TCP Telemetry Fault Localization via Differential Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network engineers face challenges in localizing network connectivity issues due to the inefficiencies of long-running packet captures and the complexity of replicating network states in data center networks, which are costly and difficult to perform.
Innovation Solution
A system and method utilizing TCP telemetry data from each server to localize connectivity issues by aggregating and geo-tagging data, allowing for efficient analysis and identification of problem locations within the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If long-running packet captures are initiated to capture connectivity issues, then complete traffic data is obtained for analysis, but processing power consumption increases significantly
Solution Approach 1:
The patent extracts only the necessary TCP telemetry data (flow establishment, termination, and failure events) from the complete packet capture process. By selectively capturing only relevant connection events rather than all packets, the system obtains sufficient data for fault localization while dramatically reducing processing power requirements.
Solution Approach 2:
The system performs preliminary filtering and aggregation of TCP telemetry data at the edge devices before centralization. By pre-processing the data to extract only meaningful connection events and aggregating flows, the system reduces the volume of data requiring centralized processing, thereby lowering overall processing power consumption while maintaining diagnostic completeness.
2Measurement precision
If network engineers try to reproduce connectivity issues to diagnose problems, then direct observation of the issue is possible, but the complexity of replicating network states in data center networks makes this difficult and cumbersome
Solution Approach 1:
Instead of physically reproducing the network state to observe issues, the system creates a copy of the relevant TCP telemetry data from the actual network state. This data copy includes flow establishment, termination, and failure events that can be analyzed centrally without requiring engineers to manually replicate complex network conditions, thus maintaining measurement precision while reducing operational complexity.
Solution Approach 2:
The patent introduces TCP telemetry data as an intermediary that mediates between the actual network state and the analysis process. Rather than directly manipulating and reproducing network states, engineers analyze the telemetry data copy, which serves as a faithful representation of the original state, thereby eliminating the need for complex state replication while preserving diagnostic accuracy.
3Productivity
If TCP telemetry data is collected from each server and centralized for analysis, then fault localization is achieved efficiently, but data volume and transmission overhead increase
Solution Approach 1:
The patent segments TCP telemetry data into distinct event types (flow establishment, termination, failure events) and processes them separately. This segmentation allows the system to identify and transmit only the critical fault-related events to the central analysis system, reducing overall data volume while maintaining the speed and efficiency of fault localization by focusing on segmented, relevant data portions.
Solution Approach 2:
The system applies partial action by collecting and transmitting only the essential TCP telemetry events necessary for fault localization rather than complete traffic data. By selecting specifically the critical events (connection failures, terminations, establishments) and omitting redundant data, the system achieves efficient fault localization speed while minimizing data transmission overhead through selective data collection.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A server includes a processor and memory. An operating system is executed by the processor and memory. A network interface is run by the operating system and sends and receives flows using transmission control protocol (TCP). An agent application is run by the operating system and is configured to a) retrieve and store TCP telemetry data for the flows in a flow table; b) move selected ones of the flows from the flow table to a closed connections table when the flow is closed; and c) periodically send the flow table and the closed connections table via the network interface to a remote server.