MONITORING USAGE BEHAVIOR BASED ON PACKAGE DISTANCES

Abstract

In a network device with multiple connections, a system tracks activity across each connection for a predetermined period. This activity comprises at least either a number of idle periods or the duration of a corresponding idle period. The system divides a predetermined time interval into a number of bins. Each bin is associated with a time range. The system stores the tracked activity in data structure entries, each specifying the number of bins, the duration of time associated with that bin, and a counter value associated with that bin. The system updates the tracked activity in the entry for each connection by incrementing a counter value associated with a bin that corresponds to the duration of the respective idle period, based on an initial number of idle periods tracked for that matching duration.The system displays the stored tracked activity for each connection.

Description

STATEMENT ON STATE-FUNDED RESEARCH.

[0001] This invention was made with government support under contract number H98230-23-C-0350, awarded by the Maryland Procurement Office. The government holds certain rights to this invention. BACKGROUND area

[0002] Application behavior can be tracked by observing the data traffic generated by the applications over a period of seconds. However, processes typically operate on a much shorter timescale, such as milliseconds or microseconds. Therefore, this coarse-grained level of tracking cannot provide details about application performance. A much finer-grained control layer can query counter data at high frequency. However, this can generate an enormous amount of data and a corresponding processing load. BRIEF DESCRIPTION OF THE FIGURES Fig. 1A shows an environment that facilitates the tracking of application behavior based on packet distances in accordance with an aspect of the present application. Fig. 1B shows information that is based on a component of the environment of Fig. 1A will be displayed, in accordance with an aspect of the present application. Fig. 1C illustrates processes that are carried out by a component of the environment of Fig. 1A in accordance with an aspect of the present application. Fig. Figure 2 shows the packet spacing information stored in a data structure in accordance with one aspect of the present application. Fig. Figure 3A shows a diagram of the packet spacing (busy / free periods) and a visual representation (histogram) of the packet spacing for four links with an equal number of evenly spaced free periods, according to one aspect of the present application. Fig. Figure 3B shows a diagram of the packet spacing (busy / free periods) and a visual representation (histogram) of the packet spacing for four connections with a different number of differently spaced free periods, in accordance with an aspect of the present application. Fig. 3C shows a diagram of the packet spacing (busy / free periods) and a visual representation (histogram) of the packet spacing for four connections with a different number of differently spaced free periods, according to one aspect of the present application. Fig. 3D shows a diagram of the packet spacing (occupied / free periods) and a visual representation (histogram) of the packet spacing for four connections with an equal number of differently spaced free periods, according to one aspect of the present application. Fig. Figure 4 shows a flowchart illustrating a procedure that facilitates the tracking of application behavior based on packet distances in accordance with an aspect of the present application. Fig. Figure 5 shows a diagram of the transitions and operations performed between and during the idle and occupied states according to one aspect of the present application. Fig. Figure 6 shows a computer system that facilitates the tracking of application behavior based on packet distances in accordance with an aspect of the present application. Fig. Figure 7 shows a computer-readable medium that facilitates the tracking of application behavior based on packet distances in accordance with an aspect of the present application.

[0003] In the illustrations, identical numbers refer to the same elements of the illustration. DETAILED DESCRIPTION

[0004] Aspects of this application provide a system capable of tracking application behavior at a more detailed level, which is less resource-intensive than monitoring each port and offers more than simple averages over extended periods. The system can track connection activity using device counters (which indicate idle or busy states) over a specified timeframe and display this information in a user-friendly visual representation, such as a histogram. The displayed information can enable the user to take action to resolve issues related to connections exhibiting abnormal, inconsistent, or unexpected behavior, and it can also provide insights into, for example, critical pathways within the system.

[0005] Application behavior can be tracked by observing the data traffic generated by applications over a specific period, for example, by calculating averages over a timescale of seconds. However, processes typically operate on a much shorter timescale, such as milliseconds or microseconds. As devices and systems become increasingly larger, simply observing application-generated traffic on the order of seconds cannot provide detailed insight into application behavior. Therefore, this coarse-grained level of tracking cannot reveal details of application performance. On the other hand, many devices maintain counters that are incremented when various events occur. This much finer-grained control level can query counter data at a high frequency.However, given the increasing number of devices and systems, the finer-grained control layer can generate an enormous amount of data and associated processing load.

[0006] The described aspects provide a system that overcomes the limitations of the coarse-grained and fine-grained levels described above. The system can track application behavior at a detailed level by determining whether a connection is busy or unoccupied at each cycle, e.g., every nanosecond. For example, a network device can track the activity of data transmitted over a connection based on the number and duration of busy / unoccupied periods, e.g., by resetting a counter or timer when the connection state changes from busy to unoccupied or vice versa. The terms "busy state" and "active state" are used interchangeably in this disclosure and can refer to the state of a connection when data is being sent or is about to be sent over the connection.The term "idle time" can refer to the state of a connection when no data is being sent or intended to be sent over it. The network can store tracked activity as histogram data, which can show the distribution of connection activity over time. A user can filter the tracked data based on various parameters, such as a specific port, traffic class, or application. The collected histogram data can then be used to gain better insights into application behavior. The histogram data can be presented to a network administrator in a visual or analytical format, which can lead to the identification of critical paths and improved efficiency.The histogram data can also be fed into an analysis engine, a machine learning model, or a pattern recognition system to generate diagnoses, and the diagnoses can be returned to a user for further analysis and action.

[0007] Fig. Figure 1A illustrates an environment 100 that facilitates the tracking of application behavior based on packet distances according to one aspect of the present application. Fig. 1B illustrates information 120, which is based on a component of the environment of Fig. 1A will be displayed, in accordance with an aspect of the present application. Fig. 1C shows processes 139, which are carried out by a component of the environment of Fig. 1A in accordance with an aspect of the present application. The environment 100 may include a device 102, a server or system 108, and a system 110, which communicate over a network 101. The device 102 may be connected to a user 104 and peripheral input / output components 106. The actions described here, performed by the user 104, may be performed by an algorithm / script, a system, a part of the system, or any other mechanism capable of performing the operation described. The device 102 may receive commands from the user 104 and display information about, or receive data from, peripheral I / O components 106 via communication links 160 and 164. The user 104 may communicate with, or send commands to, the device 102 using peripheral I / O components 106 via communication links 160 and 162. Various elements or information (e.g.Displayed information 120, as in . Fig. (shown in Figure 1B) can be displayed (or entered or edited) using peripheral I / O components 106. The server 108 can contain one or more computing devices and can store, retrieve, fetch, or generate information related to diagnostics for tracking application behavior. The server 108 can also contain an analysis engine or pattern recognition system that can create or generate diagnostics, i.e., an analysis of the tracked activity of multiple connections based on packet distances. System 110 can be any system comprising entities or devices that communicate via links or ports, e.g., a network structure, an enterprise environment, or a high-performance computing (HPC) system. System 110 can include at least devices 112 and 114, which can be coupled or connected and communicate with each other via at least links 116.

[0008] During operation, the device can perform 112 operations (as described in...). Fig. (Figure 1C is shown). The device 112 can track activity over a connection (e.g., one of the connections 116) for a predetermined time period, e.g., 10 microseconds (operation 140). The device 112 can be a switch with multiple ports (i.e., connections 116). The logic running on each switch port can track busy or idle information and store the tracked activity in each port. The tracked activity can include transmitted traffic or packets, including any interval (i.e., idle time) between the traffic or packets. The time for the tracked activity can be classified or defined as either busy (i.e., data is being sent over the connection or port) or idle (i.e., no data is being sent over the connection or port).

[0009] The packet distance tracked by device 112 can include a number of idle periods and the duration of a corresponding idle period, as well as a number of busy periods and the duration of a corresponding busy period. The system can track a period or a number of cycles during which a given link is idle by maintaining a first counter, and the system can track a period or a number of cycles during which a given link is "active" (i.e., busy) by maintaining a second counter, as shown below in relation to the Fig. 2 and Fig. 5 described.

[0010] The tracked activity information for busy and idle periods can be complementary, since activity over the connection is a binary characteristic. Aspects of the embodiments described in the application illustrate tracking packet distance based on the number and duration of idle periods (as below in relation to…) Fig. 4 described), but tracking the packet distance can also be based on the number and duration of the occupancy periods (as below in relation to Fig. 5). The information about the tracked activity or packet distance can be read from the switching center, for example, via a Control Status Register (CSR), and then used to update a data structure that stores the tracked activity, as described below and in relation to Fig. 2 described.

[0011] Device 112 can divide a predetermined time interval into a number of “bins” (process 142). The term “bin” can be used as a noun, e.g., referring to a bucket in which similar items can be grouped or placed, or similar to such a bucket. The term “bin” can also be used as a verb, e.g., to “bind” or divide a range of values ​​into a series of intervals. In this disclosure, the term “bin” is used as a noun. A histogram can display the frequency distribution by dividing a predetermined time interval into bins, each bin being associated with a time range within the predetermined time interval. For example, as below with respect to the Fig. As described in 3A-D, the predetermined time interval can be 11 microseconds, subdivided into 11 fields, and each of the 11 fields can correspond to a duration of 1 microsecond from a start value to an end value; for example, field 1 can correspond to 1.0 to 1.9 microseconds, and field 8 can correspond to 8.0 to 8.9 microseconds. Each field can be broken down to a smaller or more precise number; for example, field 3 can correspond to any time between 3.0 and 3.9 microseconds or between 3.000 and 3.999 microseconds. Each field can also correspond to a duration or range based on a number of cycles. Device 112 can store the tracked activity in data structure entries (Operation 144). An example data structure is described below in relation to Fig. 2 described. Each entry can specify the number of bins, a duration or range of time or cycles associated with a given bin, and a counter associated with that bin. While tracking activity over a given connection, the device 112 can mark or display the tracked activity in the entry for that connection by incrementing the counter value associated with a storage location corresponding to the duration of the corresponding idle time, based on the number of idle times tracked for that duration (Operation 146). For example, tracking four idle periods of equal duration (e.g., 3 microseconds) can result in the storage location being marked for "3 microseconds" by incrementing the counter for that storage location by 4.

[0012] Following operations 140, 142, and 144, device 112 can send the stored tracked activity 150 back to device 102 (operation 148). Device 102 can receive the stored tracked activity 150 (as stored tracked activity 152), which can be displayed as information 120 on the peripheral I / O components 106. As described in Fig. As shown in Figure 1B, the displayed information 120 can include a visual representation of the tracked activity (e.g., as a histogram) 121, which may further include: a number of bins 122; a duration / period for a bin 123; and a count for a bin 124. The displayed information 120 can also include filtered tracked activity 125, which may contain a subset of the tracked activity based on a factor or property of the traffic, e.g., by application 126, by traffic class 127, or by service 128. The user 104 can use one or more interactive elements to filter the tracked activity, e.g., interactive elements associated with elements 125-128, and can also use element 132 to send a command to perform a filtering task.In some aspects, the device 112 or another unit (not shown) can filter the tracked activity, and the stored tracked activity 170 and / or 172 may contain the filtered tracked activity, which may subsequently be displayed (e.g., as items 125-128) as part of the displayed information 120.

[0013] During various phases of operation of the units in environment 100, device 112 can send information 170 back to device 102 in response to user commands or requests (operation 148). Device 102 can receive the information 170 (as information 172), which can be displayed as information 120. The information 170 / 172 and the displayed information 120 can include a critical path 129 and insights 130. The critical path 129 can indicate a connection that has excessively high or low idle or utilization time (e.g., based on a predetermined threshold), also in comparison to other connections of the same device or neighboring devices. Insights 130 can contain information provided by device 112 or server 108, including diagnostics requested by and returned from server 108 (via communication 166 and 168).Insights 130 may contain information that can be used by System 110, Device 102, or Device 112 to take action that may improve the efficiency of the system or a device connected to the system. For example, Insights 130 may indicate that a particular link or group of links has a certain number of idle periods with a duration and frequency that exceeds a predetermined threshold (e.g., two links connected to Device 112 have 20 idle periods that last longer than 12 microseconds or more than 60 cycles). Insights 130 may provide information or recommendations for actions to be taken to investigate or correct abnormal idle times for the two links. The examples of insights given here are for illustrative purposes only.Other types of insights are possible and can be provided by any of the described units in the environment 100.

[0014] In some aspects, user 104 can obtain insights by requesting diagnostics from server 108 (which may contain an analysis engine or a pattern recognition system). For example, user 104 can use interactive element 132 to send a command to perform a task, which can be sent as command 162, resulting in communications 166 and 168 and receiving the requested diagnostics and insights from information 172. Information 170 / 172 and the displayed information 120 may also contain other information 131 that may relate to any of the activities or operations described here. Thus, device 112 can return information 170 (operation 148) that can be used to display elements 121-132.In some aspects, the device can display 112 information (Operation 148) to a directly connected peripheral I / O component (not shown), and the displayed information can include any of the items 121-132.

[0015] As described above, the displayed information 120 may contain one or more interactive elements (such as element 132) that allow user 104 to send commands related, for example, to tracking link activity, configuring time intervals or bins, receiving and displaying histograms, and requesting diagnoses or insights. User 104 can view and / or edit the displayed information 120 (operation 154) using one or more interactive elements. User 104, an algorithm / script, a system, a part of the system, or any other mechanism can also perform a task based on the critical path or insight (operation 155), such as...The execution of an action that causes traffic to be rerouted from a critical path identified as over-congested, or rerouted to another path via a connection identified as over-used. User 104, an algorithm / script, a system, a part of the system, or another mechanism can also perform an action based on an insight associated with the filtered and tracked activity. For example, if a particular group of connections for a specific application exhibits a "bursty stream" of traffic (i.e., significant and inconsistent amounts and rates of traffic, e.g.,If a connection experiences many long periods of occupancy and few short periods of occupancy, mixed with inconsistently occurring idle periods, or a combination of long and short periods of occupancy mixed with short idle periods, the system can display this as part of Insight 130 and provide the user with recommendations on how to handle the inconsistent traffic bursts. If a connection experiences a "steady stream" of traffic (i.e., evenly occupied periods of similar length), the system can display this as part of Insight 130 and provide the user with information that the connection is operating efficiently at a desired or optimal rate. The above examples of steady and spurious traffic flows are for illustrative purposes only. Other scenarios can be used to describe steady or spurious traffic flows. The information obtained about the current performance of the connection (e.g.,(in relation to a sudden or steady traffic flow, or the number, duration and frequency of occupied or idle periods) can be referred to as "dynamic real-time telemetry" and can be linked to an application, traffic class or service.

[0016] Fig. Figure 2 shows the packet spacing information stored in a data structure 200 in accordance with an aspect of the present application. The data structure 200 can be, for example, a table 200. The table 200 can contain rows with columns or fields that include: a total number of bins 202; a bin number 204 (e.g., an index); a bin duration / bin range 206; and a bin number 208. For example, an entry 210 can indicate that for a time interval divided into 13 bins, a bin numbered 1 covers a duration of 1.0 to 1.9 microseconds (or 5-9 cycles) with a total of 4. For the same time interval divided into 13 bins, an entry 212 can indicate that a bin numbered 2 covers a duration of 2.0 to 2.9 microseconds (or 10-14 cycles) with a total of 12; an entry 214 can indicate that a bin numbered 4 covers a duration of 4.0 to 4.9 microseconds (or 20-24 cycles) with a total of 3; and an entry 216 can indicate that a field numbered 9 covers a duration of 9.0 to 9.9 microseconds (or 45-49 cycles) with a total of 1. The data represented in the fields numbered 1-11 of data structure 200 can be used in . Fig. 3C corresponds to the tracked activity shown.

[0017] Data structure 200 can also contain upper and lower bound fields. For example, an entry 220 can indicate that a field with the number 0 covers a duration of less than 1 microsecond (or 0-4 cycles) with a total field count of 0; and an entry 222 can indicate that a field with the number 12 covers a duration of more than or equal to 12 microseconds (or more than or equal to 60 cycles) with a total field count of 0. The bins with the numbers 0 and 12 are in data structure 200 of Fig. 2 shown, but not in histograms 330, 350, 370 and 390 of Fig. 3A-D, in which only the eleven bins numbered 1 to 11 are shown.

[0018] Data structure 200 can correspond to either idle periods or occupancy periods only by maintaining a single bin counter 208 for the respective tracked or incremented idle or occupancy period. In some aspects, data structure 200 can contain two separate columns or counts for the same total number of bins and bin duration / range, e.g., one column for histogram counters relating to idle times and one column for histogram counters relating to occupancy times. Thus, as below regarding Fig. As described in section 5, a transition from an idle state to an occupied state or from an occupied state to an idle state will cause the system to increment exactly one histogram counter, either in the idle time histogram counters or in the occupied time histogram counters, depending on the direction of the transition.

[0019] Fig. Figure 3A shows a diagram 300 of the packet spacing (busy / free periods) and a visual representation (histogram) 330 of the packet spacing for four connections 301, 302, 303, and 304 with an equal number of evenly spaced free periods, according to one aspect of the present application. Connections 301–304 can be assigned to connections 116 of Fig. 1A corresponds. In Fig. In diagrams 3A-D, activity, including the occupancy times associated with each connection, is indicated by specific shading in the diagrams (i.e., diagrams 300, 340, 360, and 380): Occupied activity of connection 301 is represented by empty rectangles; occupied activity of connection 302 is represented by rectangles filled with a right-skewed pattern; occupied activity of connection 303 is represented by rectangles filled with a perpendicular crosshatching pattern; and occupied activity of connection 304 is represented by rectangles filled with vertical lines. Furthermore, activities that include idle time are represented by empty spaces between the differently shaded rectangles. Fig. In diagrams 3A-D, time 312 is shown on the right, and the time interval in which the activity is tracked via connections 301-304 begins at a time marked Start 314 and ends at a time marked End 316. Furthermore, in the Fig. 3A-D the histograms (i.e. histograms 330, 350, 370 and 390) provide a visual representation of the packet spacing and tracked activity of links 301-304, where the x-axis represents an idle time 336 in microseconds, with 11 bins each covering the same time range (with a duration of an increasing number of microseconds), and where the y-axis represents a number of samples 338 (corresponding to the number for each bin).

[0020] While the duration of the in Fig. Since 3A-D is based on a fixed area with increasingly longer durations, the bins can be of any size. That is, the granularity and the number of bins on the x-axis can be arbitrarily large and can lead to a "modified and improved" coarse and fine-grained scale compared to existing methods. For example, with regard to the aspects described, the system can use a small number of bins, each representing a larger time period or time window, for a coarse-grained distribution, and a larger number of bins, each representing a smaller time period or time window, for a fine-grained distribution. In this way, the quantity and level of the displayed data (as in Fig. 3A-D) can be configured according to the needs of a user, application, or system. The range of possible distributions for displaying activity across connections (i.e., the modified and improved coarse and fine distributions described above) in the aspects described can provide a level of control that is significantly greater than simply using averages (coarse scale of existing methods) or recording traces at each connection (fine scale of existing methods).

[0021] In diagram 300, the tracked activity for each of the four connections 301-304 comprises four idle periods of equal duration (e.g., idle periods 321, 322, 323, and 324). This information can be represented in histogram 330 as follows: a block 331 (labeled with a count of "4" corresponding to the four idle periods for connection 301); a block 332 (labeled with a count of "4" corresponding to the four idle periods for connection 302); a block 333 (labeled with a count of "4" corresponding to the four idle periods for connection 303); and a block 334 (labeled with a count of "4" corresponding to the four idle periods for connection 301). Blocks 331-334 can be located within a range corresponding to 3 microseconds.

[0022] A user or system may analyze the data generating histogram 330, or histogram 330 itself, and determine that no action is required because all four links exhibit the same amount of traffic in the same idle / busy pattern. Alternatively, the user or system may determine that, due to the fact that the bin count for the 3-microsecond bin exceeds a certain threshold (e.g., 8), action is required to further investigate the activity of links 301-304, for example, to reduce the number or duration of idle periods.

[0023] Fig. Figure 3B shows a diagram 340 of the packet spacing (busy / idle times) and a visual representation (histogram) 350 of the packet spacing for four links with a different number of differently spaced idle times in accordance with an aspect of the present application. In diagram 340, the tracked activity for each of the three links 301-303 includes four shorter idle periods of equal duration (idle periods 341, 342, 343, and 344) and one longer idle period of equal duration (idle period 345).The four shorter idle periods (341-344) can be represented in histogram 350 as follows: one block 351 (labeled with a count of "4" corresponding to the four shorter idle periods for connection 301); one block 352 (labeled with a count of "4" corresponding to the four shorter idle periods for connection 302); and one block 353 (labeled with a count of "4" corresponding to the four shorter idle periods for connection 303). Blocks 351-353 can be in a range corresponding to one microsecond. The single longer idle time (345) can be represented as blocks 355, 356, and 357, each labeled with a count of "1" corresponding to the single longer idle time for connections 301, 302, and 303, respectively. Blocks 355-357 can be located within a range corresponding to 9 microseconds.

[0024] In diagram 340, the tracked activity for junction 304 differs from that of junctions 301-303 and comprises four mean idle periods of equal duration (idle periods 346, 347, 348, and 349). These four mean idle periods can be represented in histogram 350 as block 354 (labeled with a count of "4," corresponding to the four mean idle periods for junction 304). Block 354 may be located in the range corresponding to 3 microseconds.

[0025] A user or a system can access the data (e.g., as in Fig. (2 shown), which generates histogram 350, or analyze histogram 350 itself and determine that action is required because three connections (301-303) exhibit somewhat erratic traffic (i.e., with four short idle periods at the beginning of the measured time interval and one long idle period at the end of the measured time interval), while the fourth connection (304) has more consistent idle periods over the measured time interval. The identified action may involve redistributing the data traffic until the idle times on all four connections are more consistent and show less punctual traffic overall.

[0026] Fig. Figure 3C shows a diagram 360 of the packet spacing (busy / idle times) and a visual representation (histogram) 370 of the packet spacing for four links with a different number of differently spaced idle times in accordance with an aspect of the present application. In diagram 360, the tracked activity for each of the three links 301-303 includes four shorter idle periods of equal duration (idle periods 361, 362, 363 and 364) and one medium-duration idle period of equal duration (idle period 365.1).The four shorter idle periods can be represented in histogram 370 as follows: one block 372 (labeled with a count of "4" corresponding to the four shorter idle periods for connection 301); one block 373 (labeled with a count of "4" corresponding to the four shorter idle periods for connection 302); and one block 374 (labeled with a count of "4" corresponding to the four shorter idle periods for connection 303). Blocks 372–374 can be located within a range corresponding to 2 microseconds. The single medium-duration idle period can be represented as blocks 375, 376, and 377 (within the bin corresponding to 4 microseconds), each labeled with a count of "1" corresponding to the single medium-duration idle period for connections 301, 302, and 303, respectively.

[0027] In diagram 360, the tracked activity for connection 304 differs from that of connections 301-303 and includes a longer idle period at the beginning (idle period 365.2), followed by four shorter idle periods of equal duration (idle periods 366, 367, 368, and 369). In histogram 370, the longer idle period can be represented as block 378, labeled with a count of "1" in the bin corresponding to 8 microseconds, and the four shorter idle periods can be represented as block 371, labeled with a count of "4" in the bin corresponding to 1 microsecond.

[0028] A user or system can analyze the data generating histogram 370, or histogram 370 itself, and determine that action is required because three connections (301-303) exhibit fairly consistent traffic (i.e., with only four medium-duration idle periods at the beginning of the measured time interval and a slightly longer idle period at the end), while the fourth connection (304) exhibits somewhat erratic traffic (i.e., with a long idle period at the beginning, followed by four shorter idle periods until the end). As with the Fig. 3B-based action can be based on Fig. The 3C-based action will involve a redistribution of traffic until idle times are more consistent across all four routes and show less peak traffic overall. Fig. 3C-based measures may also include investigating or verifying junction 304 to understand why there is such a long idle time at the beginning of the measured time interval.

[0029] Fig. Figure 380 shows a diagram of the packet spacing (busy / free periods) and a visual representation (histogram) of the packet spacing for four links with an equal number of differently spaced free periods, in accordance with an aspect of the present application. In diagram 380, the tracked activity for each of the four links 301-304 comprises four idle periods of equal but progressively longer duration (e.g., idle periods 381, 382, ​​383, and 384).This information can be represented in histogram 390 as follows: four blocks 391, each marked with a counter value “1”, corresponding to the first and shortest idle period 381 and located in the range corresponding to one microsecond; four blocks 392, each marked with a counter value “1”, corresponding to the second idle period 382 and located in the range corresponding to two microseconds; four blocks 393, each marked with a count of “1” corresponding to the third idle period 383 and in the bin corresponding to 4 microseconds; and four blocks 394, each marked with a count of “1” corresponding to the fourth and longest idle period 384 and in the bin corresponding to 5 microseconds.

[0030] A user or system can analyze the data that generates histogram 390, or histogram 390 itself, and determine that action must be taken because each of the four connections (301-304) exhibits increasingly longer idle times. Based on Fig. The 3D-determined measure can include checking all connections to determine what the cause of the increasingly long idle times might be.

[0031] By tracking connection activity and labeling it as described here (i.e., as bin data) instead of using a simple average as in existing methods, the described aspects can efficiently provide a fine-grained distribution of activity across the connections, which can be displayed as a histogram. The tracked connection activity can also be passed to another entity (e.g., an analysis engine, a machine learning model, or a pattern recognition system, as above in relation to diagnostics 168 and server 108). Fig. 1A described) are transferred to obtain diagnoses and findings.

[0032] Fig. Figure 4 shows a flowchart 400 illustrating a procedure that facilitates tracking application behavior based on packet spacing in accordance with an aspect of the present application. During operation, in a network device with multiple connections over which data is communicated, the system tracks activity over each connection for a predetermined period of time, where the activity includes at least a number of idle periods or the duration of a single idle period (Process 402). In System 110 of Fig. 1A For example, the device 112 can include several connections 116 through which data is transmitted, for example, to the device 114. The device 112 can track the activity (either the occupied state or the idle state) over a connection for a specific period of time, as described above in relation to process 140. Fig. 1C described. The specific time period can be configured by a user connected to device 112 or by the system, or set as a default value.

[0033] The system divides a predetermined time interval into a number of bins, with each bin being assigned to a time range within the predetermined time interval (Operation 404). For example, as above with respect to Operation 142 of Fig. 1C and the 200 data structure of Fig. As described in paragraph 2, the time interval is 11 microseconds, and the number of bins can be 11, with each bin representing one additional microsecond more than the previous bin, e.g., bin 1 corresponds to one microsecond, bin 2 corresponds to two microseconds, etc.

[0034] The system stores the tracked activity in data structure entries, where each entry specifies the number of bins, a duration of time assigned to each bin, and a count assigned to each bin (operation 406), as above with respect to at least entries 210, 212, 214, and 216 in data structure 200 of Fig. 2 described.

[0035] The system displays the tracked activity in the entry for each connection by incrementing a counter linked to a field corresponding to the duration of the respective idle period, based on an initial number of idle periods tracked for that duration (Operation 408). The bin counter can, for example, be located in a column or field 208 of the entries in data structure 200. Fig. 2 will be saved.

[0036] The system displays the stored tracked activity for the respective connection (Operation 410). In a process like the one in Diagram 300 of Fig. The activity tracked for compounds 301-304 can be represented as histogram 330 in 3A. Fig. 3A is displayed. The same applies to the processes shown in diagrams 340, 360 and 380 of the Fig. 3B, Fig. 3C and Fig. The activity tracked for compounds 301-304, represented in 3D, can be seen as histograms 350, 370 and 390 of the Fig. 3B, Fig. 3C and Fig. 3D representation.

[0037] Fig. Figure 5 shows a diagram 500 of transitions and operations performed between and during idle and busy states according to one aspect of the present application. Diagram 500 can show a mechanism implemented by the described system that counts idle and busy periods, for example, using counters labeled "idle_period" and "busy_period," respectively. For a given connection, the mechanism can detect a transition of activity on the connection from a busy state (i.e., sending data or the presence of data that needs to be sent) to an idle state (i.e., not sending data or the presence of data that needs to be sent), and can also detect a transition of activity on the connection from an idle state to a busy state.

[0038] Diagram 500 assumes that the connection starts in an idle state 520. The system can increment the idle_period counter by one in each cycle (operation 522). When the system detects a transition from idle to busy (i.e., when the connection has data to send or is about to send, indicated by a trigger 550), the connection may be in a transition to the busy state 530, and the system can perform several operations. The system can reset the busy_period counter to zero (operation 532). The system can determine the current value of the idle_period counter (operation 534). The system can determine the corresponding idle time histogram counter by comparing the current value of the idle time counter with the duration values ​​(i.e., the bins) of the histogram of the counters used to measure idle times (operation 536). The system can then determine the corresponding idle time histogram counter (i.e., the current value of the idle time counter).h. increment the bin) by one (Operation 538). Assume the data structure 200 in . Fig. 2 stores information about idle periods. If the idle period counter has a current value of "22" (i.e., 22 cycles), the system can determine that the corresponding idle period histogram counter for bin number 4 corresponds to a bin duration / range of 20-24 cycles. The system can then increment this bin counter (column 208 for row 214) by one.

[0039] When the connection has completed the transition to the busy state 540 (indicated by 552), the system can increment the busy_period counter by one in each cycle (operation 542). When the system detects a transition from the busy state to the idle state (i.e., when the connection has no data to send or receive, indicated by a trigger 554), the connection may be in an idle state transition 510, and the system can perform several operations. The system can reset the idle_period counter to zero (operation 512). The system can determine the current value of the busy_period counter (operation 514). The system can determine the corresponding occupancy time histogram counter by comparing the current value of the occupancy time counter with the duration values ​​(i.e., the bins) of the occupancy time counters (operation 516).The system can then increment the corresponding histogram counter (i.e., the bin) for the occupancy time by one (Operation 518). Assume the data structure 200 in . Fig. 2 stores information relating to occupancy times. For example, if the busy_period counter has a current value of "45" (i.e., 45 cycles), the system can determine that the corresponding histogram counter for occupancy time is bin number 9, which corresponds to a bin duration / bin range of 45-49 cycles. The system can then increment this bin counter (column 208 for row 216) by one.

[0040] Once the connection has completed the transition to sleep state 520 (indicated by 556), the system can proceed and repeat the operations and transitions described above. The system can use two data structures similar to data structure 200 in Fig. Manage two, i.e., one for histogram counters relating to idle time and one for histogram counters relating to active time. In some aspects, as above regarding... Fig. As described in section 2, the system can maintain a single data structure with the same total number of bins and bin duration / range and can also contain two separate bin counts (as columns), e.g., a bin count for idle times and a bin count for occupied times, with the corresponding bin count being incremented in operations 518 and 538.

[0041] The system can compare the conventional measurement of average connection bandwidth (e.g., using a simple counter that counts the number of busy cycles over a sample period) with an estimate of the bandwidth derived from the histograms of busy and idle times (e.g., as derived from data structures such as data structure 200 of Fig. 2 are generated). The system can use the result of this cross-check to gain additional insights into how a particular application uses network resources.

[0042] Furthermore, the described aspects can provide a simple analysis of activity on network connections in the frequency domain, as opposed to the time domain, by increasing the number of bins for bins corresponding to specific durations of either idle or busy periods. Since each bin represents a different activity frequency, the system can provide a frequency spectrum of an application's interaction with the network. This can give both a programmer and an administrator better insight into performance and opportunities for improvement than a simple bandwidth measurement would provide.

[0043] Fig. Figure 6 shows a computer system 600 that facilitates tracking application behavior based on packet spacing in accordance with an aspect of the present application. The computer system 600 comprises a processor 602, a memory 604, and a storage device 606. The memory 604 can include volatile memory (e.g., random access memory (RAM)) that serves as managed memory and can be used to store one or more memory pools. Furthermore, the computer system 600 can be connected to peripheral input / output user devices 610 (e.g., a display device 611, a keyboard 612, and a pointing device 613). The storage device 606 comprises a non-transitory, computer-readable storage medium and stores an operating system 616, instructions 618, and data 630. The computer system 600 can be connected to the device 112 of Fig. 1A corresponds and may contain fewer or more units or instructions than those in Fig. The instructions 618 are included as shown. They can also reside on a single computer device or be distributed across multiple physical and virtual machines communicating in a networked environment.

[0044] Instructions 618 may include instructions 620-628 which, when executed by computer system 600 (or by processor 602 of computer system 600), may cause computer system 600 to perform the procedures and / or processes described in this disclosure. In particular, instructions 618 may include instructions 620 to track activity over a given connection for a predetermined period of time, the activity comprising at least a number of idle periods or the duration of a given idle period, as above with respect to operation 140 of Fig. 1C and Operation 402 of Fig. 4 described. Instructions 618 may include instructions 622 to divide a predetermined time interval into a number of bins, each bin being assigned to a time range within the predetermined time interval, as above with respect to operations 142 and 404 of the Fig. 1 and 4 described. 1 and 4 described.

[0045] Instructions 618 may also include instructions 624 for storing the tracked activity in a data structure, where an entry in the data structure specifies the number of bins, a duration of time assigned to each bin, and a counter assigned to each bin. An example data structure with entries is shown above in relation to data structure 200. Fig. 2 described, including entries 210, 212, 214, and 216, each specifying a total number of storage bins 202, a storage bin number 204, a storage bin duration / area 206, and a storage bin count 208. Instructions 618 may also include instructions 626 to mark the tracked activity in the entry for the respective connection by incrementing a count associated with a storage bin that matches the duration of the respective idle period, based on an initial number of idle periods tracked for the matching duration, as described above with respect to the storage bin count 208 in data structure 200 of Fig. 2 as well as with regard to the creation of the histograms, which are in the Fig. 3A-D. In some aspects, the tracked activity includes at least a number of active periods or a duration of each active period, and instructions 626 further serve to increment a count associated with a bin corresponding to the duration of each active period, based on a number of active periods tracked for the corresponding duration, as above in relation to the Fig. 2 and Fig. 5 described.

[0046] Additionally, instructions 618 may contain instructions 628 to display the stored tracked activity for the respective connection, as above in relation to operation 148 and the displayed information 120 of Fig. 1B as well as in histograms 330, 350, 370 and 390 of Fig. 3A, Fig. 3B, Fig. 3C and Fig. 3D.

[0047] The Data 630 may include any data required as input or generated as output by the methods, operations, communications, and / or processes described in this disclosure. In particular, the Data 630 may store at least the following: an identifier or indicator of a connection; a status of "busy" or "idle" for activity or packet traffic over a connection; an indicator of a connection when it is "busy" or "idle"; a time interval; a "bin"; a number of "bins"; a "bin" duration or span; a "bin" counter; a data structure; data structure entries; a counter; an incremented counter; a visual representation of the tracked activity over a connection; a time span; a number of cycles; a counter; a number of idle or active periods; a duration of an idle or active period; a packet size;a total number of bytes transmitted over a period of time; a user-configured time period; a start or stop time; an interval; a predefined event associated with an application or service; a histogram; a subset of data; filtered data; filtered data based on an application, traffic class, or service; an indicator from a user, analytics engine, machine learning model, or pattern recognition system; telemetry; performance data; a critical path; an insight; reported bandwidth usage; an indicator of a steady or sputtering packet stream; an endpoint indicator; and an identifier or indicator for an entry switch, intermediate switch, or network interface controller (NIC).

[0048] The 618 commands can contain more commands than those in Fig. 6 shown. For example, commands for executing the operations described above can also be stored in command 618, specifically with regard to: the environment of Fig. 1A; the processes required to create the data structure in Fig. 2 lead to; the communication that leads to the diagrams and histograms of the Fig. 3A-D results; shown in flowchart 400 of Fig. 4 and in the diagram 500 of Fig. 5 processes depicted; and the instructions of the computer-readable medium 700 in Fig. 7.

[0049] Fig. Figure 7 shows a computer-readable medium 700 that facilitates tracking application behavior based on packet spacing according to an aspect of the present application. CRM 700 can be a non-transitory computer-readable medium or device that stores instructions which, when executed by a computer or processor, cause the computer or processor to perform a procedure. CRM 700 can store instructions 710 to track, in a network device with multiple links over which data is communicated, the activity over each link for a predetermined period of time, the activity comprising at least one of a number of idle periods or a duration of each idle period, as above with respect to operations 142 and 404 of the Fig. 1 and Fig. 4 described. The activity can also include at least a number of active periods or the duration of a corresponding active period. CRM 700 can store instructions 712 to divide a predetermined time interval into a number of bins, each bin being assigned to a time range within the predetermined time interval, as described above in relation to instructions 622 of Fig. 6, Operation 142 of Fig. 1C and Operation 404 of Fig. 4 described.

[0050] CRM 700 can store instructions 714 to store the tracked activity in data structure entries, where each entry specifies the number of bins, a duration of time assigned to each bin, and a count assigned to each bin, as above with respect to data structure 200. Fig. 2 described. CRM 700 can store instructions 716 to mark the tracked activity in the entry for the respective connection by incrementing a count associated with a bin that corresponds to the duration of the respective idle period, based on an initial number of idle periods tracked for the matching duration, as above with respect to the bin count 208 in data structure 200 of Fig. 2 described. The data structure can store and increment histogram counters for idle time, histogram counters for active periods, or both idle time and active period histogram counters. Furthermore, CRM 700 can store instructions 718 to display the stored tracked activity for the respective connection, as described above in relation to the creation of histograms 330, 350, 370, and 390 in Fig. 3A-D.

[0051] CRM 700 can perform more commands than those in Fig. The 7 shown contain instructions. For example, CRM 700 can also include instructions for performing the operations described above in relation to the environment of Fig. 1A, the operations required to create the data structure in Fig. 2 lead to the communication that leads to the diagrams and histograms of Fig. 3A-D lead; the processes shown in flowchart 400 of Fig. 4 and in the diagram 500 of Fig. 5 are shown; and instructions 618 in Fig. 6.

[0052] In general, the disclosed aspects provide a method, a computer system, and a computer-readable medium (CRM) that facilitate the tracking of application behavior based on packet spacing. In a network device with multiple connections through which data is communicated, the system tracks the activity over each connection for a predetermined period. The activity includes at least a number of idle periods or the duration of a corresponding idle period. The system divides a predetermined time interval into a number of bins. Each bin is associated with a time range within the predetermined time interval. The system stores the tracked activity in data structure entries. A corresponding entry specifies the number of bins, the duration of the time assigned to a corresponding bin, and the counter value assigned to that bin.The system displays the tracked activity in the entry for each connection by incrementing a count associated with a storage location that corresponds to the duration of the respective idle period, based on an initial number of idle periods tracked for that matching duration. The system then displays the stored tracked activity for that connection.

[0053] In one variation of this approach, the system tracks the time period or number of cycles during which the connection is idle by maintaining a first counter. The system tracks the time period or number of cycles during which the connection is active by maintaining a second counter. The activity comprises at least a number of active periods or the duration of each active period. The respective bin is associated with the duration of the respective active period.

[0054] In another variation of this aspect, the system calculates the duration of each idle period based on the packet size of the transmitted data and the total number of bytes transmitted during the specified time period.

[0055] In another variant, the system tracks the activity over the respective connection for the predetermined period of time based on at least one of the following: a user-configured period of time; a start time or a stop time associated with an application or service; or an interval based on the occurrence of a predefined event associated with the application or service.

[0056] In another variant, the system displays the stored tracked activity for the respective connection as a histogram, showing the number of idle periods tracked for the duration assigned to the respective bin.

[0057] In another variant, the system receives a subset of data by filtering the stored tracked activity based on at least one of the following criteria: an application, a traffic class, or a service.

[0058] In another variant, the system transmits the stored tracked activity or the filtered stored tracked activity to at least one of the following elements: a user, an analysis device, a machine learning model, or a pattern recognition system.

[0059] In another variant, the system receives information that facilitates the following: obtaining dynamic, real-time telemetry data that includes performance data for a given application; identifying a critical path associated with controlling the performance of that application; providing insights into how the application uses network resources by analyzing filtered, stored, and tracked activity; determining whether reported bandwidth usage is associated with sending a steady stream of packets or a bursty stream of packets; and determining whether multiple endpoints in a system exhibit the same or different behavior.

[0060] In another aspect, a computer system comprises a processor and a storage device that holds instructions which, when executed by the processor, are instructions for performing operations. The instructions are used to track activity over a given connection for a predetermined period of time, where the activity comprises at least either a number of idle periods or the duration of each idle period. The instructions further divide a predetermined time interval into a number of bins, each bin corresponding to a time range within the predetermined time interval. The instructions also store the tracked activity in a data structure, where each entry in the data structure represents the number of bins, the duration of time assigned to each bin, and a counter associated with each bin.The instructions also serve to mark the tracked activity in the entry for the respective connection by incrementing a count associated with a bin corresponding to the duration of the respective idle period, based on an initial number of idle periods tracked for that matching duration. The instructions also serve to display the stored tracked activity for the respective connection. The computer system may contain content-processing instructions that contain further instructions, such as the instructions for performing the operations described herein, including those relating to the environment of [the system]. Fig. 1A; the operations required to create the data structure in Fig. 2 lead to; the communication that leads to the diagrams and histograms of Fig. 3A-D lead; the processes shown in flowchart 400 of Fig. 4 and in the diagram 500 of Fig. 5 are shown; and the instructions of the computer-readable medium 700 in Fig. 7.

[0061] In another aspect, a non-transitory computer-readable storage medium (CRM) stores instructions to track activity on a network device with multiple connections for a predetermined period of time. This activity includes at least a number of idle periods or the duration of each idle period. The instructions further divide a predetermined time interval into a number of bins, with each bin corresponding to a time range within the predetermined interval. The instructions also store the tracked activity in data structure entries. Each entry specifies the number of bins, the duration of time assigned to that bin, and a counter value associated with that bin.The instructions also serve to mark the tracked activity in the entry for the respective connection by incrementing a count associated with a bin corresponding to the duration of the respective idle period, based on an initial number of idle periods tracked for that matching duration. The instructions also serve to display the stored tracked activity for the respective connection. The ZRM can also store commands to execute the operations described above, specifically in relation to the environment of [the connection]. Fig. 1A; the operations required to create the data structure in Fig. 2 lead to; the communication that leads to the diagrams and histograms of the Fig. 3A-D lead; the ones in flowchart 400 of Fig. 4 and in the diagram 500 of Fig. 5 processes shown; and instructions 618 in Fig. 6.

[0062] The foregoing description is intended to enable the person skilled in the art to produce and use the aspects and examples and is given in connection with a specific application and its requirements. Various modifications of the disclosed aspects are readily apparent to the person skilled in the art, and the general principles defined herein can be applied to other aspects and applications without departing from the spirit and scope of this disclosure. Therefore, the aspects described here are not limited to those shown but have the broadest possible scope consistent with the principles and features disclosed herein.

[0063] Furthermore, the foregoing descriptions of the aspects serve only for illustration and description. They do not claim to be exhaustive and do not limit the aspects described herein to the disclosed forms. Accordingly, many modifications and variations will be obvious to those skilled in the art. Moreover, the above disclosure is not intended to limit the aspects described herein. The scope of the aspects described herein is defined by the attached claims.

Claims

[1] Computer-implemented method, comprising: Tracking, in a network device with multiple connections through which data is communicated, the activity over each connection for a predetermined period of time, wherein the activity includes at least either a number of idle periods or the duration of each idle period; Dividing a predetermined time interval into a number of bins, where each bin is assigned to a time range within the predetermined time interval; Storing the tracked activity in data structure entries, where each entry specifies the number of bins, a duration of time assigned to each bin, and a count value assigned to each bin; Indicating the tracked activity in the entry for each connection by incrementing a count value associated with a bin that corresponds to the duration of the respective idle period, based on an initial number of idle periods tracked for the matching duration; and Displays the saved tracked activity for the respective connection. [2] The method of claim 1, wherein the method further comprises: Tracking a period of time or a number of cycles during which the connection is idle by maintaining an initial counter. [3] The method of claim 1, wherein the method further comprises: Tracking a time period or number of cycles during which the connection is active by maintaining a second counter, wherein the activity comprises at least one of a number of active periods or a duration of each active period, and where each bin is assigned to a duration of the respective active period. [4] The method of claim 1, wherein the method further comprises: Calculating the duration of each idle period based on the packet size of the data being communicated and the total number of bytes communicated during the specified time period. [5] The method of claim 1, wherein the method further comprises: Tracking activity over the respective connection for the specified time period based on at least one of the following: a time period configured by a user; a start or stop time associated with an application or service; or an interval based on the occurrence of a predefined event associated with the application or service. [6] The method of claim 1, wherein the method further comprises: Display the stored tracked activity for each connection as a histogram, indicating the number of idle periods tracked for the duration assigned to the respective bin. [7] The method of claim 1, wherein the method further comprises: Obtaining a subset of data by filtering the stored tracked activity based on at least one of the following: an application; a traffic class or a service. [8] The method of claim 7, wherein the method further comprises: Sending the stored tracked activity or the filtered stored tracked activity to at least one of the following: a user; an analysis engine; a machine learning model or a pattern recognition system. [9] The method of claim 8, wherein the method further comprises receiving information that enables the following: Receive dynamic real-time telemetry with performance data for a specific application; Identifying a critical path that is assigned to controlling the performance of the respective application; To provide insight into how the respective application uses network resources by analyzing the filtered, stored, and tracked activity; Determine whether reported bandwidth usage is attributed to sending a steady stream of packets or a bursty stream of packets; and Determine whether a plurality of endpoints in a system exhibit the same or different behavior. [10] Computer system with multiple connections through which data is communicated, wherein the computer system comprises: a processor and A storage device that stores instructions which, when executed by the processor, include instructions for: Tracking the activity over a given connection for a predetermined period of time, wherein the activity includes at least either a number of idle periods or the duration of a given idle period; Dividing a predetermined time interval into a number of bins, where each bin is assigned to a time range within the predetermined time interval; Storing the tracked activity in a data structure, wherein an entry in the data structure specifies the number of bins, a duration of time assigned to each bin, and a count value assigned to each bin; Marking the tracked activity in the entry for the respective connection by incrementing a counter value associated with a bin that corresponds to the duration of the respective idle period, based on an initial number of idle periods tracked for the matching duration; and Displays the saved tracked activity for the respective connection. [11] Computer system according to claim 10, wherein the computer system operates in a network and comprises at least one of the following: an input network switch, wherein the data from the input network switch is sent to the network via the multiple connections; an intermediate switch, whereby data is sent or received over the multiple connections; or a network interface controller (NIC). [12] Computer system according to claim 10, wherein the instructions further comprise: Tracking a period of time or a number of cycles during which the connection is idle by maintaining an initial counter. [13] Computer system according to claim 10, wherein the instructions further comprise: Tracking a period of time or a number of cycles during which the connection is active, by maintaining a second counter, wherein the activity comprises at least one of a number of active periods or a duration of each active period, and where each bin is assigned to a duration of the respective active period. [14] Computer system according to claim 10, wherein the instructions further comprise: Tracking activity over the respective connection for the specified time period based on at least one of the following: a time period configured by a user; a start or stop time associated with an application or service; or an interval based on the occurrence of a predefined event associated with the application or service. [15] Computer system according to claim 10, wherein the instructions further comprise: Display the stored tracked activity for each connection as a histogram, indicating the number of idle periods tracked for the duration assigned to the respective bin. [16] Computer system according to claim 10, wherein the instructions further comprise: Filtering the stored tracked activity based on at least one of the following: an application; a traffic class or a service; and Sending the stored tracked activity or the filtered stored tracked activity to at least one of the following: a user; an analysis engine; a machine learning model or a pattern recognition system. [17] Computer system according to claim 10, wherein the instructions further comprise: Receive dynamic real-time telemetry with performance data for a specific application; Identifying a critical path that is assigned to controlling the performance of the respective application; To provide insight into how the respective application uses network resources by analyzing the stored tracked activity; Determine whether reported bandwidth usage is attributed to sending a steady packet stream or a bursty packet stream; and Determine whether a plurality of endpoints in a system exhibit the same or different behavior. [18] Non-transitory computer-readable medium that stores instructions for: Tracking, in a network device with multiple connections through which data is communicated, the activity over each connection for a predetermined period of time, wherein the activity includes at least either a number of idle periods or the duration of each idle period; Dividing a predetermined time interval into a number of bins, where each bin is assigned to a time range within the predetermined time interval; Storing the tracked activity in data structure entries, where each entry specifies the number of bins, a duration of time assigned to each bin, and a count value assigned to each bin; Marking the tracked activity in the entry for the respective connection by incrementing a counter value associated with a bin that corresponds to the duration of the respective idle period, based on an initial number of idle periods tracked for the matching duration; and Displays the saved tracked activity for the respective connection. [19] Non-transitory computer-readable medium according to claim 18, wherein the instructions further comprise performing at least one of the following: Tracking a period of time or a number of cycles during which the connection is idle by maintaining a first counter; or Tracking a period of time or a number of cycles during which the connection is active, by maintaining a second counter, furthermore, the activity comprises at least one of a number of active periods or the duration of a respective active period, and The respective bin is assigned to a duration of the respective active period. [20] Non-transitory computer-readable medium according to claim 18, wherein the instructions further comprise: Filtering the stored tracked activity based on at least one application, traffic class or service and Display the stored tracked activity or the filtered stored tracked activity for the respective connection as a histogram indicating the number of idle periods tracked for the duration assigned to the respective bin.

Images