
`MEDIUM PROBABILITY OF PROBLEM
`
`
`ON NODE B (SOURCE) AND REPORT
`
`
`DETAILS OF INVESTIGATION
`
`416
`
`Em
`
`413
`
`Is THERE TOP PROBLEM AT NODE A (SINK)?
`YES
`
`42°
`
`NO
`
`492
`
`NOT ABLE TO
`ISOLATE
`LOCATION OF
`
`PROBLEM
`
`EXIT
`
`TELL USER THERE IS A
`MEDIUM PROBABILITY OF PROBLEM
`ON NODE A (SINK) AND REPORT
`DETAILS OF INVESTIGATION
`
`
`
`
`Em
`
`Petitioners‘ EX1007 Page 28
`
`Petitioners' EX1007 Page 28
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 28 of 38
`
`6,115,393
`
`F450
`
`452
`
`IS ANY OTHER TCP FOR THIS
`SOURCE NODE OK’?
`
`YES
`
`454
`
`NO
`
`REPLY NO NODE PROBLEM
`
`456
`
`EXIT
`
`IS THERE A DLL PROBLEM
`FOR THIS SOURCE NODE
`
`YES
`
`458
`
`NO
`
`REPLY DLL PROBLEM FOR NODE
`
`460
`
`EXIT
`
`IS THERE AN IP PROBLEM
`FOR THIS SOURCE NODE
`
`YES
`
`452
`
`NO
`
`REPLY IP PROBLEM FOR NODE
`
`454
`
`EXIT
`
`ARE ANY OTHER TCP'S ON
`THIS SOURCE NODE NOT OK?
`
`YES
`
`466
`
`NO
`
`REPLY TCP PROBLEM ON NODE
`
`EXIT
`
`EX”
`
`FIG 27
`
`Petitioners‘ EX1007 Page 29
`
`Petitioners' EX1007 Page 29
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 29 of 38
`
`6,115,393
`
`[\470
`
`472
`
`IS ANY OTHER TCP FOR THIS
`SINK NODE OK?
`
`YES
`
`474
`
`NO
`
`REPLY NO NODE PROBLEM
`
`475
`
`IS THERE A DLL PROBLEM
`FOR THIS SINK NODE?
`
`YES
`
`478
`
`REPLY DLL PROBLEM FOR NODE
`WHEN ACTING AS SINK
`
`NO
`
`480
`
`IS THERE AN IP PROBLEM
`FOR THIS NODE WHEN
`ACTING As A sum
`
`YES
`
`432
`
`N0
`
`REPLY IP PROBLEM FOR NODE
`WHEN ACTING AS SINK
`
`484
`
`ANY OTHER TCP'S ON THIS
`K?
`SINK NODE O
`
`YEs
`
`488
`
`N0
`
`REPLY TCP PROBLEM ON NODE
`WHEN ACTING As SINK
`
`em
`
`FIG 28
`
`Petitioners‘ EX1007 Page 30
`
`Petitioners' EX1007 Page 30
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 30 of 38
`
`6,115,393
`
`LINK ANALYSIS
`
`LOGIC
`
`F 55°
`
`
`
`552
`
`IS ANY OTHER TCP ON
`THIS LINK OK?
`
`NO
`
`554
`
`
`
`DECOMPOSE LINK
`
`REPLY NO LINK PROBLEM
`
`554
`
`
`
`556
`
`IS LINK COMPONENT
`PROBLEM AT IP?
`
`
`
`
`
`
`557
`
`REPLY IP PROBLEM ON LINK
`
`558
`
`559
`
`
`
` IS THERE A LINK
`COMPONENT PROBLEM
`AT DLL?
`
`
`
`REPLY DLL PROBLEM ON LINK
`
`560
`
`IS THERE ANOTHER TCP
`ON THIS LINK?
`
`562
`
`
`
`REPLY TCP PROBLEM ON LINK
`
`
`
`
`FIG 29
`
`REPLY THAT THERE IS
`NOT ENOUGH INFO TO
`DETERMINE IF THERE
`IS A LINK PROBLEM
`
`
`
`Petitioners‘ EX1007 Page 31
`
`Petitioners' EX1007 Page 31
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 31 of 38
`
`6,115,393
`
`[M90 492
`
`
`
`
`
`
`
`NO
`
`
`
`CHECK IP STATISTICS AGAINST
`MODEL
`
`4 94
`
`ARE THERE ANY SIGNIFICANT
`
`DEVIATIONS FROM IP MODEL?
`
`YES
`
`496
`
`
`
`
`REPLY IP PROBLEM AT NODE
`
`498
`
`
`
`
`
`
`EXIT
`
`REPLY NO IP
`
`PROBLEM AT NODE
`
`I-\510 512
`
`
`
`
`
`
`
`CHECK DLL STATISTICS
`AGAINST MODEL
`
`514
`
`ARE THERE ANY SIGNIFICANT
`DEVIATIONS FROM DLL MODEL?
`
`YES
`
`516
`
`
`
`REPLY DLL PROBLEM AT NODE
`
`518
`
`REPLY NO DLL
`PROBLEM AT NODE
`
`Petitioners‘ EX1007 Page 32
`
`Petitioners' EX1007 Page 32
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 32 of 38
`
`6,115,393
`
`
`
`JNWWO 572
`
`CHECK IP STATISTICS FOR LINK
`
`COMPONENT AGAINST MODEL
`
`574
`
`ARE THERE ANY SIGNIFICANT
`DEVIATIONS FROM IP LINK
`
`COMPONENT MODEL?
`
`YES
`
`575
`
`REPLY IP PROBLEM AT LINK
`
`EXIT
`
`FIG 32
`
`
`
`REPLY NO IP
`
`
`PROBLEM AT LINK
`
`COMPONENT
`
`578
`
`EXIT
`
`
`
`CHECK DLL STATISTICS FOR L
`
`COMPONENT AGAINST MODE
`
`K
`
`IN
`L
`
`F580 582
`
`
`58
`
`4
`
`
`
`
`
`
`
`ARE THERE ANY SIGNIFICANT
`DEVIATIONS FROM DLL LINK
`
`
`
`
`
`COMPONENT MODEL?
`
`YES
`
`586
`
`REPLY DLL PROBLEM AT LINK
`
`EXIT
`
`588
`
`
`
`
`
`REPLY NO DLL
`
`PROBLEM AT LINK
`
`COMPONENT
`
`FIG 33
`
`EXIT
`
`Petitioners‘ EX1007 Page 33
`
`Petitioners' EX1007 Page 33
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 33 of 38
`
`6,115,393
`
`9'“-09
`
`ENTRY
`
`TYPE
`
`START
`
`TIME
`
`AVERAGE TRANSACTION 3
`
`TIME
`
`300
`
`302
`
`302
`
`302
`
`302
`
`304
`
`30
`
`30
`
`310
`
`FIG 34
`
`Petitioners‘ EX1007 Page 34
`
`Petitioners' EX1007 Page 34
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 34 of 38
`
`6,115,393
`
`
`
`GET NEXT PACKET
`
`320
`
`
`
`IS IT A START TIME?
`
`NO
`
`COMPUTE TRANSACTION
`TIME
`
`TIME THIS EVENT?
`
`YES
`
`326
`
`
`
`ADD TIME TO EVENT
`TIMING DATABASE
`
`
`
`COMPUTE AVERAGE
`TRANSACTION TIME
`
`
`
`
`DELETE OLD
`
`
`
`
`332
`
`334
`
`FIG 35
`
`Petitioners‘ EX1007 Page 35
`
`Petitioners' EX1007 Page 35
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 35 of 38
`
`6,115,393
`
`711
`
`711
`
`711
`
`FILE SERVER
`
`GATEWAY
`
`7°
`
`703
`
`711
`
`MONITOR
`
`710
`
`714
`
`712
`
` 706
`
`703
`
`umx
`
`GATEWAY
`
`704
`
`NFS FILE SERVER
`
`MANAGEMENT
`
`w
`
`716
`
`FIG 36
`
`Petitioners‘ EX1007 Page 36
`
`Petitioners' EX1007 Page 36
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 36 of 38
`
`6,115,393
`
`724
`
`725
`
`728
`
`729
`
`d%
`
`TIME
`
`NODE NAME
`
`NODE ADDRESS
`
`IP ADDRESS
`
`722
`
`722
`
`FIG 37
`
`Petitioners‘ EX1007 Page 37
`
`Petitioners' EX1007 Page 37
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 37 of 38
`
`6,115,393
`
`GET NEXT PACKET
`
`307
`
`7
`
`32
`
`NO
`
`YES
`
`735
`
`is IT NEW NAME LOOK UP?
`
`NO
`
`IS IT A LOOKUP
`
`REPLY?
`
`Yes
`
` 2
`
`740
`
`ADD/CHANGE ADDRESS
`
`TO NAME TABLE
`
`DELETE OLD
`:28
`AGE NAMES?
`MES
`
`744
`
`AWAIT NEXT
`
`745
`
`PACKET
`
`FIG 38
`
`Petitioners‘ EX1007 Page 38
`
`
`
`ADD NAME T0
`TABLE
`
`347
`
`YES
`
`
`
`738
`
`Petitioners' EX1007 Page 38
`
`

`
`U.S. Patent
`
`Sep. 5,2000
`
`Sheet 38 of 38
`
`6,115,393
`
`DO NAME TABLE WORK
`
`
`
`“'0
`
`
`
`748
`
` 750
`
`IS IT AN IP
`
`ADDRESS RESPONSE?
`
`YES
`
`
`
`752
`
`754
`
`
`
`LOOK UP
`REQUESTOR NAME
`
`IN NAME TABLE
`
`
`
`ADD REQUESTOR NAME,
`
`REQUESTOR ADDRESS
`
`AND IF ADDRESS
`
`TO NAME TABLE
`
`PURGE OLD IP
`
`ADDRESS
`
`RETURN
`
`756
`
`
`
`758
`
`FIG 39
`
`Petitioners‘ EX1007 Page 39
`
`Petitioners' EX1007 Page 39
`
`

`
`6,115,393
`
`1
`NETWORK MONITORING
`
`CROSS REFERENCE TO RELATED
`APPLICATION
`
`This is a divisional of application Ser. No. 07/761,269
`filed on Sep. 17, 1991, now abandoned, which is a
`continuation-in-part of U.S. patent application, Ser. No.
`07/684,695, filed Apr. 12, 1991, now abandoned.
`REFERENCE TO MICROFICHE APPENDIX
`
`A Microfiche Appendix containing fourteen microfiche
`accompanies this patent application pursuant to 37 CFR
`§1.96(b) and is designated as Appendix VI. The first thirteen
`microfiche each contain 49 frames and the fourteenth micro-
`fiche contains 18 frames.
`
`BACKGROUND OF THE INVENTION
`
`The invention relates to monitoring and managing com-
`munication networks for computers.
`Today’s computer networks are large complex systems
`with many components from a large variety of vendors.
`These networks often span large geographic areas ranging
`from a campus-like setting to world wide networks. While
`the network itself can be used by many different types of
`organizations,
`the purpose of these networks is to move
`information between computers. Typical applications are
`electronic mail,
`transaction processing, remote database,
`query, and simple file transfer. Usually, the organization that
`has installed and is running the network needs the network
`to be running properly in order to operate its are various
`controls provided by the different equipment to control and
`manage the network. Network management is the task of
`planning, engineering, securing and operating a network.
`To manage the network properly, the Network Manager
`has some obvious needs. First, the Network Manager must
`trouble shoot problems. As the errors develop in a running
`network, the Network Manager must have some tools that
`notify him of the errors and allow him to diagnose and repair
`these errors. Second, the Network Manager needs to con-
`figure the network in such a manner that the network loading
`characteristics provide the best service possible for the
`network users. To do this the Network Manager must have
`tools that allow him visibility into access patterns, bottle-
`necks and general loading. With such data, the Network
`Manager can reconfigure the network components for better
`service.
`
`There are many different components that need to be
`managed in the network. These elements can be, but are not
`limited to:
`routers, bridges, PC’s, workstations,
`minicomputers, supercomputers, printers,
`file servers,
`switches and pbx’s. Each component provides a protocol for
`reading and writing the management variables in the
`machine. These variables are usually defined by the com-
`ponent vendor and are usually referred to as a Management
`Information Base (MIB). There are some standard MIB’s,
`such as the IETF (Internet Engineering Task Force) MIB I
`and MIB II standard definitions. Through the reading and
`writing of MIB variables, software in other computers can
`manage or control
`the component. The software in the
`component that provides remote access to the MIB variables
`is usually called an agent. Thus, an individual charged with
`the responsibility of managing a large network often will use
`various tools to manipulate the MIB’s of various agents on
`the network.
`
`Unfortunately, the standards for accessing MIBs are not
`yet uniformly provided nor are the MIB definitions complete
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`2
`enough to manage an entire network. The Network Manager
`must therefore use several different types of computers to
`access the agents in the network. This poses a problem, since
`the errors occurring on the network will tend to show up in
`different computers and the Network Manager must there-
`fore monitor several different screens to determine if the
`
`network is running properly. Even when the Network Man-
`ager is able to accomplish this task, the tools available are
`not sufficient for the Network Manager to function properly.
`Furthermore, there are many errors and loadings on the
`network that are not reported by agents. Flow control
`problems, retransmissions, on-off segment loading, network
`capacities and utilizations are some of the types of data that
`are not provided by the agents. Simple needs like charging
`each user for actual network usage are impossible.
`
`SUMMARY OF THE INVENTION
`
`In general, in one aspect, the invention features monitor-
`ing communications which occur in a network of nodes,
`each communication being effected by a transmission of one
`or more packets among two or more communicating nodes,
`each communication complying with a predefined commu-
`nication protocol selected from among protocols available in
`the network. The contents of packets are detected passively
`and in real time, communication information associated with
`multiple protocols is derived from the packet contents.
`Preferred embodiments of the invention include the fol-
`
`lowing features. The communication information derived
`from the packet contents is associated with multiple layers
`of at least one of the protocols.
`In general, in another aspect, the invention features moni-
`toring communication dialogs which occur in a network of
`nodes, each dialog being effected by a transmission of one
`or more packets among two or more communicating nodes,
`each dialog complying with a predefined communication
`protocol selected from among protocols available in the
`network. Information about the states of dialogs occurring in
`the network and which comply with different selected pro-
`tocols available in the network is derived from the packet
`contents.
`Preferred embodiments of the invention include the fol-
`
`lowing features. A current state is maintained for each
`dialog, and the current state is updated in response to the
`detected contents of transmitted packets. For each dialog, a
`history of events is maintained based on information derived
`from the contents of packets, and the history of events is
`analyzed to derive information about the dialog. The analy-
`sis of the history includes counting events and gathering
`statistics about events. The history is monitored for dialogs
`which are inactive, and dialogs which have been inactive for
`a predetermined period of time are purged. For example, the
`current state is updated to data state in response to observing
`the transmission of at least two data related packets from
`each node. Sequence numbers of data related packets stored
`in the history of events are analyzed and retransmissions are
`detected based on the sequence numbers. The current state
`is updated based on each new packet associated with the
`dialog; if an updated current state cannot be determined,
`information about prior packets associated with the dialog is
`consulted as an aid in updating the state. The history of
`events may be searched to identify the initiator of a dialog.
`The full set of packets associated with a dialog up to a
`point in time completely define a true state of the dialog at
`that point in time, and the step of updating the current state
`in response to the detected contents of transmitted packets
`includes generating a current state (e.g., “unknown”) which
`
`Petitioners‘ EX1007 Page 40
`
`Petitioners' EX1007 Page 40
`
`

`
`6,115,393
`
`3
`may not conform to the true state. The current state may be
`updated to the true state based on information about prior
`packets transmitted in the dialog.
`Each communication may involve multiple dialogs cor-
`responding to a specific protocol. Each protocol layer of the
`communication may be parsed and analyzed to isolate each
`