Traffic Metadata Packet Drop Detection via Sequence Summary Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Determining if aggregated traffic metadata packets are being dropped in communication networks is complex due to sequence number inconsistencies and network congestion, which can lead to unreliable network monitoring when packets are not received in order or are dropped after arrival at the collector.
Innovation Solution
A method and system to track sequence numbers and summary messages per subinterval to estimate the number of dropped packets, adjusting for data loss notifications and using a state machine to handle and recover from overload conditions, enabling accurate detection of dropped packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If sequence numbers are tracked to detect dropped packets, then detection capability is improved, but false positives increase due to network congestion and out-of-order delivery
Solution Approach 1:
The patent segments the detection problem by separating packets into different categories (e.g., NetFlow packets vs. other traffic) and by dividing time into intervals. This allows the system to track sequence numbers more carefully for specific packet types and time windows, reducing false positives while maintaining detection capability.
Solution Approach 2:
The patent performs preliminary actions by establishing baseline sequence number patterns and pre-configuring detection thresholds before actual packet flow occurs. This allows the system to distinguish between normal network variations and actual dropped packets more accurately.
2Reliability
If all aggregated traffic metadata packets are processed, then monitoring completeness is improved, but system overload increases causing packet discarding
Solution Approach 1:
The patent extracts and processes only the critical sequence number information from the aggregated traffic metadata packets, rather than processing all packet contents. This selective extraction maintains monitoring completeness for dropped packet detection while reducing the processing burden on collector systems.
Solution Approach 2:
The patent applies different processing qualities to different packet types and time intervals. Critical packets with sequence number gaps receive intensive processing, while normal packets receive minimal processing, optimizing the balance between monitoring completeness and system capacity.
3Measurement precision
If sequence numbers are incremented by number of records, then aggregation accuracy is improved, but complexity increases when distributing to multiple collector processes
Solution Approach 1:
The patent introduces summary messages as intermediaries between the aggregation engines and collector processes. These summary messages carry the sequence number information in a standardized format, simplifying the distribution process while maintaining aggregation accuracy across multiple collector processes.
Solution Approach 2:
The patent creates a universal summary message format that can be processed by any collector process regardless of its specific role or configuration. This multi-functional summary structure simplifies distributed processing while preserving the sequence number increment logic for accurate aggregation.
Data Source
AI summary
A method includes receiving summary messages summarizing respective aggregated traffic metadata packets output from the at least one traffic management device and an engine. Each summary message identifies an origination pair having a traffic management device and an aggregation engine and a sequence number. The method further includes tracking per subinterval of a series of sub-intervals, highest and lowest sequence numbers and a count of summary messages received for each unique origination pair from the beginning of the subinterval. The method further includes accumulating, per interval, accumulated highest and lowest sequence numbers and an accumulated count of summary messages for each unique origination pair from the beginning of the interval and for all previous subintervals for tracking dropped aggregated traffic metadata packets for the interval. The method further includes estimating a number of dropped aggregated traffic metadata packets for the interval based on the accumulated highest and lowest sequence numbers and the count of summary messages.