Network Traffic Filtering for Real-Time Application Health Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network performance monitoring techniques lack real-time health information and semantic understanding of data streams, making it difficult to determine the source or cause of application issues and distinguishing between healthy and unhealthy application changes.
Innovation Solution
The method involves identifying filtering criteria based on network traffic types, such as TCP or UDP port numbers and IP addresses, to generate a filtered network element metric subset, which includes performance metrics like delay, CPU usage, and memory usage, allowing for real-time analysis of network traffic data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection (DPI) is performed to monitor network traffic, then detailed network performance data can be collected, but the system becomes data-intensive and ineffective in providing real-time health information
Solution Approach 1:
The patent extracts only the necessary performance metrics from network traffic by implementing filtering criteria at the port and protocol levels. Instead of collecting all packet data through DPI, the system selectively extracts relevant metrics such as transaction counts, response times, and error rates for specific protocols (HTTP, HTTPS, FTP, SMTP, POP3, IMAP) and ports, thereby reducing data volume while maintaining monitoring precision.
Solution Approach 2:
The patent segments network traffic monitoring into distinct protocol-specific and port-specific monitoring streams. Each protocol and port combination is monitored independently with tailored filtering criteria, allowing the system to process and analyze network performance data in manageable segments rather than as a monolithic data stream, improving real-time processing capability.
2Reliability
If system management products analyze a large number of data streams to determine application health, then comprehensive monitoring coverage is achieved, but the products lack semantic understanding and cannot identify the ultimate source or cause of problems
Solution Approach 1:
The patent applies local quality by implementing protocol-specific filtering criteria tailored to each network protocol's characteristics. For example, HTTP monitoring focuses on status codes and response times, while FTP monitoring emphasizes transfer rates and completion status. This protocol-aware approach preserves semantic meaning and enables the system to understand the specific context and cause of performance issues for each application type.
3Measurement precision
If packet trace information is collected for network monitoring, then detailed traffic analysis is possible, but packet trace information may be lost and application-specific code is required
Solution Approach 1:
The patent implements a universal monitoring framework that handles multiple network protocols (HTTP, HTTPS, FTP, SMTP, POP3, IMAP) through a common architecture with protocol-specific filtering templates. This multi-functional approach eliminates the need for separate application-specific code for each protocol by using a unified collection mechanism that adapts to different protocols through configurable criteria, reducing system complexity while maintaining detailed analysis capability.
Data Source
AI summary
Provided are methods and computer program products for monitoring the contents of network traffic in a network device and identifying and analyzing transactional network traffic. Methods of collecting network traffic data for transactional traffic may include application of port level filtering and/or protocol level filtering. The filtering methods described herein may assist the operator in identifying transactional and infrastructure problems resulting in application performance degradation.