US6308148B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Network flow data export
Assignee: Cisco Technology Inc
•
Filing: 1996-12-20
•
Granted: 2001-10-23
•
Expires: 2016-12-20
Abstract
Abstract The invention provides a system for collecting, exporting and using data relating to message flows responsive to message flow patterns in a flow switching network. A router collects and aggregates flow information using a variety of criteria, including (1) ranges of addresses for source and destination, (2) information about packets in the flow, including number and frequency of packets in the flow, size of packets in the flow (total size and distribution), (3) protocol used for the flow, including for example whether the flow uses electronic mail protocol, file transfer protocol, hypertext transfer protocol, real-time audiovisual data transmission protocol, or some other protocol, (4) other administrative criteria which may be pertinent to the flow, including for example initiation time or duration of the flow, and (5) possible aggregations or combinations of these criteria. The router provides the aggregated information to one or more filters at an output port. Each filter selects only a subset of the total set of flows; filters may be combined to create compound filters. Filters may be coupled to aggregators, which further aggregate flow data and may store flow data for use by application programs. Application programs may identify useful information in the flow data and may either (1) present that data to an operator for review, or (2) use that data to adjust features or parameters of the network. The router may also collect information so that flows which are improper or otherwise unusual can be traced to particular source and destination devices.
Inventors
- 👤 Barry L. Bruins
- 👤 Darren R. Kerr
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 23:03
CPC Classifications
H; H04; H04L; H04L45/00; H04L45/56; H04L45/566; H04L47/00; H04L47/10; H04L47/24; H04L47/2441; Y; Y10; Y10S; Y10S707/00; Y10S707/99941; Y10S707/99944; Y10S707/99945; Y10S707/99948
Claims Analysis
Total Claims: 24
Claim 1
Independent Claim
166 words
A method for exporting data responsive to patterns of message flows passing through a routing device of a network, said method including the steps of: receiving a plurality of packetized message flows defined by transport protocol fields and each comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; collecting history information regarding the plurality of message flows at the routing device; filtering the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; aggregating the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the subset of message flows in a database of a storage element for use by one or more external application programs; and tracing said history information to identify a source or a destination device for said subset of message flows.
Claim 2
Independent Claim
166 words
A method for exporting data responsive to patterns of message flows passing through a routing device of a network, said method including the steps of: receiving a plurality of packetized message flows defined by transport protocol fields and each comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; collecting history information regarding the plurality of message flows at the routing device; filtering the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; aggregating the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the subset of message flows in a database of a storage element for use by one or more external application programs; and tracing said history information to identify a source or a destination device for said subset of message flows.
Claim 3
Dependent Claim
44 words
A method as recited in claim 1 , further comprising the steps of: automatically displaying through a display application program, based on the aggregated message flow information, accounting information pertaining to network usage for use in charging users of the network for their use.
Claim 4
Dependent Claim
48 words
A method as recited in claim 1 , further comprising the steps of: automatically displaying through a network management application program, based on the aggregated message flow information, event information that identifies an attempt to violate a security policy as determined according to one or more administrative policies.
Claim 5
Independent Claim
190 words
A system for exporting data responsive to message flow patterns, said system including means for receiving a message flow defined by transport protocol fields as a set of packets for a particular TCP or UDP transport connection traveling in a single direction on a network; means for collecting, from a router on the network, history information regarding a plurality of message flows, and for receiving a plurality of flow data packets of the message flows that are generated by the router; a filter coupled to said flow data packets that filters the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; an aggregator coupled to the filter and that aggregates the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the sub-plurality of message flows in a database of a storage element for use by one or more external application programs; and means for tracing said history information to identify a source or a destination device for said selected message flow.
Claim 6
Independent Claim
190 words
A system for exporting data responsive to message flow patterns, said system including means for receiving a message flow defined by transport protocol fields as a set of packets for a particular TCP or UDP transport connection traveling in a single direction on a network; means for collecting, from a router on the network, history information regarding a plurality of message flows, and for receiving a plurality of flow data packets of the message flows that are generated by the router; a filter coupled to said flow data packets that filters the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; an aggregator coupled to the filter and that aggregates the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the sub-plurality of message flows in a database of a storage element for use by one or more external application programs; and means for tracing said history information to identify a source or a destination device for said selected message flow.
Claim 7
Dependent Claim
46 words
A system as recited in claim 4 , further comprising means for communicating the stored aggregated message flow information to an application program for use in modifying a performance parameter of the router that improves performance of the router based on the aggregated message flow information.
Claim 8
Independent Claim
180 words
A method for improving performance of a routing device in a network responsive to message flow patterns of messages passing through the routing device, said method including the steps of: receiving a plurality of message flows represented by transport protocol fields and each comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; filtering the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; aggregating the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the sub-plurality of message flows and occupies less storage than the sub-plurality of message flows in a database of a storage element for use by one or more external application programs; and communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in improving performance of the routing device.
Claim 9
Independent Claim
180 words
A method for improving performance of a routing device in a network responsive to message flow patterns of messages passing through the routing device, said method including the steps of: receiving a plurality of message flows represented by transport protocol fields and each comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; filtering the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; aggregating the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the sub-plurality of message flows and occupies less storage than the sub-plurality of message flows in a database of a storage element for use by one or more external application programs; and communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in improving performance of the routing device.
Claim 10
Dependent Claim
114 words
A method as recited in claim 6 , wherein the step of communicating the stored aggregated message flow information to the routing device comprises the step of communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in achieving fairness among a plurality of devices that communicate packets in the network with respect to an administrative policy selected from among: pricing according to time of day; pricing according to relative loading; granting greater or preferential access to particular users or preferred classes of users; or granting greater access or preferential access to particular message flows or classes of message flows.
Claim 11
Dependent Claim
63 words
A method as recited in claim 6 , wherein the step of communicating the stored aggregated message flow information to the routing device comprises the step of communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in achieving a particular quality of service treatment of the message flows.
Claim 12
Dependent Claim
80 words
A method as recited in claim 6 , wherein the step of communicating the stored aggregated message flow information to the routing device comprises the step of communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in prioritizing different types of message traffic, in response to relative loading of particular types of message flows on a communication link that is coupled to the routing device.
Claim 13
Dependent Claim
96 words
A method as recited in claim 6 , wherein the step of communicating the stored aggregated message flow information to the routing device comprises the step of communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in prioritizing different types of message traffic, in response to relative loading of particular protocols used in the message flows in response to an amount of network bandwidth actually being used for the protocols on a communication link that is coupled to the routing device.
Claim 14
Dependent Claim
71 words
A method as recited in claim 6 , wherein the step of communicating the stored aggregated message flow information to the routing device comprises the step of communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in limiting use of a particular protocol to no more than a selected fraction of network bandwidth for that protocol.
Claim 15
Dependent Claim
183 words
A computer-readable medium carrying one or more instructions for exporting data responsive to patterns of message flows passing through a routing device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: receiving a plurality of packetized message flows defined by transport protocol fields and each comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; collecting history information regarding the plurality of message flows at the routing device; filtering the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; aggregating the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the sub-plurality of message flows in a database of a storage element for use by one or more external application programs; and tracing said history information to identify a source or a destination device for said selected message flow.
Claim 16
Dependent Claim
183 words
A computer-readable medium carrying one or more instructions for exporting data responsive to patterns of message flows passing through a routing device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: receiving a plurality of packetized message flows defined by transport protocol fields and each comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; collecting history information regarding the plurality of message flows at the routing device; filtering the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; aggregating the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the sub-plurality of message flows in a database of a storage element for use by one or more external application programs; and tracing said history information to identify a source or a destination device for said selected message flow.
Claim 17
Dependent Claim
200 words
A computer-readable medium carrying one or more instructions for improving performance of a routing device in a network responsive to patterns of message flows passing through the routing device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: receiving a plurality of message flows represented by transport protocol fields and each comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; filtering the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; aggregating the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the sub-plurality of message flows and occupies less storage than the sub-plurality of message flows in a database of a storage element for use by one or more external application programs; and communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in improving performance of the routing device.
Claim 18
Dependent Claim
200 words
A computer-readable medium carrying one or more instructions for improving performance of a routing device in a network responsive to patterns of message flows passing through the routing device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: receiving a plurality of message flows represented by transport protocol fields and each comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; filtering the message flows to result in selecting at least one subset of said message flows, wherein all message flows in the subset of message flows satisfy a selected criterion; aggregating the sub-plurality of message flows by creating and storing at least one set of aggregated message flow information that represents the sub-plurality of message flows and occupies less storage than the sub-plurality of message flows in a database of a storage element for use by one or more external application programs; and communicating the stored aggregated message flow information to the routing device for use in modifying a parameter value of the routing device that results in improving performance of the routing device.
Claim 19
Independent Claim
218 words
A method for exporting data representing one or more message flows that pass through a routing device of a network, said method including the steps of: receiving a plurality of packetized message flows defined by transport protocol fields, each of the flows comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; filtering the message flows using a first filter to result in selecting a first subset of said message flows, wherein all packets selected by the first filter for the first subset of message flows have the same originating domain value; filtering the first subset of message flows using a second filter to result in selecting a second subset of said message flows, wherein all packets selected by the second filter for the second subset of message flows have the same protocol value; aggregating the second subset of message flows by creating and storing first aggregated message flow information that represents the second subset of message flows in a database of a first storage element; receiving the first aggregated message flow information from the first storage element at a display application program that computes one or more charges to one or more users of the network based on the first aggregated message flow information.
Claim 20
Independent Claim
218 words
A method for exporting data representing one or more message flows that pass through a routing device of a network, said method including the steps of: receiving a plurality of packetized message flows defined by transport protocol fields, each of the flows comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network; filtering the message flows using a first filter to result in selecting a first subset of said message flows, wherein all packets selected by the first filter for the first subset of message flows have the same originating domain value; filtering the first subset of message flows using a second filter to result in selecting a second subset of said message flows, wherein all packets selected by the second filter for the second subset of message flows have the same protocol value; aggregating the second subset of message flows by creating and storing first aggregated message flow information that represents the second subset of message flows in a database of a first storage element; receiving the first aggregated message flow information from the first storage element at a display application program that computes one or more charges to one or more users of the network based on the first aggregated message flow information.
Claim 21
Dependent Claim
140 words
A method as recited in claim 14 , further comprising the steps of: filtering the first subset of message flows using a third filter to result in selecting a third subset of said message flows, wherein all packets selected by the third filter for the third subset of message flows satisfy a criterion other than those used by the first filter and second filter; aggregating the third subset of message flows by creating and storing second aggregated message flow information that represents the third subset of message flows in a second storage element; consolidating the first aggregated message flow information and the second aggregated message flow information in a consolidated database; receiving consolidated message flow information from the consolidated database; computing one or more charges to one or more users of the network based on the consolidated message flow information.
Claim 22
Dependent Claim
228 words
A network data flow export system configured to export data representing one or more message flows that pass through a routing device of a network, the system comprising: a first filter that receives a plurality of packetized message flows defined by transport protocol fields, each of the flows comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network and that filters the message flows to result in selecting a first subset of said message flows, wherein all packets selected by the first filter for the first subset of message flows have the same originating domain value; a second filter that filters the first subset of message flows to result in selecting a second subset of said message flows, wherein all packets selected by the second filter for the second subset of message flows have the same protocol value; a first aggregator that aggregates the second subset of message flows by creating and storing first aggregated message flow information that represents the second subset of message flows in a database of a first storage element; means for communicating the first aggregated message flow information from the first storage element to a display application program that computes one or more charges to one or more users of the network based on the first aggregated message flow information.
Claim 23
Dependent Claim
228 words
A network data flow export system configured to export data representing one or more message flows that pass through a routing device of a network, the system comprising: a first filter that receives a plurality of packetized message flows defined by transport protocol fields, each of the flows comprising a plurality of sets of packets for a particular TCP or UDP transport connection traveling in a single direction on the network and that filters the message flows to result in selecting a first subset of said message flows, wherein all packets selected by the first filter for the first subset of message flows have the same originating domain value; a second filter that filters the first subset of message flows to result in selecting a second subset of said message flows, wherein all packets selected by the second filter for the second subset of message flows have the same protocol value; a first aggregator that aggregates the second subset of message flows by creating and storing first aggregated message flow information that represents the second subset of message flows in a database of a first storage element; means for communicating the first aggregated message flow information from the first storage element to a display application program that computes one or more charges to one or more users of the network based on the first aggregated message flow information.
Claim 24
Dependent Claim
156 words
An apparatus as recited in claim 16 , further comprising: a third filter that filters the first subset of message flows to result in selecting a third subset of said message flows, wherein all packets selected by the third filter for the third subset of message flows satisfy a criterion other than those used by the first filter and second filter; a second aggregator that aggregates the third subset of message flows by creating and storing second aggregated message flow information that represents the third subset of message flows in a database of a second storage element; a consolidator that consolidates the first aggregated message flow information and the second aggregated message flow information in a consolidated database; means for communicating the consolidated message flow information from the consolidated database to a display application program that computes one or more charges to one or more users of the network based on the consolidated message flow information.
References Cited (Backward Citations)
US4131767A
Cited
US4161719A
Cited
US4445213A
Cited
US4316284A
Cited
US4397020A
Cited
USRE33900E
Cited
US4438511A
Cited
US4446555A
Cited
US4419728A
Cited
US4424565A
Cited
US4439763A
Cited
US4456957A
Cited
US4437087A
Cited
US4464658A
Cited
US4506358A
Cited
US4532626A
Cited
US4499576A
Cited
US4507760A
Cited
US4819228A
Cited
US4771425A
Cited
US4903261A
Cited
US4646287A
Cited
US4879551A
Cited
US5054034A
Cited
US4679227A
Cited
US4833706A
Cited
US4731816A
Cited
US4644532A
Cited
US4723267A
Cited
US4970678A
Cited
US4679189A
Cited
US4677423A
Cited
US4750136A
Cited
US4757495A
Cited
US4763191A
Cited
US4835737A
Cited
US4933937A
Cited
US4769811A
Cited
US4769810A
Cited
US5491804A
Cited
US4965772A
Cited
US4827411A
Cited
US4893306A
Cited
US5088032A
Cited
US4922486A
Cited
US4991169A
Cited
US4980897A
Cited
US5212686A
Cited
US5255291A
Cited
US4962532A
Cited
US5020058A
Cited
EP0384758A2
Cited
US5249292A
Cited
US5095480A
Cited
US4960310A
Cited
US5003595A
Cited
US4962497A
Cited
US5477541A
Cited
US5208811A
Cited
US5014265A
Cited
US5307343A
Cited
US5128945A
Cited
US5072449A
Cited
US5033076A
Cited
US5237564A
Cited
US5206886A
Cited
US5228062A
Cited
US5199049A
Cited
US5136580A
Cited
US5226120A
Cited
US5604868A
Cited
US5249178A
Cited
US5287453A
Cited
US5229994A
Cited
US5059925A
Cited
US5243342A
Cited
US5115431A
Cited
US5280470A
Cited
US5280480A
Cited
US5268592A
Cited
US5317562A
Cited
US5274631A
Cited
US5247516A
Cited
US5241682A
Cited
US5313582A
Cited
US5224099A
Cited
US5442630A
Cited
US5490258A
Cited
US5311509A
Cited
US5280500A
Cited
US5287103A
Cited
US5386567A
Cited
US5243596A
Cited
US5313454A
Cited
US5621720A
Cited
US5423002A
Cited
US5742760A
Cited
US5260933A
Cited
US5305311A
Cited
US5291482A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-10-22 | 2005-04-23 | 2005-10-23 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-10-22 | 2009-04-23 | 2009-10-23 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-10-22 | 2013-04-23 | 2013-10-23 | $7700.00 | Window Closed / Lapsed |