Media slice tracking in communication network

Abstract

Examples disclosed herein relate to a method performed by a remote capture server that tracks media slices through at least a portion of a communication network comprising a plurality of network elements, the method comprising checking a first payload of a first data packet observed at an egress capture point of a first network element; checking a second payload of a second data packet observed at an ingress capture point of a second network element; comparing the first payload with the second payload and in response to determining that the first payload and the second payload are the same, associating the first data packet with the second data packet; wherein the first data packet and the second data packet correspond to the first media slice in response to determining that the first data packet and the second data packet are associated.

Description

Background Art

[0001] Communication networks, such as Voice over Internet Protocol (VoIP) networks and other types of packet-based communication networks, facilitate media services such as video / audio calls and audio / video streaming by transmitting any one or more of media such as image, video, and audio signals between computing devices.

[0002] When providing media services in a communication network, performance or quality degradation is a common problem encountered. Examples of poor media quality include, but are not limited to: pixelated video, video loss, audio loss, and noisy audio.

[0003] The embodiments described below are not limited to implementations that solve any or all of the disadvantages of known ways of tracking media streams in communication networks. Summary of the Invention

[0004] The following presents a simplified overview of the present disclosure in order to provide a basic understanding to the reader. This summary of the invention is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Its sole purpose is to present a selection of concepts disclosed herein in a simplified form as a prelude to a more detailed description that is presented later.

[0005] For identifying the causes of media quality problems, it is useful to track media slices through a communication network, such as in the case of providing video, audio, or other services in a VoIP communication network.

[0006] In various examples, there is a method performed by a remote capture server that tracks media slices through at least a portion of a communication network including a plurality of network elements. The method includes: examining a first payload of a first data packet observed at an egress capture point of a first network element; examining a second payload of a second data packet observed at an ingress capture point of a second network element; comparing the first payload with the second payload; in response to determining that the first payload and the second payload are the same, associating the first data packet with the second data packet; wherein in response to determining that the first data packet and the second data packet are associated, the first data packet and the second data packet correspond to a first media slice; examining a third payload and / or metadata of a third data packet observed at the ingress capture point of the second network element; examining a fourth payload and / or metadata of a fourth data packet observed at the egress capture point of the second network element; comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet; in response to determining that the third payload and / or metadata of the third data packet and the fourth payload and / or metadata of the fourth data packet are the same, associating the third data packet with the fourth data packet; wherein in response to determining that the third data packet and the fourth data packet are associated, the third data packet and the fourth data packet correspond to a second media slice; and wherein in response to determining that the second data packet and the third data packet are the same data packet: associating the first, second, or third data packet with the fourth data packet; and recording the first media slice and the second media slice as a common media slice. Wherein in response to determining that the second data packet and the third data packet are not the same data packet: recording the first media slice and the second media slice as different media slices.

[0007] Many related features will be more readily understood when considered in conjunction with the following detailed description and with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The present description will be better understood by reading the following detailed description in conjunction with the accompanying drawings, in which:

[0009] Figure 1 is a diagram showing a communication network for facilitating the transmission of media slices.

[0010] Figure 2A is a diagram showing the egress-to-ingress association of data packets.

[0011] Figure 2B is a diagram showing the ingress-to-egress association of data packets.

[0012] Figure 2C is a diagram showing the ingress-to-egress and egress-to-ingress associations of data packets.

[0013] Figure 3 is a diagram showing the time coordination between two network elements.

[0014] Figure 4 is a diagram showing the time stream representation of media slices traversing the network.

[0015] Figure 5A and 5B is a flowchart of an exemplary method for associating data packets.

[0016] Figure 6 is a flowchart of a method for generating a corrected timestamp for a data packet; and

[0017] Figure 7 shows an exemplary computing-based device in which embodiments of 500 and 600 are implemented.

[0018] In the drawings, the same reference numerals are used to denote the same parts. Detailed Description

[0019] The following detailed description provided in conjunction with the drawings is intended as a description of examples of the present disclosure and is not intended to represent the only form in which the examples of the present disclosure may be constructed or utilized. This specification sets forth the functions of the examples and the sequences of operations for constructing and operating the examples. However, the same or equivalent functions and sequences may be achieved by different examples.

[0020] As described above, when providing media services in a communication network (such as a VoIP network or other packet-based communication network), performance or quality degradation is a common problem encountered. At the same time, the demand for media services and high-quality media service performance is increasing continuously. Media quality problems may be caused by a variety of different reasons, which may be additive. Non-exhaustive examples of the causes of media quality problems include: hardware failures at communication network nodes, congestion at communication network nodes or edges, firmware or software defects at communication network nodes, incompatibility between two or more communication network nodes, poor network latency, and excessive data packet loss in the network.

[0021] The investigation and diagnosis of media service quality degradation are time-consuming and complex. The complexity stems from the fact that there can be a large number of different causes of media quality problems and different combinations of these causes. The scale of the problem (the communication network can be very large, such as an intranet or the Internet) and the traffic in the communication network can also be very large, which also contributes to the complexity. Current methods for diagnosing poor media service quality are mainly manual operations, which are both complex and time-consuming. However, it is possible to diagnose media quality problems within minutes or seconds in order to perform automated operations to improve media service quality. The diagnosis of media quality problems typically involves identifying a specific part of the communication network architecture (e.g., a network element or a part of a network element), which, in one example, is responsible for failing to perform the assigned task.

[0022] The inventors have recognized that in order to accurately diagnose problems with poor media quality, it is very important to track how the communication network processes media slices. A media slice is a part of a media stream and includes the media content of the media stream that is intended to be output to the user at a particular moment or time interval. Thus, a media slice includes media content that typically has some semantic meaning to the user. Therefore, if the media quality is poor, the quality of the media slice will also be poor because the poor media quality perceived by the user is due to content degradation or absence. By tracking media slices within the communication network, the technical causes of poor media quality can be identified and subsequently resolved, perhaps even automatically. In contrast, investigating individual parts of the communication network may not help to solve the media quality problem of a particular media service because individual communication network nodes may have identified faults, but the fault may have no impact on media quality. Therefore, examining each node of the communication network may reveal many faults, but some of these faults may not be related to the particular poor media quality being experienced.

[0023] The term "media slice" refers to the underlying media content within a specific time period, regardless of its specific representation. For an audio call between Alice and Bob, media slice (M1) is defined as the audio transmitted from Alice to Bob between t = 100 ms and t = 120 ms. In other words, M1 is a 20-ms long audio segment traveling from Alice to Bob. Note that M1 is defined as the audio (i.e., the sound of Alice's voice on the phone call), rather than a specific representation of the audio. If the representation of the audio changes (e.g., through transcoding), M1 remains unchanged. Thus, a media slice is a fragment or portion of media content that is independent of how the media content is represented. When using a packet-based communication network (such as a VoIP network), the media content is divided into parts and stored in the payload of packets. Then, the packets are sent through the communication network. Individual packets may experience different journeys or processing when passing through the communication network. The destination computing entity needs to receive the packets and reconstruct the media slice before presenting it to the end user. As described above, the media slice is independent of the representation of the media content (i.e., the individual packets). The content of a media slice may be in part of the payload of a packet, a single packet, or multiple packets.

[0024] Tracking media slices in a communication network (such as a telecommunications network) is not straightforward because any available measurements or logs regarding the traffic in the communication network are typically about packets rather than media slices. Manually attempting to interpret such measurements and logs to understand what they mean regarding media slices is virtually impossible and is likely to be error-prone even if practical.

[0025] Before being received by the intended recipient, each media slice traverses the communication network and passes through multiple network elements. A network element is any node within the communication network where a data packet (which may be all or part of a media slice) is received before being sent to another network element or the intended final recipient of the data packet. A network element may perform actions on the data packet before sending it. Data packets can be recorded at the ingress and egress capture points of the network element, and these records (including relevant information about the media stream) can be reported to a central diagnostic server. However, as described above, logs regarding packets are not easily understood from the perspective of media slices.

[0026] Tracking information about which network elements a media slice passes through enables identification of errors in the communication network. As an illustrative example, if multiple corrupted media slices are received, the tracking information associated with each media slice can reveal that they passed through a common network element. Thus, the common network element can be investigated to diagnose the problem and / or automatically indicate that it undergoes automated maintenance, such as by downloading and installing firmware and / or software upgrades, automatically restarting, automatically reconfiguring, or other automated maintenance.

[0027] For a variety of reasons, it is challenging to provide a log or timeline of how a particular media slice traverses a network. When a media slice passes through different network elements, the properties of the media slice can change. For example, the way the content is represented can change depending on whether encryption is used, whether a video or audio codec is applied, or for other reasons. At different layers of a communication network, the way the content is represented can also change. As a result, the media slice appears as multiple unconnected data packets recorded at different parts of the network at different times. This is in addition to the large number of data packets traversing the network during media-related activities. For example, consider a 5-minute VoIP call as a media slice, which may use 120,000 packets. A 5-minute VoIP call is 300 seconds, and if there are 50 packets per second in the audio stream, then there are a total of 15,000 packets. If there are two adjacent network nodes, each with two inlets and two outlets, then there are a total of 15,000 times 8 packet observations on the two network nodes, i.e., 120,000 packet observations related to the media slice.

[0028] Due to the constantly changing properties of the packets of content used for communicating a media slice, it is difficult to provide a timeline of the location of a particular media slice. The large number of data packets and the expectation of real-time or near-real-time operation exacerbate this problem.

[0029] The embodiments described herein provide a method of associating data packets with a media slice such that a record of which network elements the media slice has passed through can be provided.

[0030] In various examples described herein, associating data packets with a media slice is achieved by examining the payload of a data packet leaving the outlet of a first network element and comparing the payload with the payload of a data packet entering the inlet of a second network element. If the payloads are the same, the method associates the two data packets (the data packet leaving the first network element and entering the second network element). This association provides an indication that the two data packets contain the content of a common media slice. When a packet is observed leaving the outlet of the first network element, the observation of the payload content matches the content of the packet at the inlet of the second network element. Due to the content match, the content is likely to be from the same media slice and is observed in the packets at different times at the outlet and the inlet.

[0031] In various examples described herein, associating a data packet with a media slice is achieved by examining the payload and / or metadata of the data packet when it enters at the ingress of a network element (e.g., such as the second network element described above) and comparing the payload and / or metadata with the payload and / or metadata of the data packet leaving at the egress of the network element. If there is a consistency between the payload and / or metadata of the data packets, the method associates the two data packets (entering and leaving the network element). The association provides an indication that the data packets correspond to a common media slice.

[0032] If a data packet entering at the ingress of a network element has previously been associated with another data packet leaving at the egress of a different network element and is also associated with a data packet leaving at the egress of the network element, this indicates that all three data packets correspond to a common media slice.

[0033] While identifying which data packets correspond to a particular media slice is useful for diagnostics, the order of events as the media slice traverses the network provides more detailed information for diagnostics. For example, knowing that a data packet passed through a first network element before it passed through a second network element can indicate whether data transmission from the first network element to the second network element or data transmission from the second network element to the first network element is the cause of network performance degradation.

[0034] In an example, when data packets are reported from the ingress and egress of a network element to a central diagnostic server, the report includes a timestamp that records when the data packet arrived at the ingress capture point or when the data packet left the egress capture point. The timestamp is generated by an internal clock within each network element. However, the internal clocks between network elements are typically not synchronized. For example, the value of two timestamps generated at the same time may be T = 1 in one network element, while the value of the timestamp in a second network element may be T = 5.

[0035] The solution is to calculate the calibration between network elements, which, however, is not a viable solution in practice. First, the internal clocks may differ significantly compared to the frequency at which data packets are received. Second, and perhaps more importantly, the internal clocks of each network element may drift relative to each other over time. For example, during a VoIP call, the internal clocks of two network elements may drift relative to each other.

[0036] Embodiments described herein provide a method for calculating the offset between the internal clocks of network elements when data packets of content having a single media slice are sent from a first network element and received by a second network element. These offsets are calculated on a per-data-packet basis, which means that the offset between the two internal clocks is calculated using information associated with the data packet itself.

[0037] This is achieved by checking the timestamps of correlated data packets, where the timestamps are generated by different network elements. The first timestamp of the first data packet leaving (send event) the first network element is checked and compared with the second timestamp of the second data packet entering (receive event) the second network element, where the first data packet and the second data packet are correlated as they both contain the content of the same media slice. The third timestamp of the third data packet leaving (send event) the second network element is checked and compared with the fourth timestamp of the fourth data packet entering (receive event) the first network element, where the third and fourth timestamps are correlated. The timestamps are generated by the network element where the capture point (entry or exit point) is located (e.g., the timestamp of the first data packet is generated by the first network element).

[0038] The method uses the difference between the send event timestamp from the first network element and the receive event timestamp from the second network element and / or the difference between the send event timestamp from the second network element and the receive event timestamp from the first network element to estimate the offset between the internal clocks of the first network element and the second network element. This offset is specific to the send time of the data packet, thus providing a higher time recording granularity to account for clock drift between network elements.

[0039] Figure 1 Communication network 100 is shown, which facilitates the transmission of media slices between computing devices (e.g., computing device 102 and computing device 104). The computing devices are connected via a communication network including a plurality of network elements. Solid line 101 shows the communication network links between the network elements and the computing devices. Figure 1 The first network element 106 and the second network element 110 linking the computing devices are shown. However, it should be understood that more than two network elements can be connected between the computing devices. A network element is any communication network node of a packet-based communication network. A network element has the function of receiving data packets and sending the data packets to another network element or the intended final recipient of the data packet. Non-exhaustive examples of examples of network elements include: session border controllers, firewalls, media gateways, data center computing nodes, servers, soft switches, etc.

[0040] There are ingress and egress capture points within the network element. The ingress capture point is where the network element will capture incoming media slices, and the egress capture point is where the network element will capture outgoing media slices. A first network element having ingress 108A and egress 108B capture points, and a second network element also having ingress 112A and egress 112B capture points. When a data packet is received at the ingress capture point or sent from the egress capture point, a copy of the data packet including the payload and metadata associated with the data packet is sent to the remote capture server 114 along with a timestamp. In some examples, the copy of the data packet is encapsulated within another data packet, so the original data packet remains unchanged as it travels to the remote capture server 114. The data packet itself continues to be routed through the communication network. The remote capture server 114 records the data packet information and the time information associated with the data packet. The remote capture server 114 then discards the copy of the data packet. The recorded data packet information is used to track media slices. The tracked media slices are used to automatically investigate and diagnose any media quality issues. In practice, it has been found that using the remote capture server to infer data packet data to track media slices is efficient and accurate. The data captured by the remote capture server regarding data packets observed at different locations and times in the communication network is precisely measured. The data is then efficiently processed using rules to achieve mapping with media slices.

[0041] When a data packet enters or leaves a capture point, the timestamp assigned to the data packet is generated by the internal clock of the network element where the capture point is located. Figure 1 A first network element having an internal clock 124 and a second network element having an internal clock 126 for generating timestamps are shown.

[0042] As an illustrative example, a media slice 115 is sent by a first computing device 102. In some embodiments, the media slice consists of audio or video data. It is received by the first network element 106 at the ingress capture point 108A as all or part of a data packet (P1) 116. The metadata associated with P1 is sent to the remote capture server 114 along with the timestamp. A second data packet (P2) 118 leaves the first network element 106 at the egress capture point 108B. The metadata associated with P2 is sent to the remote capture server 114 along with the timestamp.

[0043] P1 and P2 are recorded as separate data packets by the remote capture server 114. Although P1 and P2 correspond to the same media slice 115, they may have different attributes due to the different ways data packets are processed within network elements. The networking layers of the data packets can be different (e.g., different Ethernet, Internet Protocol (IP), and User Datagram Protocol (UDP) headers, etc.), and the representations of the media can be different (e.g., different codecs, packetization timers (ptime), whether Secure Real-Time Transport Protocol (SRTP) is used, etc.). The audio in the media slice may also change (e.g., the first network element can perform Dual-Tone Multi-Frequency (DTMF) injection or muting, or inject announcements, etc.).

[0044] The third data packet (P3) 120 enters the second network element 110 at the ingress capture point 112A. The metadata associated with P3 is sent to the remote capture server 114 together with a timestamp. P2 and P3 are recorded as separate data packets by the remote capture server 114. Although corresponding to the same media slice 115, P2 and P3 can have different attributes. For example, any or all of the network layers may have been changed during transmission (e.g., by Network Address Translation (NAT), encryption, application of a codec, or otherwise).

[0045] The fourth data packet (P4) 122 leaves the second network element 110 at the egress capture point 112B. The metadata associated with P4 is sent to the remote capture server 114 together with a timestamp. P3 and P4 are recorded as separate data packets by the remote capture server 114. For the same reasons as P1 and P2, P3 and P4 may have different attributes. The media slice 115 reaches the second computing device 104.

[0046] In Figure 1 the example shown, the "Footprints" left by the media slice 115 are recorded in the form of data packets (P1, P2, P3, and P4), and the payload, metadata associated with the data packets, and timestamps are reported to the remote capture server 114 to record the details of the media slice traversing the network. This recording is very useful for network engineers or diagnostic applications in identifying at which point network media quality problems occur.

[0047] However, in order for the remote capture server 114 to generate this record, it determines that each data packet (P1, P2, P3, and P4) is associated with one another and corresponds to a common media slice. The remote capture server uses timestamps to confirm the order in which capture point events (entry / exit of data packets) occur. Since the internal clocks of network elements are not synchronized with respect to one another and / or drift over time, ordering capture point events chronologically is complex. The examples described herein provide a method implemented by the remote capture server 114 to perform such association and time coordination of the internal clocks of network elements. These methods do not require specialized calibration. Since the method of ordering capture point events uses observations of existing packets, it does not unnecessarily increase network traffic due to the need to send dedicated calibration packets.

[0048] Alternatively or additionally, the functionality of the remote capture service described herein is performed at least in part by one or more hardware logic components. By way of example, and not limitation, illustrative types of hardware logic components that may optionally be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), and graphics processing units (GPUs).

[0049] Figure 2A A process is shown of associating two data packets captured at the exit capture point 206 of a first network element 202 and the entry capture point 208 of a second network element 204 as part of the same media slice.

[0050] The remote capture server 214 receives a first data packet (P1) captured at the exit capture point of the first network unit 202 from the first network unit. The remote capture server also receives a second data packet (P2) captured at the entry capture point of the second network element from the second network element. Both data packets P1 and P2 include a payload and metadata associated with the data packet. The payloads of P1 and P2 are then compared by the remote capture server (e.g., a Real-time Transport Protocol (RTP) payload or a Real-time Transport Control Protocol (RTCP) payload). If the payloads are the same (i.e., the media content in the payloads is the same), the remote capture server 214 associates P1 with P2. The remote capture server 214 records the association between P1 and P2 in the log 216, indicating that they both correspond to a common media slice.

[0051] Figure 2AThe process in [the above] realizes the automatic association between data packets, enabling the tracking of the path taken by media slices through the network and being used for diagnosing media quality degradation. Since this process is automated and stored in the log 216 of the remote capture server, this record can be used to automatically identify where in the network there are solutions to media quality problems, because the log can be used as input for a pre-programmed diagnostic application.

[0052] Figure 2B The process of associating two data packets is shown, where one data packet is captured at the ingress capture point 222 of the network element 220, and a second packet is captured at the egress capture point 224 of the same network element 220.

[0053] The remote capture server receives a third data packet (P3) from the network element, including the payload and metadata associated with P3 captured at the ingress capture point 222 of the network element 220. The remote capture server also receives a fourth data packet (P4) from the network element, which includes the payload and metadata associated with P4 captured at the egress capture point of the network element. The remote capture server compares the payloads and / or metadata associated with P3 and P4.

[0054] If one or more of the following conditions are met, then P3 is associated with P4: the RTP payload has not changed (which is also as described with reference to Figure 2A ), and / or the RTP packets are equal under the relevant processes of transcoding or SRTP (Secure Real-Time Transport Protocol) interoperability, and / or other internal diagnostic logs indicate, such as evaluating the rate conversion protocol from the metadata of the third and fourth data packets (where the packets at the ingress and egress of the network element are compared).

[0055] In one embodiment, the conditions for associating P3 with P4 are determined based on the central processing unit (CPU) resources of the remote capture server (i.e., the data packet received from the ingress capture point of the network element and the data packet received from the egress capture point of the same network element). For example, if the CPU resources of the remote capture server are limited and the RTP payload remains unchanged, then P3 and P4 are associated. If the remote capture server has a large amount of CPU resources, then P3 and P4 are associated when the previously described conditions are met. The data packet association method provided by this embodiment is very flexible, so it can be implemented on various computing resources with a certain range of CPU capabilities. Therefore, a larger range of network resources can be allocated to the tasks of the remote capture server, which helps to implement a more powerful network performance diagnostic method.

[0056] In some embodiments, the association between the packets and the media slices is based on the assumption that the remote capture server knows the inbound and outbound codecs and / or the remote capture server knows the inbound and outbound SRTP encryption keys of the network elements. This assumption is reasonable because the remote capture server can access the Session Initiation Protocol (SIP), which has established a session including media packet transmission. The remote capture server 214 records the association between P3 and P4 in the log 216, indicating that they both correspond to a common media slice.

[0057] Figure 2C The process of associating four data packets is shown, where the first data packet (P5) is captured at the ingress capture point of the first network element 250, the second data packet (P6) is captured at the egress capture point of the first network element 250, the third data packet (P7) is captured at the ingress capture point of the second network element 260, and the fourth data packet (P8) is captured at the egress capture point of the second network element 260.

[0058] Figure 2C It shows how P5 is associated with P6 and P7 is associated with P8 in the same way as Figure 2B P3 and P4 are associated in the example. Figure 2C It also shows how P6 is associated with P7 in the same way as Figure 2A P1 and P2 are associated in the illustrated embodiment.

[0059] Figure 2C It shows that by applying two methods for egress-ingress and ingress-egress associations to a set of data packets, the data packet event chain can be recorded. By applying these methods on the network connecting the first computing device that sends the media slice and the second computing device that receives the media slice, the data packet event chain can be recorded, reflecting the traversal of a single media slice in the network. Thus, Figure 2C the example illustration in

[0060] provides a record of which network elements the media slice has passed through.

[0061] Figure 3 It shows an illustrative example of how the remote capture server generates a corrected timestamp for the captured data packets, which works in conjunction with the data packet association method described with respect to Figures 2A - 2C the data packet association method described.

[0062] In Figure 3In the example shown, the remote capture server 314 receives first (P1), second (P2), third (P3), and fourth (P4) data packets, which are captured at the ingress capture point 304A of the first network element 302, the egress capture point 308B of the second network element 306, the egress capture point 304B of the first network element 302, and the ingress capture point 308A of the second network element 306, respectively.

[0063] Each data packet is assigned a timestamp generated by the network element where the data packet capture occurs. In Figure 3 the example shown, the internal clock of the first network element C NE1 310 is used to assign timestamps (T P1 and T P3 ) to data packets P1 and P3, while the internal clock of the second network element C NE2 312 is used to assign timestamps (T P2 and T P4 ) to data packets P2 and P4. The timestamps are recorded by the remote capture server 314 together with the payload and metadata of the data packets.

[0064] Using Figure 2A the method shown (i.e., egress-to-ingress association of data packets), data packets P1 and P2 are associated, and data packets P3 and P4 are associated. Thus, for the media slices corresponding to P1 and P2, the recorded "send" time from network element 2 is T P2 , and the recorded "receive" time at network element 1 is T P1 . The time of capturing P1 at the ingress capture point of the first network element will be after the time of capturing P2 at the egress capture point of the second network element. Similarly, the time of capturing P4 will be after the time of capturing P3.

[0065] To estimate the time offset between C NE1 and C NE2 , the remote capture server calculates the difference between T P1 and T P2 and the difference between T P3 and T P4 . The remote capture server uses these differences to estimate the time offset when the media slice is transmitted between the first and second network elements. Then the estimated time offset is applied to the timestamps stored for the data packets to generate corrected timestamps.

[0066] Thus, the remote capture server can dynamically calibrate the timestamps of each captured data packet on a per-data-packet basis by using the differences in the timestamps assigned to the data packets sent / received by adjacent network elements.

[0067] In an exemplary embodiment, the remote capture server estimates the time offset using the following method:

[0068] From Figure 3 , T P2 and T P1 The difference between is equal to the transmission time of the data packet from the second network element to the first network element (t 2→1 ) + C NE1 The amount before C NE2 . t 2→1 Cannot be negative, so the amount by which CNE1 is before CNE2 is at most the gap between "transmission" at the second network element (T P2 ) and "reception" at the first network element (T P1 ) - call this ΔT1 (i.e., T P2 – T P1 ).

[0069] T P3 and T P4 The difference between is equal to the transmission time of the data packet from the first network element to the second network element (t 1→2 ) + C NE2 The amount before C NE1 . Similarly, t 1→2 Cannot be negative, so the amount of C NE2 before C NE1 is at most the gap between "transmission" at the first network element (T P3 ) and "reception" at the second network element (T P4 ) - call this ΔT2 (i.e., T P3 - T P4 ).

[0070] Therefore: C NE1 - C NE2 ≤ΔT1 C NE2 - C NE1 ≤ΔT2

[0071] Rearranging: C NE1 – C NE2 ≥ -ΔT2

[0072] Therefore, -ΔT2 ≤ C NE1 – C NE2 ≤ΔT1

[0073] In other words, using the above logic, it is inferred that C NE1 at most leads C NE2 (T P1 – T P2 ), at least leads (TP3 -T P4 )。This provides the upper and lower limit values for the time offset estimation.

[0074] This document regarding Figure 3 the described time coordination method enables the remote capture server to

[0075] Use a working example: T P1 = 5 T P2 = 0 T P3 = 6 T P4 = 1

[0076] Therefore, ΔT2 = 6 - 1 = 5 ΔT1 = 0 - 5 = -5

[0077] Therefore, 5 ≤ C NE1 –C NE2 ≤ 5

[0078] From this working example, when data packets P1, P2, P3, and P4 are exchanged between the first and second network elements, the time offset between C NE1 and C NE2 is estimated to be 5.

[0079] Although Figure 3 not shown in, the remote capture server can calculate the time offset between the internal clocks of more than two network elements. For example, the time offset between the internal clocks of the second and third network elements can be calculated. Since the time offset between the first and second network elements has been calculated, the time offset between the first and third network elements can be inferred from the time offset between the second and third network elements. By repeating this process for mutually correlated data packets throughout the network, the remote capture server can generate a common time reference framework, and thus can generate an order of data packet capture events related to media slices.

[0080] By applying the method of data packet association described regarding Figures 2A - 2C and the method of time coordination described regarding Figure 3 the remote capture server can generate and store an ordered sequence of each data packet capture event corresponding to a media slice. The generation and storage of the ordered sequence are automatically performed (using regarding Figures 2A - 2C and Figure 3(the described rule-based method), thus providing a way for diagnostic applications or network engineers to access the trace history on demand without classifying data packets and performing manual data packet correlation. This enables the rapid and effective determination of the cause of problems in the network.

[0081] In an embodiment, the results of the ordered sequence generated by the remote capture server are output at a graphical user interface or other display in a format such as Figure 4 shown. Figure 4 The display is merely an example, such as a display, and is not restrictive.

[0082] Figure 4 Represents the time flow of the media slice traversing the network (represented by arrows 410, 420, and 430) when entering / leaving the first network element (represented by a vertical line) 402 and the second network element 404 (represented by a vertical line). The arrows representing the data packet flow are shown as non-horizontal arrows to reflect the transmission time of the data packets between network elements; that is, the relative vertical position of the arrows represents the time order.

[0083] The data packet flow 410 is generated using the recorded capture events 412. The first capture event (at the entry capture point of network element 1402) is recorded as the first entry (05-08-2022T13:10:00.000). The second capture event (at the exit capture point of network element 1402) is recorded as the second entry (05-08-2022T13:10:00.004). The third capture event (at the entry capture point of network element 2404) is recorded as the third entry (05-08-2022T13:10:00.014). The fourth capture event (at the exit capture point of network element 2404) is recorded as the fourth entry (05-08-2022T13:10:00.019).

[0084] As shown in 406, the differences and commonalities between the associated data packets are stored and accessed. In this case, since the data packet leaving network element 1 and the data packet entering network element 2 have the same payload, the two data packets are associated by the remote capture server as part of the same media slice. As shown in the data flow 410, due to the association between the data packets, the data packets are represented as a continuous flow. The differences represent the information changed by the network between the two network elements.

[0085] Although Figure 4 is not included, there is also the same difference and commonality information for the data packets entering and leaving a network element. In this case, the differences represent the information changed by the network element itself.

[0086] Data packet flow 420 is an example where data packets are sent by network element 1 but not received by network element 2. Data packet flow 430 is an example where data packets are received by network element 2 but not sent by network element 1. In this example scenario, the data packets from 420 are not associated with the data packets from 430 because they do not share the same payload.

[0087] Using Figure 4 display, engineers can quickly determine how to handle media slices in a communication network between two communication network nodes.

[0088] Figure 5A and 5B is a flowchart showing an example of method 500 for associating Figure 2A and Figure 2B the data packets corresponding to the processes shown. Method 500, executed by a remote capture server, is used to track media slices through at least a portion of a communication network.

[0089] At 502 of method 500, the remote capture server examines the first payload of the first data packet observed at the egress capture point of the first network element.

[0090] At 504 of method 500, the remote capture server examines the second payload of the second data packet observed at the ingress capture point of the second network element.

[0091] At 506 of method 500, the remote capture server compares the first payload with the second payload, and at 508, the remote capture server associates the first data packet with the second data packet in response to determining that the first payload and the second payload are the same. In response to determining that the first data packet and the second data packet are associated, the first data packet and the second data packet correspond to the first media slice.

[0092] At 510 of method 500, the remote capture server examines the third payload and / or metadata of the third data packet observed at the ingress capture point of the second network element.

[0093] At 512 of method 500, the remote capture server examines the fourth payload and / or metadata of the fourth data packet observed at the egress capture point of the second network element.

[0094] At 514 of method 500, the remote capture server compares the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet, and at 516, in response to determining that the third payload and / or metadata of the third data packet is the same as the fourth payload and / or metadata of the fourth data packet, associates the third data packet with the fourth data packet. In response to determining that the third data packet is associated with the fourth data packet, the third data packet and the fourth data packet correspond to the second media slice.

[0095] In some embodiments, comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet includes at least one of the following: examining and comparing the payloads of the third data packet and the fourth data packet; and / or evaluating whether the third data packet and the fourth data packet are equal in a related transcoding process; and / or evaluating the rate conversion protocol based on the metadata of the third data packet and the fourth data packet. In some embodiments, the method of comparing the third payload and / or metadata of the third data packet and the fourth payload and / or metadata of the fourth data packet is selected based on the CPU resource value of the remote capture server in certain embodiments.

[0096] In response to determining that the second data packet and the third data packet are the same data packet, the remote capture server associates the first, second, or third data packet with the fourth data packet at 518 and records the first media slice and the second media slice as a common media slice at 520.

[0097] In response to determining that the second data packet and the third data packet are not the same data packet, the remote capture server records the first media slice and the second media slice as different media slices at 522.

[0098] In some embodiments, method 500 includes generating a graphical representation of network elements and media slices for display to a user at 524.

[0099] Figure 6 is a flowchart of method 600 for generating a corrected timestamp of a data packet representing the process shown in Figure 2C Method 600 follows method 500, wherein the following actions are performed in response to determining that the first, second, or third data packet and the fourth data packet are associated.

[0100] At 602 of method 600, the remote capture server examines the first timestamp assigned to the first data packet, wherein the first timestamp is generated by the first network element.

[0101] At 604 of method 600, the remote capture server checks a second timestamp assigned to the second data packet or the third data packet, where the second timestamp is generated by the second network element.

[0102] At 606 of method 600, the remote capture server checks a third timestamp assigned to the fourth data packet, where the third timestamp is generated by the second network element.

[0103] At 608 of method 600, the remote capture server checks a fourth timestamp assigned to the fifth data packet, where the fifth data packet is recorded at the ingress of the first network element and the fifth data packet is associated with the fourth data packet, and where the fourth timestamp is generated by the first network element.

[0104] At 610 of method 600, the remote capture server uses the difference between the first timestamp and the second timestamp and the difference between the third timestamp and the fourth timestamp to estimate the time offset between the first network element and the second network element.

[0105] At 612 of method 600, the time offset is applied to the first, second, third, and fourth timestamps to generate first, second, third, and fourth corrected timestamps.

[0106] At 614 of method 600, the remote capture server records the corrected timestamps and the data packets to which they are assigned in a log.

[0107] In some examples, at 616 the remote capture server sorts at least one of the first, second, third, fourth, and fifth data packets based on the values of the corrected timestamps for the first, second, third, fourth, and fifth data packets.

[0108] Figure 7 Exemplary components of a computing-based device 700 are shown, which is implemented as any form of computing and / or electronic device, and in some examples an embodiment of the remote capture server is implemented therein.

[0109] The computing-based device 700 includes one or more processors 702, which are microprocessors, controllers, or any other suitable type of processor for processing computer-executable instructions 710 to control the operation of the device so as to track media slices via a communication network such as by performing the methods of FIGS. 5 and Figure 6 In some examples, such as in the case of using a system-on-chip architecture, the processor 702 includes one or more fixed function blocks (also referred to as accelerators) that implement FIGS. 5 and Figure 6Part of the method. Provide platform software including operating system 708 or any other suitable platform software at the computing-based device to enable application software to execute on the device. Record 712 is stored at the computing-based device and includes metadata, grouped data, packets, media stream data, or other information.

[0110] Use any computer-readable medium accessible by the computing-based device to provide computer-executable instructions 710. Computer-readable media include, for example, computer storage media such as memory 706 and communication media. Computer storage media, such as memory 706, include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules, or the like. Computer storage media include, but are not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), electronically erasable programmable read-only memory (EEPROM), flash memory or other storage technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic tape cartridges, tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium for storing information accessible by a computing device. In contrast, communication media embody computer-readable instructions, data structures, program modules, etc. in a modulated data signal such as a carrier wave or other transmission mechanism. As defined herein, computer storage media do not include communication media. Thus, computer storage media by itself should not be construed as propagating signals. Although computer storage media (memory 706) is shown in computing-based device 700, it can be understood that in some examples, storage is distributed or remotely located and accessed via a network or other communication link (e.g., using communication interface 704).

[0111] Alternatively or additionally, in addition to the other examples described herein, examples include any combination of the following:

[0112] Clause 1. A method is provided that is performed by a remote capture server to track media slices through at least a portion of a communication network including a plurality of network elements. The method includes: examining a first payload of a first data packet observed at an egress capture point of a first network element; examining a second payload of a second data packet observed at an ingress capture point of a second network element; comparing the first payload with the second payload; in response to determining that the first payload and the second payload are the same, associating the first data packet with the second data packet; wherein in response to determining that the first data packet and the second data packet are associated, the first data packet and the second data packet correspond to a first media slice; examining a third payload and / or metadata of a third data packet observed at the ingress capture point of the second network element; examining a fourth payload and / or metadata of a fourth data packet observed at the egress capture point of the second network element; comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet; in response to determining that the third payload and / or metadata of the third data packet and the fourth payload and / or metadata of the fourth data packet are the same, associating the third data packet with the fourth data packet; wherein in response to determining that the third data packet and the fourth data packet are associated, the third data packet and the fourth data packet correspond to a second media slice; and wherein in response to determining that the second data packet and the third data packet are the same data packet: associating the first, second, or third data packet with the fourth data packet; and recording the first media slice and the second media slice as a common media slice; wherein in response to determining that the second data packet and the third data packet are not the same data packet: recording the first media slice and the second media slice as different media slices.

[0113] Clause 2. The method according to Clause 1, further including, in response to determining that the first, second, or third data packet is associated with the fourth data packet: examining a first timestamp assigned to the first data packet, wherein the first timestamp is generated by the first network element; examining a second timestamp assigned to the second data packet or the third data packet, wherein the second timestamp is generated by the second network element; examining a third timestamp assigned to the fourth data packet, wherein the third timestamp is generated by the second network element; examining a fourth timestamp assigned to a fifth data packet, wherein the fifth data packet is recorded at the ingress of the first network element and the fifth data packet is associated with the fourth data packet, wherein the fourth timestamp is generated by the first network element; using the difference between the first timestamp and the second timestamp and the difference between the third timestamp and the fourth timestamp to estimate a time offset between the first network element and the second network element; applying the time offset to the first, second, third, and fourth timestamps to generate first, second, third, and fourth corrected timestamps; and recording the corrected timestamps and the data packets to which they are assigned in a log.

[0114] Clause 3. The method as in Clause 2, including sorting at least one of the first, second, third, fourth, and fifth data packets according to the values of the corrected timestamps for the first, second, third, fourth, and fifth data packets.

[0115] Clause 4. The method according to Clause 2 or Clause 3, wherein the estimation of the time offset is at most the difference between the first timestamp and the second timestamp

[0116] Clause 5. The method according to any one of Clauses 2 to 4, wherein the estimation of the time offset is at least the difference between the third timestamp and the fourth timestamp.

[0117] Clause 6. The method according to any one of Clauses 2 to 5, wherein for data packets received after the fifth data packet, the estimation of the time offset is repeated and the previous time offset estimation is discarded.

[0118] Clause 7. The method according to any of the preceding clauses, wherein comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet includes at least one of the following: checking and comparing the payloads of the third data packet and the fourth data packet; and / or evaluating whether the third data packet and the fourth data packet are equal in a related transcoding process; and / or evaluating the rate conversion protocol based on the metadata of the third data packet and the fourth data packet.

[0119] Clause 8. The method according to Clause 7, wherein the method of comparing the payload and / or metadata of the third data packet with the payload and / or metadata of the fourth data packet is selected based on the CPU resource value of the remote capture server.

[0120] Clause 9. The method according to any of the preceding clauses, further including: when comparing the first data packet and the second data packet, identifying the differences and commonalities between the first data packet and the second data packet; recording the differences and commonalities between the first data packet and the second data packet in a log; when comparing the third data packet and the fourth data packet, identifying the differences and commonalities between the third data packet and the fourth data packet; and recording the differences and commonalities between the third data packet and the fourth data packet in a log.

[0121] Clause 10. The method according to Clause 9, wherein the differences and / or commonalities are at least one of the following: one or more layer headers, service distribution platforms, payloads, or metadata.

[0122] Clause 11. The method according to any of the preceding items, including generating a graphical representation of network elements and media slices for display to a user.

[0123] Clause 12. The method according to any one of Clauses 2 to 11, the method further comprising: receiving copies of first, second, third, fourth, and fifth data packets prior to inspection; wherein each first data packet is encapsulated within another data packet such that the first, second, third, fourth, and fifth data packets remain unchanged as they travel to the remote capture server.

[0124] Clause 13. A remote capture server for tracking media slices through at least a portion of a communication network including a plurality of network elements, wherein the remote capture server is configured to: inspect a first payload of a first data packet observed at an egress capture point of a first network element; inspect a second payload of a second data packet observed at an ingress capture point of a second network element; compare the first payload with the second payload; in response to determining that the first payload and the second payload are the same, associate the first data packet with the second data packet; wherein in response to determining that the first data packet and the second data packet are associated, the first data packet and the second data packet correspond to a first media slice; inspect a third payload and / or metadata of a third data packet observed at the ingress capture point of the second network element; inspect a fourth payload and / or metadata of a fourth data packet observed at the egress capture point of the second network element; compare the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet; in response to determining that the third payload and / or metadata of the third data packet and the fourth payload and / or metadata of the fourth data packet are the same, associate the third data packet with the fourth data packet; wherein in response to determining that the third data packet and the fourth data packet are associated, the third data packet and the fourth data packet correspond to a second media slice; and wherein in response to determining that the second data packet and the third data packet are the same data packet: associate the first, second, or third data packet with the fourth data packet; and record the first media slice and the second media slice as a common media slice; wherein in response to determining that the second data packet and the third data packet are not the same data packet: record the first media slice and the second media slice as different media slices.

[0125] Clause 14. The remote capture server according to Clause 13, in response to determining that the first, second, or third data packet is associated with the fourth data packet, is further configured to: check a first timestamp assigned to the first data packet, wherein the first timestamp is generated by a first network element; check a second timestamp assigned to the second data packet or the third data packet, wherein the second timestamp is generated by a second network element; check a third timestamp assigned to the fourth data packet, wherein the third timestamp is generated by the second network element; check a fourth timestamp assigned to a fifth data packet, wherein the fifth data packet is recorded at an ingress of the first network element and the fifth data packet is associated with the fourth data packet, wherein the fourth timestamp is generated by the first network element; estimate a time offset between the first network element and the second network element using a difference between the first timestamp and the second timestamp and a difference between the third timestamp and the fourth timestamp; apply the time offset to the first, second, third, and fourth timestamps to generate first, second, third, and fourth corrected timestamps; and record the corrected timestamps and the data packets to which they are assigned in a log.

[0126] Clause 15. The remote capture server according to Clause 14, the remote capture server is further configured to: sort at least one of the first, second, third, fourth, and fifth data packets according to the values of the corrected timestamps for the first, second, third, fourth, and fifth data packets.

[0127] Clause 16. The remote capture server according to any one of Clauses 13 to 15, wherein the estimation of the time offset is at most a difference between the first timestamp and the second timestamp.

[0128] Clause 17. The remote capture server according to any one of Clauses 13 to 16, wherein the estimation of the time offset is at least a difference between the third timestamp and the fourth timestamp.

[0129] Clause 18. The remote capture server according to any one of Clauses 13 to 17, the remote capture server is further configured to: generate a graphical representation of the network elements and media slices for display to a user.

[0130] Clause 19. A method performed by a remote capture server is provided, the method being a method of tracking media slices through at least a portion of a communication network including a plurality of network elements, the method including: examining a first payload of a first data packet observed at an egress capture point of a first network element; examining a second payload of a second data packet observed at an ingress capture point of a second network element; comparing the first payload with the second payload; in response to determining that the first payload and the second payload are the same, associating the first data packet with the second data packet; wherein in response to determining that the first data packet and the second data packet are associated, the first data packet and the second data packet correspond to a first media slice; examining a third payload and / or metadata of a third data packet observed at the ingress capture point of the second network element; examining a fourth payload and / or metadata of a fourth data packet observed at the egress capture point of the second network element; comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet; in response to determining that the third payload and / or metadata of the third data packet and the fourth payload and / or metadata of the fourth data packet are the same, associating the third data packet with the fourth data packet; wherein in response to determining that the third data packet and the fourth data packet are associated, the third data packet and the fourth data packet correspond to a second media slice; and wherein in response to determining that the second data packet and the third data packet are the same data packet: associating the first, second, or third data packet with the fourth data packet; and recording the first media slice and the second media slice as a common media slice; wherein in response to determining that the second data packet and the third data packet are not the same data packet: recording the first media slice and the second media slice as different media slices; in response to determining that the first, second, or third data packet is associated with the fourth data packet, further including: examining a first timestamp assigned to the first data packet, wherein the first timestamp is generated by the first network element; examining a second timestamp assigned to the second data packet or the third data packet, wherein the second timestamp is generated by the second network element; examining a third timestamp assigned to the fourth data packet, wherein the third timestamp is generated by the second network element; examining a fourth timestamp assigned to a fifth data packet, wherein the fifth data packet is recorded at the ingress of the first network element and the fifth data packet is associated with the fourth data packet, wherein the fourth timestamp is generated by the first network element; using the difference between the first timestamp and the second timestamp and the difference between the third timestamp and the fourth timestamp to estimate a time offset between the first network element and the second network element; applying the time offset to the first, second, third, and fourth timestamps to generate first, second, third, and fourth corrected timestamps; and recording the corrected timestamps and the data packets to which they are assigned in a log.

[0131] Clause 20. A computer-readable medium comprising instructions that, when executed by a processor, cause the processor to perform a method of tracking media slices through at least a portion of a communication network comprising a plurality of network elements, the method comprising: examining a first payload of a first data packet observed at an egress capture point of a first network element; examining a second payload of a second data packet observed at an ingress capture point of a second network element; comparing the first payload with the second payload; in response to determining that the first payload and the second payload are the same, associating the first data packet with the second data packet; wherein in response to determining that the first data packet and the second data packet are associated, the first data packet and the second data packet correspond to a first media slice; examining a third payload and / or metadata of a third data packet observed at the ingress capture point of the second network element; examining a fourth payload and / or metadata of a fourth data packet observed at the egress capture point of the second network element; comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet; in response to determining that the third payload and / or metadata of the third data packet and the fourth payload and / or metadata of the fourth data packet are the same, associating the third data packet with the fourth data packet; wherein in response to determining that the third data packet and the fourth data packet are associated, the third data packet and the fourth data packet correspond to a second media slice; and wherein in response to determining that the second data packet and the third data packet are the same data packet: associating the first, second, or third data packet with the fourth data packet; and recording the first media slice and the second media slice as a common media slice; wherein in response to determining that the second data packet and the third data packet are not the same data packet: recording the first media slice and the second media slice as different media slices.

[0132] As used herein, the terms "computer" or "computing-based device" refer to any device having processing capabilities such that it can execute instructions. Those skilled in the art will recognize that such processing capabilities are integrated into many different devices, and thus the terms "computer" and "computing-based device" each include personal computers (PCs), servers, mobile phones (including smart phones), tablets, set-top boxes, media players, gaming consoles, personal digital assistants, wearable computers, and many other devices.

[0133] In some examples, the methods described herein are performed by software in a machine-readable form on a tangible storage medium, such as in the form of a computer program that includes computer program code means which, when the program is run on a computer, are adapted to perform all operations of one or more of the methods described herein, and the computer program can be embodied on a computer-readable medium. The software is adapted to be executed on a parallel processor or a serial processor, such that the method operations can be performed in any suitable order or simultaneously.

[0134] Those skilled in the art will recognize that the storage devices for storing program instructions are optionally distributed over a network. For example, a remote computer can store an example of a process described as software. A local or terminal computer can access the remote computer and download part or all of the software to run the program. Alternatively, the local computer can download parts of the software as needed, or execute some software instructions at the local terminal and execute some software instructions at the remote computer (or computer network). Those skilled in the art will also recognize that all or part of the software instructions can be executed by dedicated circuitry, such as a digital signal processor (DSP), a programmable logic array, etc., using conventional techniques known to those skilled in the art.

[0135] It will be apparent to those skilled in the art that any range or device value given herein can be extended or changed without losing the desired effect.

[0136] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims need not be limited to the specific features or acts described above. Rather, the above specific features and acts are disclosed as example forms of implementing the claims.

[0137] It should be understood that the above benefits and advantages may relate to one embodiment or may relate to multiple embodiments. Embodiments are not limited to embodiments that solve any or all of the stated problems, nor are they limited to embodiments having any or all of the stated benefits and advantages. It will also be understood that the mention of "one" item means one or more of those items.

[0138] The operations of the methods described herein can be performed in any suitable order, or simultaneously where appropriate. Additionally, individual blocks can be deleted from any method without departing from the scope of the subject matter described herein. Aspects of any of the above-described examples can be combined with aspects of any of the other examples described to form other examples without losing the desired effect.

[0139] The term "comprising" is used herein to mean including the identified method blocks or elements, but such blocks or elements do not comprise an exclusive list, and a method or apparatus can contain additional blocks or elements.

[0140] It should be understood that the above description is given by way of example only, and various modifications can be made by those skilled in the art. The above specification, examples and data provide a complete description of the structure and use of the exemplary embodiments. Although the various embodiments have been described above with a certain degree of particularity or with reference to one or more individual embodiments, many changes can be made to the disclosed embodiments by those skilled in the art without departing from the scope of this specification.

[0141] The above configurations implement various methods for providing user input to a computer system. Some such methods are now described by way of example with continued reference to the above configurations. However, it should be understood that the methods described herein and other methods within the scope of the present disclosure can also be implemented by different configurations. The methods introduced herein relate to the observation of people's daily lives and should, and can, respect personal privacy to the greatest extent possible when implemented. Therefore, the methods introduced herein are fully in line with the voluntary participation of the observed. In embodiments where personal data is collected in a local system and transmitted to a remote system for processing, known methods can be used to anonymize the data. In other embodiments, personal data can be limited to the local system and only non-personal summary data is transmitted to the remote system.

Claims

1. A method performed by a remote capture server that traces media slices through at least a portion of a communication network including a plurality of network elements, the method comprising: Examining a first payload of a first data packet observed at an egress capture point of a first network element; Examining a second payload of a second data packet observed at an ingress capture point of a second network element; Comparing the first payload with the second payload; In response to determining that the first payload and the second payload are the same, associating the first data packet with the second data packet; Wherein in response to determining that the first data packet and the second data packet are associated, the first data packet and the second data packet correspond to a first media slice; Examining a third payload and / or metadata of a third data packet observed at the ingress capture point of the second network element; Examining a fourth payload and / or metadata of a fourth data packet observed at an egress capture point of the second network element; Comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet; In response to determining that the third payload and / or metadata of the third data packet and the fourth payload and / or metadata of the fourth data packet are the same, associating the third data packet with the fourth data packet; Wherein in response to determining that the third data packet and the fourth data packet are associated, the third data packet and the fourth data packet correspond to a second media slice; And Wherein in response to determining that the second data packet and the third data packet are the same data packet: Associating the first, second, or third data packet with the fourth data packet; And Recording the first media slice and the second media slice as a common media slice; Wherein in response to determining that the second data packet and the third data packet are not the same data packet: Recording the first media slice and the second media slice as different media slices.

2. The method according to claim 1, further comprising, in response to determining that the first, second, or third data packet is associated with the fourth data packet: Examining a first timestamp assigned to the first data packet, wherein the first timestamp is generated by the first network element; Examining a second timestamp assigned to the second data packet or the third data packet, wherein the second timestamp is generated by the second network element; Examining a third timestamp assigned to the fourth data packet, wherein the third timestamp is generated by the second network element; Examining a fourth timestamp assigned to a fifth data packet, wherein the fifth data packet is recorded at the ingress of the first network element and the fifth data packet is associated with the fourth data packet, wherein the fourth timestamp is generated by the first network element; Estimate the time offset between the first network element and the second network element using the difference between the first timestamp and the second timestamp and the difference between the third timestamp and the fourth timestamp; Apply the time offset to the first, second, third, and fourth timestamps to generate first, second, third, and fourth corrected timestamps; and Record the corrected timestamps and the data packets assigned to them in a log.

3. The method according to claim 2, including sorting at least one of the first, second, third, fourth, and fifth data packets according to the values of the corrected timestamps for the first, second, third, fourth, and fifth data packets.

4. The method according to claim 2, wherein the estimation of the time offset is at most the difference between the first timestamp and the second timestamp.

5. The method according to claim 2, wherein the estimation of the time offset is at least the difference between the third timestamp and the fourth timestamp.

6. The method according to claim 2, wherein for data packets received after the fifth data packet, the estimation of the time offset is repeated and the previous time offset estimation is discarded.

7. The method according to claim 1, wherein comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet includes at least one of the following: Checking and comparing the payloads of the third data packet and the fourth data packet; and / or Evaluating whether the third data packet and the fourth data packet are equal in a related transcoding process; and / or Evaluating the rate conversion protocol based on the metadata of the third data packet and the fourth data packet.

8. The method according to claim 7, wherein the method of comparing the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet is selected based on the CPU resource value of the remote capture server.

9. The method according to claim 1, further comprising: When comparing the first data packet and the second data packet, identifying the differences and commonalities between the first data packet and the second data packet; Recording the differences and commonalities between the first data packet and the second data packet in a log; When comparing the third data packet and the fourth data packet, identifying the differences and commonalities between the third data packet and the fourth data packet; and Recording the differences and commonalities between the third data packet and the fourth data packet in a log.

10. The method according to claim 9, wherein the differences and / or commonalities are at least one of the following: one or more layer headers, service distribution platforms, payloads, or metadata.

11. The method according to claim 1, including generating a graphical representation of the network element and the media slice for display to the user.

12. The method according to claim 2, further comprising: Prior to inspection, receive copies of the first, second, third, fourth, and fifth data packets; wherein each of the first data packets is encapsulated in another data packet such that the first, second, third, fourth, and fifth data packets remain unchanged as they travel to the remote capture server.

13. A remote capture server for tracking media slices through at least a portion of a communication network including a plurality of network elements, wherein the remote capture server is configured to: Inspect a first payload of a first data packet observed at an egress capture point of a first network element; Inspect a second payload of a second data packet observed at an ingress capture point of a second network element; Compare the first payload with the second payload; In response to determining that the first payload and the second payload are the same, associate the first data packet with the second data packet; wherein in response to determining that the first data packet and the second data packet are associated, the first data packet and the second data packet correspond to a first media slice; Inspect a third payload and / or metadata of a third data packet observed at the ingress capture point of the second network element; Inspect a fourth payload and / or metadata of a fourth data packet observed at an egress capture point of the second network element; Compare the third payload and / or metadata of the third data packet with the fourth payload and / or metadata of the fourth data packet; In response to determining that the third payload and / or metadata of the third data packet and the fourth payload and / or metadata of the fourth data packet are the same, associate the third data packet with the fourth data packet; wherein in response to determining that the third data packet is associated with the fourth data packet, the third data packet and the fourth data packet correspond to a second media slice; and wherein in response to determining that the second data packet and the third data packet are the same data packet: Associate the first, second, or third data packet with the fourth data packet; and Record the first media slice and the second media slice as a common media slice; wherein in response to determining that the second data packet and the third data packet are not the same data packet: Record the first media slice and the second media slice as different media slices.

14. The remote capture server according to claim 13, further configured, in response to determining that the first, second, or third data packet is associated with the fourth data packet, to: Inspect a first timestamp assigned to the first data packet, wherein the first timestamp is generated by the first network element; Inspect a second timestamp assigned to the second data packet or the third data packet, wherein the second timestamp is generated by the second network element; Inspect a third timestamp assigned to the fourth data packet, wherein the third timestamp is generated by the second network element; Check the fourth timestamp assigned to the fifth data packet, where the fifth data packet is recorded at the ingress of the first network element and the fifth data packet is associated with the fourth data packet, and the fourth timestamp is generated by the first network element; Use the difference between the first timestamp and the second timestamp and the difference between the third timestamp and the fourth timestamp to estimate the time offset between the first network element and the second network element; Apply the time offset to the first, second, third, and fourth timestamps to generate first, second, third, and fourth corrected timestamps; And Record the corrected timestamps and the data packets assigned thereto in a log.

15. The remote capture server according to claim 14, further configured to: sort at least one of the first, second, third, fourth, and fifth data packets according to the values of the corrected timestamps for the first, second, third, fourth, and fifth data packets.

Images