Network Traffic Aggregation via Neutral Format Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network traffic analysis tools, such as sFlow and Netflow, are unable to provide information on the geographic origin or destination of packets, limiting their ability to offer insights into traffic flow changes relevant to business aspects of network service providers.
Innovation Solution
A system and method that samples packet data, converts it into a neutral format, and aggregates it to derive traffic flow statistics associated with attributes like geographic region, network, and autonomous systems, enabling the generation of reports on traffic volume and flow patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packet-level traffic analysis tools (sFlow, Netflow) are used, then detailed packet information (source IP, destination IP, port numbers) can be obtained, but geographic origin and autonomous system level information cannot be provided
Solution Approach 1:
The patent segments traffic analysis into multiple hierarchical levels: packet-level details (source IP, destination IP, port numbers) are captured by sampling agents, while autonomous system-level and geographic-level information are captured by collectors and aggregators respectively. This segmentation allows each component to focus on specific information types, resolving the contradiction between detailed packet information and high-level contextual information.
Solution Approach 2:
The patent adds new dimensions of analysis by mapping IP addresses to geographic locations and autonomous systems. Instead of only analyzing traffic at the packet level, the system creates additional layers of abstraction (geographic region, autonomous system, network community) that provide contextual information without losing the underlying packet-level details. This multi-dimensional approach simultaneously delivers both detailed and aggregated information.
2Measurement precision
If traffic flow information is gathered at packet level, then low-level information (source IP, destination IP) can be obtained, but high-level business context (city, ISP, autonomous system) cannot be provided
Solution Approach 1:
The patent creates a universal traffic analysis system where sampling agents, collectors, and aggregators work together to serve multiple functions. The same infrastructure that captures packet-level information also generates autonomous system-level statistics and geographic distributions. This multi-functional system adapts to different business needs (capacity planning, marketing analysis, traffic engineering) without requiring separate systems, thus resolving the contradiction between detailed measurement and versatile application.
Solution Approach 2:
The patent introduces collectors and aggregators as intermediary components between the packet-level sampling agents and the business applications. These intermediaries perform the crucial function of mapping raw packet data to meaningful business contexts (autonomous systems, geographic regions, networks). They translate technical packet information into business-relevant metrics, enabling both detailed analysis and high-level contextual understanding.
3Adaptability or versatility
If multiple standardized formats (sFlow, Netflow, cflowd) are supported, then compatibility with different network devices is improved, but data conversion and aggregation complexity increases
Solution Approach 1:
The patent extracts the format conversion functionality into a dedicated component (the collector) that handles all standardized formats (sFlow, Netflow, cflowd). By isolating the conversion logic from the aggregation logic, the system maintains simplicity in the core aggregation function while accommodating multiple formats through a specialized intermediary. This extraction resolves the contradiction by containing the complexity in a manageable, dedicated module.
Solution Approach 2:
The patent changes the parameter representation of traffic data by converting from format-specific parameters (sFlow headers, Netflow records) to a unified neutral format that captures essential traffic characteristics. This parameter transformation allows data from different sources to be aggregated using the same logic, reducing complexity by eliminating format-specific processing while maintaining broad compatibility.
Data Source
AI summary
A method for analyzing traffic in a communications network includes sampling data packets at a plurality of network interconnection points, wherein sampling the data packets includes generating a plurality of sampled packet data in one or more standardized formats, converting the sampled packet data from the one or more standardized formats into a neutral format, and aggregating the sampled packet data in the neutral format from the plurality of network interconnection points. A system includes a communications node operable to sample data packets flowing through and generate sample packet data in a specified format, a collector node operable to convert the sampled packet data into a neutral format, the collector node further operable to map IP addresses of the sampled packet data to corresponding prefixes in a routing table; and an aggregator node operable to aggregate neutrally formatted sampled packet data from a plurality of collector nodes.