WO1998021845A1

WO1998021845A1 - Method and apparatus for measurement of peak throughput in packetized data networks

Info

Publication number: WO1998021845A1
Application number: PCT/US1997/019973
Authority: WO
Inventors: James D. Ennis, Jr.; John E. Hasselkus; Robert J. Norberg; Robert Troutman; Matthew A. Tucker
Original assignee: Visual Networks, Inc.
Priority date: 1996-11-12
Filing date: 1997-11-12
Publication date: 1998-05-22
Also published as: DE69736399D1; CA2270890A1; DE69736399T2; US5867483A; EP0976212A1; CA2270890C; EP0976212B1; EP0976212A4

Abstract

A system for measuring peak throughput in packetized data networks includes a remote monitoring probe (12) and console (16). The probe (12) is connected to the network to monitor network activity, while the console is in communication with the probe via the network or other communications medium. The probe maintains a plurality of counters associated with different ranges of percentage of utilization of network bandwidth. For each sampling interval, the probe measures the network and individual network circuit bandwidth utilization and increments the appropriate counters associated with the percentage ranges encompassing the measured bandwidth utilizations. The console polls the probe for the percentage counter data to display the network bandwidth utilization in the form of a bar graph and pie chart. The network bandwidth may then be adjusted based on the displayed data.

Description

METHOD AND APPARATUS FOR MEASUREMENT OF PEAK THROUGHPUT IN PACKETIZED DATA NETWORKS

BACKGROUND OF THE INVENTION

1. Technical Field

The present invention pertains to monitoring systems for communications networks. In particular, the present invention pertains to monitoring systems for measuring and displaying peak throughput in packetized data networks to assess network bandwidth utilization for the entire network or individual network circuits. The present invention is related to the system disclosed in U.S. Patent No. 5,521 ,907 (Ennis, Jr. et al) the disclosure of which is incorporated herein by reference in its entirety.

2. Discussion of Prior Art

Communications networks, especially packetized data networks, are currently utilized in various applications for transmission and reception of data across varying distances. Packetized data networks (e.g., local and wide area networks) typically format data into packets for transmission across the network. In particular, the data is partitioned into separate packets at a network transmission site wherein the packets usually include headers containing information relating to packet data and routing. The packets are transmitted through the network in accordance with any of several conventional protocols known in the art (e.g., Frame Relay, High Level Data Link Control (HDLC), X.25, etc.), by which the transmitted data are restored from various packets received at a network destination site.

Packetized data communications are especially appealing for common carrier or time-shared switching systems since a packet communication path or circuit is unavailable only during the time when a packet utilizes the circuit to traverse the network, thereby permitting other users to utilize that same circuit when the circuit becomes available (i.e., during intervening periods between packet transmissions). The entire network and each individual network circuit typically has a maximum data carrying capacity or bandwidth expressed in units of bytes per second (bytes/second). The network or access channel throughput (i.e., bandwidth utilization) is typically measured as an aggregate of the individual circuit throughputs and has a fixed bandwidth, while the individual circuits may be utilized by several users wherein each user may utilize an allocated portion of the circuit bandwidth (i.e., referred to as the committed information rate (CIR)). In other words, the committed information rate is the amount of bandwidth guaranteed to the user for a data communications circuit. When a user sends data on a circuit in excess of the circuit committed information rate, the additional data exceeding the rate might possibly be dropped during transmission, depending upon network traffic conditions, thereby requiring re-transmission and degrading network performance. Since the cost of network bandwidth is directly proportional to the bandwidth quantity, cost effective networks tend to utilize the minimum amount of bandwidth necessary to facilitate data communications.

In order to determine the proper bandwidth requirements for a network or specific circuit, it is desirable to monitor network activity and view the network bandwidth utilization. Various prior art network monitoring systems are available that measure network traffic, throughput, load and other network characteristics. For example, U.S. Patent No. 4,775,973 (Tomberlin et al) discloses a communications measurement matrix display for a protocol analyzer wherein the protocol analyzer measures, and the matrix display shows, communications between nodes on a packet-switched network. The protocol analyzer passively monitors the network and measures network traffic in accordance with a user selected time interval (i.e., one second through four hours). The matrix display shows the network traffic via a grid having markers indicating the volume of traffic between two specific nodes (i.e., the first thirty-one nodes are individually specified and a single grid location is reserved for remaining nodes in the network in excess of thirty one), or the magnitude of traffic between one specific node and each of the other nodes. The protocol analyzer utilizes counters to maintain the amount of frames transmitted between nodes during a user-specified interval.

Further, U.S. patent No. 5,251 ,152 (Notess) discloses a system for collecting and displaying statistical data for a plurality of local area networks (LAN) wherein several remote nodes attached to a LAN collect and analyze LAN data (i.e., traffic) to produce statistics relating to the data. The statistics are sent to a management node for storage in a history file. The history file is periodically compressed to maintain the history file size at a manageable level. The remote nodes employ various counters to produce the data statistics relating to network and packet characteristics, while the management node utilizes the statistics for various displays to show the network information. For example, the management node includes a traffic distribution display wherein vertical bars illustrate percentages of packets within a particular time interval having certain packet lengths.

U.S. Patent No. 5,446,874 (Waclawsky et al) discloses a system for maintaining a standard of operation for a data communications network. The system initially monitors the network for a certain duration to generate benchmark data sets that contain the standard of operation for the network. The benchmark data sets are typically categorized by traffic type or activity (e.g., batch, interactive, voice, etc.). Current network activity is measured by the system and compared to the benchmark data sets via criteria modules that interface an expert system. When the network activity is determined to be beyond normal behavior, the criteria modules notify the expert system such that the expert system may modify network routing, close applications or allocate additional bandwidth. In addition, the benchmark data sets may be modified or updated to include a recent representation of network behavior.

The prior art suffers from several disadvantages. Typically, probes utilized by network monitoring systems for monitoring network activity have limited resources and memory. Since network traffic bursts (i.e., peaks or surges in network traffic) endure for short periods of time, the probe must collect information from the network at short sampling intervals to properly monitor network traffic burst activity. However, monitoring the network with short sampling intervals for extended periods of time generates a large sample base that may exceed the probe's memory. For example, a probe with a one second sampling interval monitoring a network for fifteen minutes accumulates nine-hundred measurements. Although the Notess system (5,251 ,152) utilizes file compression to maintain file size, the compressed file may still grow to exceed the probe's memory capacity, while the additional processing to compress and read the compressed file degrades system performance. Further, incorporating additional processing and memory resources into the probes to accommodate large sample bases increases system costs. Moreover, prior art systems generally display the amount or lengths of data traversing a network, thereby requiring the operator to determine network traffic and bandwidth utilization based on the data volume information. There is typically no provision to display the percentage of network bandwidth utilized over a predetermined time interval in graphical form showing periods of high and low bandwidth utilization to enable an operator to quickly determine appropriate measures for adjusting the bandwidth to accommodate network behavior.

OBJECTS AND SUMMARY OF THE INVENTION

Accordingly, it is an object of the present invention to monitor packetized data networks and display network bandwidth utilization for the entire network or an individual network circuit over a predetermined time interval.

It is another object of the present invention to collect network bandwidth utilization information via a remote monitoring probe by utilizing a series of counters within the probe representing varying percentage ranges of network bandwidth utilization for the entire network or an individual network circuit to reduce the storage requirements for the network sample base and accommodate limited memory resources of the probe.

Yet another object of the present invention is to collect network bandwidth utilization information and analyze that information to advise an operator as to the manner in which to adjust network bandwidth for the entire network or an individual network circuit.

Still another object of the present invention is to monitor network bandwidth utilization and display the percentage of bandwidth utilization for the entire network or an individual network circuit in the form of bar graphs and pie charts, thereby showing the time periods of heavy and/or light network bandwidth utilization.

The aforesaid objects are achieved individually and in combination, and it is not intended that the present invention be construed as requiring two or more of the objects to be combined unless expressly required by the claims attached hereto.

According to the present invention, a remote monitoring probe connected to a packetized data network monitors network activity (i.e., throughput). The probe collects information relating to access channel throughput and circuit level or permanent virtual circuit (PVC) throughput. A permanent virtual circuit is basically a path established in a packet switching network to transfer data to a specific network destination. The access channel throughput refers to the aggregate throughput of all defined PVC circuits or, in other words, the entire network, while the circuit level throughput refers to the throughput associated with a single PVC. A console in communication with the probe polls the probe after a predetermined time period, or upon user request, to retrieve data collected by the probe. The probe determines the number of bytes transmitted on specified network PVCs and the overall network for each predetermined sampling interval, preferably set for one second. A series of counters is utilized by the probe to collect network bandwidth utilization for the entire network and the individual network circuits wherein each counter represents a different network bandwidth utilization percentage (i.e., the percentage of the bandwidth capacity utilized) range. The probe maintains a series of counters for network bandwidth utilization for data traveling in each direction to and from the network, and for each individual circuit for data traveling from the circuit. The probe measures the bandwidth utilization for the network and each individual circuit, and increments, after each sampling interval, the counters for the network and individual circuits that correspond to the percentage of bandwidth utilization measured during that interval. The counters typically maintain information for each fifteen minute interval (i.e., nine hundred seconds), and are then reset to gather information for the next interval. The counter information for the fifteen minute interval is stored in the probe until transferred to the console to display the network bandwidth utilization over a user selected time interval.

The probe counters represent distinct bandwidth utilization percentage ranges that vary depending upon whether the bandwidth utilization is determined for the entire network or an individual circuit. When the overall network utilization is measured (i.e., the aggregate of the individual circuits and typically a fixed bandwidth), the probe maintains a set of counters for data traveling in each direction to and from the network representing the overall utilization percentage (i.e., percentage of bandwidth capacity utilized) range of zero through one-hundred percent. However, when an individual network PVC circuit utilization is measured wherein the bandwidth is allocated among several users (i.e., with each user utilizing a portion of the bandwidth, or having a committed information rate as described above), the probe maintains a set of counters for each circuit (i.e., for data traveling from the circuit) representing circuit utilization percentages (i.e., percentage of committed information rate utilized) in the range of zero through two-hundred percent. The probe utilizes the circuit committed information rate, or the circuit rate (i.e., full bandwidth capacity of the circuit) divided by two when the committed information rate is not available, as the bandwidth capacity value for determining the bandwidth utilization for the circuit as described above. A circuit utilization exceeding one-hundred percent typically indicates that data transmitted in excess of the circuit rate might possibly be dropped since the network circuit exceeds its allotted bandwidth.

After a predetermined time interval, upon user request, or at user-specified times, the console polls the probe to receive the network information (i.e., the data accumulated by the plurality of percentage range counters). The console manipulates the information for display in graphical form. Specifically, the console displays the information via a conventional graphical user interface or window containing a bar graph and pie chart indicating the percentage utilization of network bandwidth. The user specifies whether to view the access channel (i.e., the network for data traveling in each direction to and from the network) or a particular circuit throughput (for data traveling from the circuit), and the time interval over which the data is to be displayed (e.g., two hours, two days, etc.). The bar graph typically includes a horizontal axis partitioned into fifteen minute intervals extending for the user selected time interval, and a vertical axis partitioned into nine hundred one second intervals corresponding to the seconds within each fifteen minute interval on the horizontal axis. The bandwidth utilization percentage ranges associated with the probe counters are color coded such that a multi-colored bar extends along the vertical axis for the entire nine hundred seconds of each fifteen minute interval on the horizontal axis to indicate the amount of time within the fifteen minute interval that the bandwidth utilization was in a particular percentage range. The vertical extension of the various colors within each vertical bar indicates the number of seconds within the fifteen minute interval that the network bandwidth utilization was in the percentage range represented by the color. Since the sampling interval is typically one second, the counts maintained by the counters represent the number of seconds the network or individual circuit operated at a particular utilization. A separate bar graph is shown for each direction of data travel in the network.

The pie chart represents the network bandwidth utilization for a fifteen minute interval selected by the user from the bar graph. The pie chart is color coded as described above for the bar graph to indicate the amount of time within the selected fifteen minute interval that the network bandwidth utilization was in a particular utilization percentage range. A separate pie chart is shown for each direction of data travel in the network wherein a particular pie chart shows the direction associated with the bar graph from which the fifteen minute interval is selected.

The display conveys to an operator the network bandwidth utilization for the entire network for each direction or for an individual circuit (i.e., for a single direction unless a second probe is utilized at a destination site) for the requested time interval. The operator may then, based on the displayed information, reduce the network or circuit bandwidth during all or part of network operation, thereby reducing network costs. The operator may also increase bandwidth during peak times of network operation to enhance system performance. Alternatively, the operator may command the system to analyze the network bandwidth utilization data and advise the operator as to the manner in which to adjust the network or circuit bandwidth. The above and still further objects, features and advantages of the present invention will become apparent upon consideration of the following detailed description of a specific embodiment thereof, particularly when taken in conjunction with the accompanying drawings wherein like reference numerals in the various figures are utilized to designate like components.

BRIEF DESCRIPTION OF THE DRAWINGS

Fig. 1 is a functional block diagram of a data network having a probe monitoring network throughput and a console in communication with the probe for processing probe data according to the present invention.

Fig. 2 is a view in perspective of an exemplary computer system implementing the console according to the present invention.

Fig. 3 is a schematic block diagram of the probe utilized for monitoring the data network according to the present invention.

Figs. 4 - 8 are procedural flow charts illustrating the manner in which the probe determines network bandwidth utilization for the entire network (i.e., access channel throughput) and individual network circuits (i.e., circuit level throughput) by determining range thresholds and incrementing appropriate utilization percentage range counters according to the present invention. Fig. 9 is a procedural flow chart illustrating the manner in which the console retrieves data from the probe and stores the data in short term database tables according to the present invention.

Fig. 10 is a procedural flow chart illustrating the manner in which the console transfers data from the short term database to a long term database according to the present invention.

Fig. 11 is a schematic illustration of an exemplary console graphical user screen displaying the network bandwidth utilization (i.e., access channel throughput) for a two hour history according to the present invention.

Fig. 12 is a procedural flow chart illustrating the manner in which network bandwidth utilization information is displayed by the console according to the present invention.

Fig. 13 is a schematic illustration of a portion of the exemplary console graphical user screen of Fig. 11 displaying a bar graph indicating the network bandwidth utilization for a two hour history according to the present invention.

Fig. 14 is a schematic illustration of a portion of the exemplary console graphical user screen of Fig. 11 displaying a pie chart indicating the network bandwidth utilization for a fifteen minute interval selected from the bar graph of Fig. 13 according to the present invention.

Fig. 15 is a schematic illustration of a portion of an exemplary console graphical user screen displaying a bar graph indicating the network bandwidth utilization (i.e., access channel throughput) for a two day (i.e., forty-eight hour) history according to the present invention. Fig. 16 is a schematic illustration of a portion of an exemplary console graphical user screen displaying a pie chart indicating the network bandwidth utilization (i.e., access channel throughput) for a fifteen minute interval selected from the bar graph of Fig. 15 according to the present invention.

Fig. 17 is a procedural flowchart illustrating the manner in which the console analyzes the bandwidth utilization data to recommend a bandwidth adjustment according to the present invention.

Fig. 18 is a procedural flow chart illustrating the manner in which the console determines a conservative recommendation for bandwidth adjustment according to the present invention.

Fig. 19 is a procedural flow chart illustrating the manner in which the console determines a moderate recommendation for bandwidth adjustment according to the present invention.

Fig. 20 is a procedural flow chart illustrating the manner in which the console determines an aggressive recommendation for bandwidth adjustment according to the present invention.

Fig. 21 is a procedural flow chart illustrating the manner in which the console determines a recommendation for bandwidth adjustment from analysis of recommendations determined for data traveling in each direction on the network (i.e., to and from the network) and/or individual circuit (i.e., data traveling from the circuit wherein two directions are utilized when a probe is located at each end of the circuit) according to the present invention.

DESCRIPTION OF THE PREFERRED EMBODIMENTS A system for monitoring data network throughput and rendering bandwidth adjustment recommendations is illustrated in Fig. 1. Specifically, two sites (A and B) are connected via a packetized data communications network by communication lines 10, 11. The communications network is typically either a North American T1 (1.544 Mbits/second) or CCITT (variable rate) network. Sites A and B are each capable of transmitting and receiving data packets in various protocols utilized by communication lines 10, 11 , such as Frame Relay, High Level Data Link Control (HDLC) and X.25. Each line 10, 11 represents a respective transmission direction as indicated by the arrows. For example, communication line 10 represents transmissions from site A to site B, while communication line 11 represents transmissions from site B to site A. A probe 12 is connected to each communication line to capture and process data packets being sent between sites A and B. The "far" side of the probe captures data packets arriving at the probe, herein referred to as the direction "to the network", while the "near" side of the probe captures data packets departing from the probe, herein referred to as the direction "from the network" or "from the circuit" (when an individual network PVC circuit is referenced). The terms "arriving", "to the network", "departing", "from the network" and "from the circuit" are all relative and are employed to imply transmission direction. By way of example, the probe is disposed toward site A, however, the probe may be connected to the communication lines at any point in the network, and the system may include several probes connected to the network at various locations. The probe monitors throughput for individual or permanent virtual circuits (PVC), or the entire network (i.e., referred to as the access channel wherein network throughput is the aggregate throughput of the individual circuits), wherein Frame Relay, HDLC and X.25 type probes are utilized to monitor the access channel, while frame relay and multiprotocol type probes are utilized to measure individual circuits. A permanent virtual circuit (PVC) is a path established through a packet switching network to carry data to a specific endpoint. Probe 12 passively monitors network activity (i.e., throughput) and collects information for processing by a console 16. The probe collects the information via utilization of a series of counters as described below. Console 16 is in communication with probe 12 via the packetized data network or secondary communication line 15 (e.g., a local area network (LAN)). Console 16 retrieves the information collected by probe 12 and processes the information for display as described below.

Console 16 is typically implemented by a conventional personal computer as illustrated in Fig. 2. Specifically, console 16 may be implemented by an IBM- compatible personal computer preferably equipped with a mouse 67, monitor 63, keyboard 69 and base 65. Base 65 commonly contains the processors, memory and communications resources, such as internal/external modems or other communications cards for the console. The console includes software for analyzing the collected network data and displaying the information to an operator as described below. Further, the console utilizes short term and long term databases to maintain network data for extended periods of time. The databases may be implemented by any conventional or commercially available database. Console 16 typically includes at a minimum an Intel 80486 or equivalent processor with substantial RAM in order to effectively execute the software, however, a pentium processor with 16 megabytes of RAM is preferable. The console may operate as a stand-alone console coupled to the probe, or in a client/server configuration wherein a server (i.e., a computer system as described above preferably utilizing a windows NT environment) performs substantial interactions with the probe and conveys probe information to its clients (i.e., computer systems as described above preferably utilizing a Windows 95 NT or Unix environment). The clients may also communicate with the probe directly for the data collection requests and for providing configuration parameters to the probe as described below.

Probe 12 is a passive monitoring device and is preferably implemented by a Simple Network Monitoring Protocol (SNMP) remote monitoring (R-mon) probe. These probes commonly include free-running counters that increment for each occurrence of a particular event. The probe architecture is similar to the probe architecture disclosed in the aforementioned Ennis, Jr. et al patent (5,521 ,907) and is illustrated in Fig. 3. Specifically, probe 12 includes line interface circuits 31 , 32, packet receivers 33, 34, packet RAM 35, a microprocessor 36 and an ethernet interface 37. Line interface circuit 31 receives signals from communication line 11 and adapts the signals to standard digital logic levels for processing by packet receiver 33. Similarly, line interface circuit 32 receives signals from communication line 10 and adapts the signals to standard digital logic levels for processing by packet receiver 34. Packet receivers 33, 34 receive the adapted signals from line interface circuits 31 , 32, respectively, and identify individual packets in the received data stream for copying and storage in packet RAM 35. Microprocessor 36 retrieves packets from packet RAM 35 and processes the packets to generate bandwidth utilization information as described below, while responding to any requests from console 16. The bandwidth utilization information is stored in internal microprocessor memory (not shown). When console 16 requests bandwidth utilization information from the probe, the information is released from microprocessor 36 to ethernet interface 37 wherein the data is manipulated to be compatible for transfer, preferably via an ethernet bus 38, to console 16. However, the data transfer from the probe to the console may be accomplished via other communication media.

The above described probe components are preferably all conventional and commercially available. For example, the preferred embodiment utilizes a Level One LXT901 PC as Ethernet Interface 37; a Motorola MC(XC) 68EN360RC25-60 as microprocessor 36 and packet receivers 33, 34 (i.e., a single microprocessor chip functions as both the microprocessor and packet receivers); a Texas Instruments TM124BBK32-60 or equivalent DRAM SIMM as Packet RAM 35; and an Advanced Micro Devices AM26LS32PC or equivalent line receivers as Line Interface circuits 31 , 32. It is to be understood that any other components performing substantially the same functions may be utilized in substantially the same manner described above to realize the probe.

Generally, network activity, and in particular network traffic bursts (i.e., sudden surges or peaks in network utilization), endure for short periods of time. In order to appropriately capture network data, the probe must have a sampling interval of sufficiently short duration to collect information relating to the network utilization and bursts. In addition, since the console displays the network utilization information in graphical form as described below, a large sample base is required to provide sufficient granularity to discern bursts within the network utilization data. However, the probe includes limited memory resources that can be exhausted when the probe monitors the network for extended periods of time. For example, a probe having a sampling interval of one second accumulates nine-hundred measurements for a fifteen minute interval (i.e., sixty samples per minute multiplied by fifteen minutes). In order to reduce the storage requirements for the network information while enabling the probe to collect a sufficient sample base for graphical display, the probe utilizes a series of counters to collect and represent network utilization information. The probe sampling interval is preferably set for one second wherein the probe measures network activity. The sampling interval may be designated to be any time interval capable of supplying a sufficient sample base (i.e., sufficient number of data points) to the console for graphical display.

Initially, a system operator enters information into console 16 describing the network configuration including the individual circuits to monitor and corresponding bandwidth capacities and committed information rates (i.e., bandwidth allocated to a circuit as described below) for the network and individual circuits, respectively. The system operator enters further information to enable the probe to determine the network circuit routing and destinations for captured packets (e.g., typically addresses and other parameters). Basically, the packets include an address or other identifier corresponding to the network circuit routing and packet destination. Packet switches forward each packet according to the address and routing information. Since data streams are likely to contain packets for different destinations, the present invention filters the packets based on circuit routing and destination address to collect network information relating to the network and individual circuits. The console transfers various parameters to the probe and configures the probe for proper monitoring operation. The probe captures packets from the network and deposits them in packet RAM 35 (Fig. 3) as described above. Since the console displays information relating to bandwidth utilization for individual network circuits, microprocessor 36 utilizes the parameters transmitted from the console to identify the circuit traversed by a particular packet. Further, since the console displays network utilization for data traveling "to" and "from" the network as described below, microprocessor 36 determines the data direction based on the communication line with which the probe receives a packet. For example, packets received on the "near" side of the probe (Fig. 1 ) indicate data going "from the network", while packets received on the "far" side of the probe indicate data going "to the network". Microprocessor 36 retrieves the captured packets from packet RAM 35 subsequent each sampling interval and filters the packets to associate the packets with the proper network information. Alternatively, the packets may include identifiers indicating the sampling interval within which they are collected such that the microprocessor may determine the packets that are collected during a particular interval and then process the packets at a later time. Microprocessor 36 determines the number of bytes transferred in each direction (i.e., to and from the network) over the network and on each individual circuit during the one second sampling interval. The measured byte information is utilized to increment specific counters within the probe as described below.

Once the probe measures network activity during a sampling interval, the network activity information is typically processed while the probe collects information for the subsequent sampling interval. Therefore, the processing of sampled data occurs within the sampling interval time for proper operation. Microprocessor 36 utilizes a series of counters to store the collected network information. In particular, the counters represent different percentage ranges indicating the amount of bandwidth utilization for the entire network or an individual circuit. The entire network utilization or access channel throughput is based on the aggregate utilization or throughput of the individual circuits and typically includes a fixed maximum bandwidth, while the individual circuits are usually allocated a fraction of the total circuit bandwidth referred to as the committed information rate (CIR). In other words, the committed information rate refers to a guaranteed bandwidth for sending data on a specific circuit. Microprocessor 36 preferably utilizes a series of five counters wherein a separate series of counters is utilized to individually maintain network activity information for data going from the network, data going to the network, and each individual circuit. The counters within each series maintaining utilization information for data traveling to and from the network, respectively, are each associated with a different utilization percentage range within an overall range of 0% - 100%. In particular, each counter from a series corresponds to one of the utilization percentage ranges of 0% - 10%, 11 % - 40%, 41 % - 60%, 61 % - 90% and 91% - 100%, respectively. The counters within each series maintaining utilization information for circuit level throughput measurements are each associated with a different utilization percentage range within an overall range of 0% - 200%. In particular, each counter from a series corresponds to one of the utilization percentage ranges of 0% - 20%, 21 % - 80%, 81 % - 120%, 121% - 180% and 181 % - 200%, respectively. The network throughput is measured against a fixed maximum bandwidth as described above, and therefore the overall percentage range associated with the counters is 0% - 100%. However, since the individual circuits utilize a portion of the circuit bandwidth capacity, the circuits may transfer data at rates in excess of one-hundred percent of the allocated bandwidth or committed information rate. Therefore, the individual circuits require percentage ranges exceeding one-hundred percent. When an individual circuit transfers data at rates that exceed one-hundred percent of the committed information rate, there is a risk that the additional data may not be transferred, thereby degrading performance since the information is continually retransmitted. The counters are incremented after each sampling interval based on the measured throughput of the network and individual circuits as described below. The counters convey the amount of time the network or circuit is operating within the corresponding utilization percentage range, thereby indicating high and/or low network utilization for a particular time interval. It is to be understood that the present invention may utilize any number of counters representing any desired percentage ranges capable of conveying the network activity information.

The manner in which the probe determines the appropriate counter to increment is illustrated in Figs. 4 - 8. Initially, after the probe collects data during a sampling interval, microprocessor 36 (Fig. 3) retrieves and filters the packets from packet RAM 35 as described above. Specifically, the microprocessor determines the increment thresholds at step 2 for the series of utilization percentage counters that maintains information for the access channel throughput for data traveling in each direction to and from the network. The increment thresholds for the counters are determined as illustrated in Fig. 5. In particular, microprocessor 36 sets the increment threshold for the respective 0 - 10% range counters associated with each direction to ten percent of the fixed network bandwidth at step 21. The increment threshold for the respective 11 - 40% range counters associated with each direction is set to forty percent of the fixed network bandwidth at step 23. Similarly, the increment threshold for the respective 41 - 60% range counters associated with each direction is set to sixty percent of the fixed network bandwidth at step 25, while the increment threshold for the respective 61% - 90% range counters associated with each direction is set to ninety percent of the fixed network bandwidth at step 27. The bandwidth for the network is typically entered at console 16 as a parameter and downloaded to the probe as described above to enable the probe to calculate the increment thresholds. These increment thresholds are utilized to determine the appropriate counter to increment as described below. The thresholds indicate the number of bytes required to be transferred during a sampling interval to attain the corresponding bandwidth utilization percentage.

Referring back to Fig. 4, after the increment thresholds are calculated at step 2, microprocessor 36 determines the total of data bytes transferred (i.e., the total byte count does not include overhead bytes transferred with the data) over the network in each direction during the sampling interval based on information in the captured packets. The number of transferred bytes in combination with the increment thresholds are utilized to increment the counters associated with the appropriate bandwidth utilization percent range as illustrated in Fig. 6. The process for incrementing the appropriate counters is performed for data traveling in each direction to and from the network as described below. Specifically, the number of bytes transferred to the network is compared at step 41 to the increment threshold for the 0 - 10% counter. When the number of transferred bytes is less than or equal to the increment threshold, the corresponding 0 - 10% counter is incremented at step 91. When the number of transferred bytes exceeds the increment threshold for the 0 - 10% counter, the transferred byte count is compared at step 43 to the increment threshold for 11 - 40% counter wherein the 11 - 40% counter is incremented at step 93 if the number of transferred bytes is less than or equal to the increment threshold for the 11 - 40% counter. Similarly, when the number of transferred bytes exceeds the increment threshold for the 11 - 40% counter, the number of transferred bytes is compared at step 45 to the increment threshold for the 41 - 60% counter wherein the 41 - 60% counter is incremented at step 95 if the number of transferred bytes is less than or equal to the increment threshold for the 41 - 60% counter. When the number of transferred bytes exceeds the increment threshold for the 41 - 60% counter, the number of transferred bytes is compared at step 47 to the increment threshold for the 61 % - 90% counter wherein the 61 - 90% counter is incremented at step 97 if the number of transferred bytes is less than or equal to the increment threshold for the 61 - 90% counter. When the number of transferred bytes exceeds the increment threshold for the 61 - 90% counter, the 91 - 100% counter is incremented at step 49. In other words, the number of transferred bytes is compared to the increment thresholds of the counters in ascending order until reaching an increment threshold greater than the number of transferred bytes wherein the appropriate counter corresponding to that increment threshold is incremented.

Once the network utilization counters for each direction (i.e., to and from the network) have been updated, microprocessor 36 performs a similar counter update process for the individual circuits having an allotted bandwidth or common information rate. With reference to Fig. 4, microprocessor 36 determines at step 5 whether or not the individual circuits have been processed. When the individual circuits have not been processed, microprocessor 36 determines increment thresholds for the counters at step 6 and increments a corresponding counter at step 7 in substantially the same manner described above for the access channel throughput except that the utilization counters for the individual circuit correspond to different percentage ranges. The probe collects data traveling from the circuit for individual circuits and therefore only determines thresholds and increments counters for a single direction.

The manner in which the increment thresholds are determined for counters associated with individual circuits is illustrated in Fig. 7. Generally, individual circuits utilize only a portion of the total circuit bandwidth and transfer data at a committed information rate as described above. The committed information rate is typically entered at console 16 and downloaded to the microprocessor as described above. Specifically, the microprocessor determines at step 60 whether or not the committed information rate is available. When the committed information rate is not available, the microprocessor assumes at step 61 that the committed information rate is one half the maximum circuit rate. Once the committed information rate is ascertained, the microprocessor sets the increment thresholds for the counters. In particular, the increment threshold for the 0 - 20% counter is set to twenty percent of the committed information rate at step 62; the increment threshold for the 21 - 80% counter is set to eighty percent of the committed information rate at step 64; the increment threshold for the 81 - 120% counter is set to one-hundred twenty percent of the committed information rate at step 66; and the increment threshold for the 121 - 180% counter is set to one-hundred eighty percent of the committed information rate at step 68. The thresholds indicate the number of bytes required to be transferred to attain the corresponding utilization percentage as described above. Subsequent to the increment threshold calculations, a corresponding counter representing the utilization percentage range measured during the sampling interval is incremented as illustrated in Fig. 8. Initially, the microprocessor determines the total number of bytes transferred over the individual circuit during the sampling interval based on the information in the captured packets as described above. Specifically, the number of transferred bytes for the individual circuit is compared at step 81 to the increment threshold for the 0 - 20% counter wherein the 0 - 20% counter is incremented at step 71 if the number of transferred bytes is less than or equal to the increment threshold for the 0 - 20% counter. When the number of transferred bytes exceeds the increment threshold for the 0 - 20% counter, the number of transferred bytes is compared at step 83 to the increment threshold for the 21 - 80% counter wherein the 21 - 80% counter is incremented at step 73 if the number of transferred bytes is less than or equal to the increment threshold for the 21 - 80% counter. When the number of transferred bytes exceeds the increment threshold for the 21 - 80% counter, the number of transferred bytes is compared at step 85 to the increment threshold for the 81 - 120% counter wherein the 81 - 120% counter is incremented at step 75 if the number of transferred bytes is less than or equal to the increment threshold for the 81 - 120% counter. When the number of transferred bytes exceeds the increment threshold for the 81 - 120% counter, the number of transferred bytes is compared at step 87 to the increment threshold for the 121 - 180% counter wherein the 121 - 180% counter is incremented at step 77 if the number of transferred bytes is less than or equal to the increment threshold for the 121 - 180% counter. When the number of transferred bytes exceeds the increment threshold for the 121 - 180% counter, a 181 - 200% counter is incremented at step 89 and the microprocessor returns to process any remaining circuits.

Referring back to Fig. 4, after processing the individual circuit, microprocessor 36 determines at step 5 whether or not further circuits require processing, and repeats the counter incrementing process described above for the remaining circuits waiting to be processed. When all circuits are processed, data from the next sampling interval is utilized to increment the network and circuit counters as described above. The counters are repeatedly incremented at each sampling interval as described above for fifteen minute periods wherein at the end of each period the counts are stored in the microprocessor memory and the counters are reset. In this fashion, a small series of counts contains network information for a fifteen minute interval, thereby reducing storage requirements of the sample base. The period for storage and resetting of the counters may be set to any desired interval accommodating the probe's limited storage requirements.

Console 16 is typically utilized by an operator to retrieve the captured data from the probe and store the data in short and long term databases as illustrated in Figs. 9 - 10. Initially, data from the probe is transferred to console 16 via secondary communications between the console and probe, such as ethernet bus 38 (Fig. 3). An operator can schedule the console to retrieve data from the probe daily at a specified time, each hour, or not at all. Further, an operator can manually command the console to retrieve data from the probe at anytime, or the console automatically collects the appropriate data to satisfy any display requests for a specified time period. The data retrieved by the console from the probe is initially stored in short term database tables at step 8 (Fig. 9) for display on troubleshooting screens as described below. The console further transfers data from the short term database tables to a long term database at step 9 (Fig. 10) to permit recently sampled data to be placed in the short term database. The operator may specify a time for the daily occurrence of the database transfer from the short term to the long term database, or may command the console to immediately transfer the data. The long term database information is typically utilized for printed reports containing information spanning extensive periods of time, such as a day or a month.

Console 16 displays a conventional graphical user interface or window enabling the operator to initiate network bandwidth utilization analysis as illustrated in Fig. 11. The window may be arranged in any fashion and contain any network or other information. The window may contain only the network analysis and report functions, or include any other functions pertinent to the analysis, such as help, tools, view, etc. Specifically, window 20 includes burst tool bar 22, access channel and PVC tool bars 24, 26 and two hour and two day history tool bars 28, 42. Window 20 typically includes several pull down menus located toward the top of the window, such as File, View, Setup, Troubleshooting, Update, Toolset and Help, for initiating various functions. The operation of pull down menus via a mouse is conventional and well known in the computer arts. Further, window 20 includes a sliding bar 44 manipulable by mouse 67 (Fig. 2) to select a desired time interval for viewing. The bar may be moved by directly placing the cursor on the bar via the mouse, and dragging the bar (i.e., maintaining the left mouse button in a depressed state and moving the mouse in a desired direction) to a location indicating the desired time interval to view. In addition, bar 44 is disposed between left and right arrows 46, 48 that may be manipulated via mouse 67 to move the bar in a desired direction (i.e., placing the cursor on an arrow and depressing and releasing the left mouse button (i.e., clicking) moves slide bar 44 in the corresponding direction) to select a time interval. The time interval indicated by the bar position is displayed above the bar. Window 20 further displays network bandwidth utilization in the form of bar graphs 80, 82 for data traveling to and from the network, respectively, for the selected interval as described below. The bar graphs include labels indicating the direction being displayed and the network bandwidth, and a bar graph key 99 showing codes for the utilization percentages associated with the probe counters described below. A pointer 50 is manipulable via mouse 67 along the bar graph horizontal axis to select a particular fifteen minute interval for which a corresponding pie chart 84, 86 is generated as descπbed below. The pie chart is displayed directly below the bar graph from which the fifteen minute interval is selected, and includes a label indicating the actual time of day the selected interval represents. The pie chart further includes a pie chart key 99 showing the codes for the utilization percentages associated with the probe counters and the percentage of the pie chart coded by each code. In addition, window 20 includes advisor button 52 for initiating analysis of the network utilization data to recommend a bandwidth adjustment.

Operation of the console is now described with reference to Figs. 11 - 12. Specifically, console 16 is initiated and commanded to execute the monitoring software. Executing software on console 16 is well known in the computer art. Console 16 displays window 20 wherein network bandwidth utilization analysis is initiated from the troubleshooting pull down menu described above. The operator selects at step 92 either the access channel (i.e., bandwidth for all circuits) or circuit level (i.e., an individual or permanent virtual circuit (PVC)) bandwidth utilization to view by clicking on tool bar 24 or 26, respectively. After selecting the utilization to view, the operator selects at step 94 either a two day or two hour history via tool bar buttons 28, 42, respectively, and subsequently manipulates slide bar 44 via mouse 67 as described above to select the date and times of the interval for display. The operator clicks on burst toolbar button 22 to select bandwidth utilization analysis, and once all the above-described selections are made, console 16 retrieves the appropriate probe data from the short term database tables at step 96 and manipulates the data to generate at step 98 bar graphs 80, 82 described below. The operator may select a fifteen minute interval from the bar graph by manipulating pointer 50 such that console 16 generates a pie chart 84, 86 corresponding to that interval described below.

Console 16 manipulates the data retrieved from the probe in order to display the information in graphical form. In particular, the console receives the counts of all the utilization percentage range counters from the probe for each fifteen minute interval. The counters are typically reset by the probe after every fifteen minute interval to maintain utilization information in fifteen minute increments as described above. Each counter corresponds to the number of seconds the network or individual circuit utilizes the percentage of bandwidth indicated by the bandwidth utilization percentage range associated with that counter. Console 16 preferably color codes each bar graph to indicate the percentage of bandwidth utilization during a specific interval. An exemplary bar graph showing network bandwidth utilization for data traveling from the network is illustrated in Fig. 13, however, the bar graph showing network utilization for data traveling to the network is generated, and functions, in a substantially similar manner. Specifically, bar graph 82 displays the network bandwidth utilization for data heading from the network over a selected two hour period. The bar graph includes a horizontal axis extending over a two hour period partitioned into fifteen minute intervals. The vertical axis extends from zero to nine hundred and indicates the seconds within each fifteen minute interval on the horizontal axis. The utilization percentage ranges associated with the probe counters are displayed in a key 99 indicating the codes 53, 54, 55, 56 and 57 utilized by the bar graph to show the various bandwidth percentage utilizations. Console 16 retrieves the counters from the short term database wherein the counts indicate the amount of time (i.e., number of seconds since the sampling interval is one second) within the fifteen minute interval that the network utilization was at a particular utilization percentage range. Consequently, console 16 displays a vertical bar for each fifteen minute interval on the horizontal axis spanning the vertical axis from zero to nine hundred. Each vertical bar includes a series of vertically concatenated coded bars wherein the height of each concatenated bar within the vertical bar designates the amount of time within the interval that network bandwidth utilization is within a particular percentage range. The amount of time the network utilization is within a particular percentage range is directly proportional to the count of the counter corresponding to that range. Each concatenated bar is coded in accordance with key 99 to indicate the bandwidth utilization percentage that the concatenated bar represents such that for each fifteen minute interval along the horizontal axis, the network bandwidth utilization is easily discemable based on the codes of the concatenated bars. For example, the fifteen minute interval starting approximately at 22:52 and ending at 22:07 has a network bandwidth utilization predominately in the 91 % - 100% range based on the height of the concatenated bar coded utilizing code 57 to indicate the 91 % - 100% range. Typically, the shades from green to yellow represent codes 53 - 54 (i.e., 0 - 40%), while the shades from yellow to red represent codes 55 - 57 (i.e., 41 - 100%), however, any color scheme or other indicia may be utilized to distinguish the percentage ranges.

Subsequent to displaying bar graph 82, pointer 50 may be manipulated via mouse 67 to isolate a specific fifteen minute interval and generate a pie chart 86 as illustrated in Fig. 14. Specifically, pie chart 86 is coded in accordance with key 99 based on network bandwidth utilization as described above. Key 99 includes substantially the same coding scheme described above for the bar graph and further indicates the proportion (i.e., percentage) that pie chart 86 is coded by each code. The value of each of the probe counters indicates the amount of time (i.e., seconds since the sampling interval is one second) within the selected fifteen minute interval that the bandwidth utilization was in the utilization percentage range associated with that counter and directly influences the proportion that pie chart 86 is coded with the corresponding code indicating that percentage range. For example, when the counter for the 91 - 100% (i.e., code 57) range attains a value of approximately 465, this indicates that the network was in the 91 % - 100% utilization range for approximately half the time of the fifteen minute interval (i.e., 465 is approximately half of the 900 seconds within the interval), thereby causing approximately half of the pie chart to be coded by corresponding code 57 indicating the 91 % - 100% range as illustrated in the figure. The other codes are utilized in the pie chart in a similar manner based on the percentage range counters associated with the other percentage ranges. The color scheme for the pie chart is substantially similar to the color scheme for the bar graph described above and may be any color scheme or other indicia capable of distinguishing the percentage ranges.

A detailed view of a bar graph displaying data for a two day period is illustrated in Fig. 15. The bar graph for a two day period is substantially similar to the bar graph described above for the two hour period except that the bar graph horizontal axis extends to indicate a two day period. Specifically, bar graph 70 includes a horizontal axis partitioned into six hour intervals extending for forty-eight hours (i.e., two days). The six hour intervals further include twenty-four fifteen minute intervals. Each fifteen minute interval includes a vertical bar having a series of vertically concatenated bars with each concatenated bar coded to designate a network bandwidth utilization percentage as described above. Further, pointer 50 may be manipulated along the horizontal axis to isolate a particular fifteen minute interval within the two day period for generation of a pie chart 72 in substantially the same manner described above. The generated pie chart is substantially similar to the pie chart generated above for the two hour time period and is illustrated in Fig. 16.

When an individual circuit is selected for viewing, the console displays a window substantially similar to window 20 described above. Specifically, the window includes a bar graph and pie chart that are substantially similar to the bar graph and pie chart described above except that the utilization percentage ranges indicated in the bar graph and pie chart keys reflect the committed information rate, or half the circuit rate when the committed information rate is not available, and extend from zero to two-hundred percent. Since a probe captures network information for individual circuits in a single direction (i.e., from the circuit), only a single bar graph and pie chart are displayed on the window. However, when an additional probe is utilized at the other end of the circuit, the console processes that probe's data in substantially the same manner described above and displays a bar graph and pie chart corresponding to data traveling from that other end of the circuit or probe. An operator specifies the circuit to view wherein each bar graph and pie chart includes labels indicating the circuit and the committed information rate for that circuit. Each bar graph and pie chart displays data in substantially the same manner described above utilizing codes to delineate the varying utilization percentage ranges. Typically, the color scheme employed in each bar graph and pie chart utilizes the shades from green to yellow for the range 0 - 80% and the shades from yellow to red for the range 81 - 200%, however, any color scheme or other indicia capable of delineating the percentage ranges may be employed.

Once the bar graph and pie charts are displayed, an operator can view the bandwidth utilization and make adjustments. For example, a bar graph showing operation in the 0 - 10% range for a majority of the selected time samples indicates that additional applications, extra users, or increased communications can be enabled across the network or circuit without degrading performance. Further, when the bar graph and pie chart indicate low utilization, the bandwidth may be reduced, thereby reducing costs. Conversely, a bar graph showing bandwidth utilization predominantly in the 91 - 100% range indicates a highly utilized network or circuit that may require additional bandwidth. The console may recognize such periods of high utilization and issue an alarm and/or warning (e.g., audio, displayed warning, printed message etc.) notifying the operator of the condition. Alternatively, console 16 may analyze the bandwidth utilization data and suggest whether to increase or decrease the network bandwidth or individual circuit rate as illustrated in Fig. 17. Specifically, an operator selects at steps 14, 17 the access channel or circuit throughput information and time period for the console to analyze (i.e., two hour or two day) in substantially the same manner described above, and subsequently clicks on advisor button 52 (Fig. 11) to initiate the analysis. The console retrieves the appropriate data from the short and/or long term databases at step 18 and determines a series of recommendations for bandwidth adjustment at step 19 as described below. A conservative recommendation is least tolerable to high bandwidth utilization and recommends increasing the bandwidth after surpassing a low threshold. Conversely, the conservative recommendation ensures low bandwidth utilization for a substantial period of time and recommends decreasing the bandwidth after surpassing a high threshold. An aggressive recommendation is tolerable to high bandwidth utilization and recommends increasing the bandwidth upon surpassing a high threshold. A decrease in bandwidth is recommended by the aggressive recommendation after surpassing a low threshold indicating low bandwidth utilization for short periods of time. A moderate recommendation suggests increasing or decreasing the bandwidth upon surpassing respective thresholds set to values between the conservative and aggressive thresholds. The system determines each of the conservative, moderate and aggressive recommendations for the network and the selected individual circuits and indicates the recommendations in a report described below.

Once the operator selects the access channel or circuit throughput and time interval, and subsequently clicks on button 52, the console retrieves the appropriate data from the database tables and determines each of the recommendations described above. The conservative recommendation is determined in the manner illustrated in Fig. 18. Initially, the console sums the counts retrieved from the database tables for each respective percentage utilization counter in order to obtain the total counts for each respective counter during the entire time interval. The sums indicate the number of seconds within the time interval that bandwidth utilization was in the particular percentage range associated with the counter. The counter sums are then compared to threshold percentages of the time interval as described below. Specifically, the console determines at step 102 whether the analysis is for the network (i.e., access channel) or individual circuit. When the analysis is for the network, the console determines at step 104 whether or not the topmost counter (i.e., the sum of the counts for the 91% - 100% counter during the interval) exceeds ten percent of the time interval (i.e., whether or not high bandwidth utilization occurred in excess of 10% of the two hour or two day time interval). If the topmost counter exceeds 10% of the time interval, then the conservative recommendation suggests to increase the bandwidth at step 106. When the topmost counter does not exceed 10% of the time interval, the console determines at step 108 whether or not the second lowest counter (i.e., the sum of the counts for 11 % - 40% counter during the interval) exceeds 90% of the time interval (i.e., whether or not low bandwidth utilization occurred in excess of 90% of the two hour or two day time interval). Upon determining that the second lowest counter exceeds 90% of the time interval, the conservative recommendation suggests to decrease bandwidth at step 110. When the second lowest counter does not exceed 90% of the time interval, the conservative recommendation for the access channel suggests no adjustment of bandwidth at step 112.

When the analysis is for an individual circuit, the console determines at step 101 whether or not the sum of the top two counters for the interval period (i.e., the total of the sum of the counts for the 181% - 200% and 121 % - 180% counters during the interval) exceeds 10% of the time interval (i.e., whether or not the high utilization occurred in excess of 10% of the two hour or two day time interval). If the sum of the counters exceeds 10% of the time interval, then the conservative recommendation suggests to increase the committed information rate for the circuit at step 103. When the sum of the counts does not exceed 10% of the time interval, the console determines at step 105 whether or not the second lowest counter (i.e., the sum of the counts for the 21 % - 80% counter during the interval) exceeds 90% of the time interval (i.e., whether or not low utilization occurred in excess of 90% of the two hour or two day time interval). Upon determining that the second lowest counter exceeds 90% of the time interval, the conservative recommendation suggests to decrease the committed information rate for the circuit at step 107. When the second lowest counter does not exceed 90% of the time interval, the conservative recommendation for the individual circuit suggests no adjustment of the committed information rate at step 109. The above process is performed for each network direction (i.e., to and from the network) to determine recommendations for each network direction. When an additional probe is utilized on a circuit, a recommendation for the direction from each probe is determined, otherwise only a recommendation for a single circuit direction (i.e., from the circuit) is determined. The manner in which the moderate recommendation is determined is illustrated in Fig. 19. The moderate recommendation is determined in substantially the same manner as the conservative recommendation described above except that the sums of the counts of the utilization percentage counters are compared against different thresholds to arrive at a bandwidth or committed information rate adjustment. Specifically, an increase in the network (i.e., access channel) bandwidth is suggested at step 124 when the console determines at step 122 that the top most counter (i.e., the sum of the counts for 91% - 100% counter during the interval) exceeds 25% of the time interval (i.e., high bandwidth utilization occurred in excess of 25% of the two hour or two day time interval), while a decrease in access channel bandwidth is suggested at step 128 when the console determines at step 126 that the second lowest counter (i.e., the sum of the counts for the 11 % - 40% counter during the interval) exceeds 75% of the time interval (i.e., low bandwidth utilization occurred in excess of 75% of the two hour or two day time interval). No adjustment for the network bandwidth is suggested at step 130 for other values of the sums of the counts for these counters. Similarly, an increase in the committed information rate is suggested at step 123 for an individual circuit when the console determines at step 121 that the sum of the top two counters for the interval period (i.e., the total of the sum of the counts for the 181% - 200% and 121% - 180% counters during the interval) exceeds 25% of the time interval (i.e., high bandwidth utilization occurred in excess of 25% of the two hour or two day time interval), while a decrease in the committed information rate for the circuit is suggested at step 127 when the console determines at step 125 that the second lowest counter (i.e., the sum of the counts for the 21 % - 80% counter during the interval) exceeds 75% of the time interval (i.e., low bandwidth utilization occurred in excess of 75% of the two hour or two day time interval). No adjustment for the committed information rate is suggested at step 129 for other values of the sums of the counts for these counters. The above process is performed for each network and circuit direction as described above.

The manner in which the aggressive recommendation is determined is illustrated in Fig. 20. The aggressive recommendation is determined in substantially the same manner as the conservative and moderate recommendations described above except that the sums of the counts for the utilization percentage counters are compared against different thresholds to arrive at the aggressive recommendation. Specifically, an increase in network (i.e., access channel) bandwidth is suggested at step 144 when the console determines at step 142 that the top most counter (i.e., the sum of the counts for the 91% - 100% counter during the interval) exceeds 50% of the time interval (i.e., high bandwidth utilization occurred in excess of 50% of the two hour or two day time interval), while a decrease in access channel bandwidth is suggested at step 148 when the console determines at step 146 that the second lowest counter (i.e., the sum of the counts for the 11 % - 40% counter during the interval) exceeds 50% of the time interval (i.e., low bandwidth utilization occurred in excess of 50% of the two hour or two day time interval). No adjustment for the network bandwidth is suggested at step 150 for other values of the sums of the counts these counters. Similarly, an increase in the committed information rate is suggested for an individual circuit at step 143 when the console determines at step 141 that the sum of the top two counters for the time interval (i.e., the total of the sum of the counts for the 181 % - 200% and 121 % - 180% counters during the interval) exceeds 50% of the time interval (i.e., high bandwidth utilization occurred in excess of 50% of the two hour or two day time interval), while a decrease in committed information rate for the circuit is suggested at step 147 when the console determines at step 145 that the second lowest counter (i.e., the sum of the counts for the 21 % - 80% counter during the interval) exceeds 50% of the time interval (i.e., low bandwidth utilization occurred in excess of 50% of the two hour or two day time interval). No adjustment for the committed information rate for the circuit is suggested at step 149 for other values of the sums of the counts of these counters. The above process is performed for each network and circuit direction as described above.

The console determines the conservative, moderate and aggressive recommendations for each direction of data travel on the network (i.e., going to and from the network) and individual circuits as described above. Once the conservative, moderate and aggressive recommendations are determined for each direction, the respective recommendations in each direction are examined to arrive at final conservative, moderate and aggressive recommendations provided to the operator as illustrated in Fig. 21. The console determines a final recommendation for each of the respective conservative, moderate and aggressive recommendations for the network and individual circuits in substantially the same manner described below. However, the final recommendations suggest an adjustment to bandwidth for the network analysis, while suggesting adjustments to the committed information rate for individual circuits. Specifically, the console determines at step 162 whether or not an increase in bandwidth or circuit committed information rate is suggested for either network (i.e., to and from the network) or circuit direction. When an increase in the bandwidth or circuit committed information rate has been suggested, the final recommendation suggests to increase the network bandwidth or circuit committed information rate at step 164. Upon determining that an increase in bandwidth or circuit committed information rate has not been suggested, the console determines at step 161 whether or not no bandwidth or circuit committed information rate adjustment is suggested for either direction. When no bandwidth or circuit committed information rate adjustment has been suggested, the final recommendation suggests not to adjust the network bandwidth or circuit committed information rate at step 165. Upon determining that a "no adjustment" suggestion has not been made, the final recommendation suggests a decrease in the network bandwidth or circuit committed information rate at step 163.

After the operator views the bandwidth utilization, a report may be generated by the console in hardcopy form displaying the utilizations for a particular day or month. Specifically, the operator enters the time period for the report and the console generates exemplary reports as illustrated in Appendix A. The console retrieves the counts of the appropriate utilization percentage counters from the long term database for the selected interval, and sums the counts of the respective counters for the interval to display the information in graphical or tabular form as described below. In particular, report 1 in Appendix A is an exemplary report containing information relating to network bandwidth utilization (i.e., the access channel throughput) for data going to the network on a particular day. An operator may specify to the console whether to generate a report for data going to or from the network. Report 1 displays the data in bar graph form generated in substantially the same manner as, and substantially similar to, the bar graphs described above having the number of hours within the day on the horizontal axis and the number of seconds per hour on the vertical axis. A coded vertical bar for each hour indicates the utilization percentages (e.g., in the range of 0 - 100% as described above) for that hour in substantially the same manner described above for the two hour and two day bar graphs. Report 1 further includes a key indicating the percentage ranges associated with the codes, the date the information was collected, the date the report is printed, the network, the site, the access line and line speed, and the values and units associated with the bar graph axes.

Similarly, report 2 of Appendix A is substantially similar to report 1 described above except that the report displays data in bar graph form for an entire month. The bar graph horizontal axis contains the number of days within the month while the bar graph vertical axis contains the number of seconds per day. A coded vertical bar for each day indicates the utilization percentages for that day in substantially the same manner described above. Reports for the individual circuits are substantially similar to reports 1 and 2 described above except that the percentages indicated by the codes (e.g., in the range of 0 - 200% as described above) are different and the report may only be generated utilizing data traveling from the circuit.

Alternatively, an operator may command the console to generate reports having the system recommendations for adjusting the bandwidth and/or committed information rate as illustrated in exemplary reports 3 and 4 of Appendix A. Specifically, report 3 displays data for the network on a particular day in tabular form. Each row of the table corresponds to an hour within the day and contains information relating the amount of time (i.e., in percentages) within that hour that the network bandwidth utilization was in the percentage ranges associated with the probe counters described above. The table columns indicate the utilization percentage ranges (i.e., 0 - 10%, 11 - 40%, 41 - 60%, 61 - 90% and 91 - 100%) and include the ranges for data traveling both to and from the network. The sum of the counts for the utilization percentage counters indicate the time the bandwidth utilization is in a particular range and are utilized to determine the percentages contained in the table. The table further includes an additional summary row containing the totals for each of the table columns. Report 3 further displays the date of the information (i.e., the day), the date the report is printed, the network, the site, the access line and access line rate, and the conservative, moderate and aggressive recommendations for bandwidth adjustment.

Report 4 of Appendix A illustrates an exemplary report for an individual circuit and is substantially similar to report 3 described above except that table columns indicate percentage ranges for individual circuits (i.e., 0 - 20%, 21 - 80%, 81 - 120%, 121 - 180% and 181 - 200%). Specifically, report 4 contains the information in tabular form as described above and further displays the date the information was collected, the date the report is printed, the network, the circuit name and path, and the conservative, moderate and aggressive recommendations for committed information rate adjustment for the circuit. Further, the table displays percentages for data traveling from the circuit and includes a label identifying the circuit. When an additional probe is utilized at the other end of the circuit, the table also includes percentage utilizations for data coming from that other end of the circuit or probe.

Operation of the present invention is now described with reference to Figs. 1 , 2 and 11. Initially, a probe 12 is connected to a network at any desired location to monitor and collect information relating to network traffic. An operator initiates monitoring software in console 16 to enable the console to display network bandwidth utilization. The operator enters the various line rates and paths for the various network circuits, and the times to collect data from the probe and transfer data from a short term database to a long term database as described above. The probe collects network information and increments the appropriate utilization percentage counters for the entire network and various network circuits each sampling interval (e.g., one second), while the console retrieves the information from the probe at designated times and stores the information in the short term database as described above. The operator commands the console to display various network information for a two-hour or two-day history based on the data entered by the operator on window 20 (Fig. 11 ) as descπbed above. The console retrieves the appropriate data from the short and/or long term databases based on the operator input, and displays the information in bar graph and pie chart form as described above. The operator may manipulate a pointer adjacent the bar graph to have the corresponding interval indicated by the pointer displayed in pie chart form. The operator may then command the console to analyze the data and recommend a conservative, moderate or aggressive strategy for modifying the network bandwidth and/or circuit committed information rate. Further, the operator may command the console to generate reports in hardcopy form displaying the network and/or individual circuit bandwidth utilization in bar graph form for a particular day or month, or the network and/or individual circuit bandwidth utilization in tabular form with the conservative, moderate and aggressive bandwidth and/or committed information rate recommendations.

The software for the console and microprocessor of the present invention is implemented in the "C++" programming language. However, it is to be understood that the software may be written in any of a number of computing languages to perform the console and microprocessor functions, and that such software can be developed by one of ordinary skill in the computer arts based on the above description and flow charts.

It will be appreciated that the embodiments described above and illustrated in the drawings represent only a few of the many ways of implementing the present invention to measure peak throughput in packetized data networks.

The console of the present invention may be implemented by any personal computer or processor in combination with a monitor capable of processing and displaying the data in graphical form. Further, the windows or screens of the present invention may be arranged in any manner and contain any desired information. Moreover, the information may be displayed in any graphical or other form capable of conveying the network information. The bar graphs, pie charts and reports may contain any desired information extending for any desired period of time (e.g., hours, days, months etc.). The bar graphs and pie charts may utilize any color or other coding schemes, and display information for any desired percentage ranges. In addition, the sampling and counting intervals may be set to any desired time interval capable of supplying a sufficient sample base while accommodating the limited resources of the probe.

Communications between the console and probe may be accomplished by busses, voice grade modems, the packetized data network being monitored, or any other means suitable for transporting data.

The probes may be implemented by any devices performing similar functions to the probe components described above, or any other data gathering devices capable of retrieving and processing network information. Further, the present invention may employ probes utilizing other protocols for circuit level measurements, such as an Internet, HDLC multi-protocol, or X.25 multi-protocol type probe. The counters may be of any quantity and associated with any desired percentage range, while being implemented by any data structures, variables, hardware (e.g., adders, accumulators etc) or other hardware or software constructs capable of maintaining the counts for various entities.

The thresholds (i.e., percentages of the time interval) for the conservative, moderate and aggressive recommendations may be modified to accommodate various network systems. In addition, the system may be modified such that the recommendations suggest a particular amount of bandwidth adjustment depending upon the particular network activity. For example, the system may recommend an increase or decrease in the bandwidth and/or committed information rate by a certain amount or range of bandwidth.

The increment thresholds may be modified to accommodate different percentage ranges associated with the counters. Further, the increment and recommendation thresholds may be determined in any manner yielding equivalent results to the manner described above. For example, a probe may determine whether or not to increment a counter by determining the bandwidth utilization percentage for a measurement (i.e., number of bytes divided by bandwidth capacity) and comparing that percentage to 10%, 40%, 60%, 90%, respectively, as described above. Similarly, the console may determine whether or not to recommend a bandwidth adjustment by determining the percentage of bandwidth utilization for an interval (i.e., the sum of counts for the percentage counters during an interval divided by the seconds in the interval) and comparing that percentage to the threshold percentage of the time interval (e.g., 10%, 25%, 50%, 75%, 90%) described above. From the foregoing description it will be appreciated that the invention makes available a novel method and apparatus for measurement of peak throughput in packetized data networks wherein a probe collects network information via counters maintaining counts that represent network utilization percentage over a predetermined time interval for manipulation by a console to display the information in graphical form to an operator.

Having described preferred embodiments of a new and improved method and apparatus for measurement of peak throughput in packetized data networks, it is believed that other modifications, variations and changes will be suggested to those skilled in the art in view of the teachings set forth herein, it is therefore to be understood that all such variations, modifications and changes are believed to fall within the scope of the present invention as defined by the appended claims.

^Appen^dix

r- f- Burst Analysis-Link Layer Channel (Daily Report) t/3

Date :

H Printed On U Network : Tuc-Test Site : psi-faker Access Line : ase-221 Current Line speed (Kbps): 56

Horizontal Axis : Day Vertical Axis: To Network

Advisor - Link Layer Channel (Daily Report)

Date: Printed On Network: Tuc-Test Site: psi-faker

ON Access Line: ase-221 Current Line Speed (Kbps): 56

H υ P- Utilization Of Traffic In Direction Towards Network Utilization Of Traffic In Direction From Network

Hour 0-10% 11-40% 41-60% 61-90% 91-100% 0-10% 11-40% 41-60% 61-90% 91-100%

0 52.61% 10.67% 17.67% 11.53% 7.53%) 95.58% 4.42% 0.00% 0.00% 0.00%

1 84.14% 5.44% 5.11% 2.56% 2.75% 98.58% 1.42% 0.00% 0.00% 0.00%

2 77.78% 9.31% 5.61% 2.64% 4.67% 98.06% 1.94% 0.00% 0.00% 0.00%

3 86.17% 5.64% 4.17% 2.83% 1.19% 98.47% 1.53% 0.00% 0.00% 0.00%

4 84.11% 5.56% 5.67% 3.06% 1.61% 97.92% 2.08% 0.00% 0.00% 0.00%

5 83.00% 5.69% 5.58% 4.42% 1.31% 96.97% 3.03% 0.00% 0.00% 0.00%

6 85.36% 5.19% 5.11% 2.25% 2.08% 98.61% 1.36% 0.03% 0.00% 0.00%

7 78.58% 10.64% 5.56% 3.75% 1.47% 95.00% 4.19% 0.61% 0.17% 0.03%)

8 64.44% 12.53% 9.06% 9.31% 4.67% 96.61% 3.28% 0.11% 0.00% 0.00%

9 57.28% 8.53% 9.17% 14.03% 11.00% 89.61% 9.86% 0.42% 0.03% 0.08%

10 38.25% 8.86% 9.42% 19.14% 24.33% 81.06% 18.44%) 0.50% 0.00% 0.00%

11 62.81% 9.67% 7.92% 10.00% 9.61%) 87.92% 11.89% 0.19% 0.00% 0.00%

12 57.83% 10.14% 8.78% 11.58% 11.67% 90.17% 9.53% 0.28% 0.03% 0.00%

13 59.17% 13.03% 8.69% 10.00% 9.11% 89.94% 9.42% 0.61% 0.03%) 0.00% oo 14

< 52.25% 10.69% 7.42% 13.39% 16.25% 86.94% 12.11% 0.67% 0.25% 0.03%

00

15 38.67% 9.11% 9.89% 10.92% 31.42% 74.08% 21.03% 2.89% 1.69% 0.31%

O

16 56.81% 12.33% 9.56% 11.97% 9.33% 77.53% 15.83% 4.53% 1.78% 0.33%

17 49.36% 11.17% 12.28% 15.00% 12.19% 87.33% 12.08% 0.56%) 0.03% 0.00%

Page I of 2

r- Utilization Of Traffic In Direction Towards Network Utilization Of Traffic In Direction From Network •

Hour 0-10% 11-40% 41-60% 61-90% 91-100% 0-10% 11-40% 41-60% 61-90% 91-100% t-

18 50.47% 6.83% 8.36% 10.92% 23.42% 95.61% 4.36% 0.03% 0.00% 0.00% υ PH 19 60.39% 8.11% 12.22% 8.53% 10.75% 96.86% 3.14% 0.00% 0.00%) 0.00% 20 71.81% 8.61% 9.94%) 5.47% 4.17% 98.50% 1.47% 0.03% 0.00% 0.00% 21 55.92% 11.67% 15.06% 11.47% 5.89% 95.36% 4.61% 0.03% 0.00% 0.00% 22 68.06% 8.17% 8.03% 6.86% 8.89% 95.69% 4.14% 0.06% 0.08% 0.03% 23 67.00% 4.56% 10.06% 7.69% 10.69% 94.64% 5.33% 0.03% 0.00% 0.00%

Summary 64.26% 8.84% 8.76% 8.72% 9.42% 92.38% 6.94% 0.48% 0.17% 0.03%

Conservative: Increase Speed o

LO Moderate: Increase Speed Aggressive: No change recommended

3.23 % of the samples were available for this month.

00 oo

O

[ psi-aker (DLCI 485) via ase-221 c- I visual internet (DLCI 485) via ase-209 |

Hour 0 - 20 % 21-80% 81-120% 121 -180 %> 180% 0 - 20 % 21-80% 81-120% 121 -180%>18O%_> r-- Summary 63.05% 11.13% 1.50% 2.21% 22.11% 66.30% 14.61% 6.23% 4.19% 8.67%

5 Conservative: Increase CIR

H ϋ Moderate: Increase CIR

Aggressive: Increase CIR

3.23 % of the samples for psi-faker and 3.23 % of the samples for visual internet were available during this month.

Claims

WHAT IS CLAIMED IS:

1. An apparatus for measuring peak throughput of a data network as a percentage of network data transfer capacity comprising: a probe connected to the network to measure the throughput of the network and generate information relating to the percentage utilization of the network data transfer capacity during successive predetermined sampling intervals, said probe including: a plurality of counters for maintaining said information relating to the percentage utilization of the network data transfer capacity, wherein each of said counters is associated with a different range of utilization percentages; and incrementing means responsive to network throughput measurements in each sample interval for incrementing one of said plurality of counter means corresponding to the utilization percentage range encompassing the utilization percentage represented by the network throughput measured during that sampling interval; and console means coupled to said probe means for receiving said percentage utilization information in the form of counts from said plurality of counters and processing said information to display network data transfer capacity utilization over a predetermined time interval.

2. The apparatus of claim 1 wherein said probe includes means for measuring said throughput as data traveling in each direction to and from the network, and means for generating said information relating to the percentage utilization of the network data transfer capacity for each said direction as a function of a fixed network bandwidth.

3. The apparatus of claim 2 wherein said plurality of counters includes five counters for each said direction with each of said five counters corresponding to different utilization sub-percentage ranges within an overall range between zero and one-hundred percent.

4. The apparatus of claim 1 wherein said probe includes means for measuring said throughput for individual network circuits, and means for generating information relating to the percentage utilization of the circuit data transfer capacity for each individual circuit as a function of a circuit committed information rate for the individual circuit.

5. The apparatus of claim 4 wherein said plurality of counters includes five counters for each circuit with each of said five counters corresponding to different utilization percentage sub-ranges within an overall range between zero and two- hundred percent.

6. The apparatus of claim 1 further comprising: advisor means for analyzing said utilization percentage information and automatically recommending a plurality of network data transfer capacity adjustments.

7. The apparatus of claim 6 wherein said advisor means includes conservative recommendation means for recommending a conservative network data transfer capacity adjustment wherein an increase in capacity is recommended when said plurality of counter means indicate the occurrence of high utilization of data transfer capacity in excess of ten percent of a user-specified time interval, and a decrease in capacity is recommended when said plurality of counter means indicate the occurrence of low utilization of data transfer capacity in excess of ninety percent of the user-specified interval.

8. The apparatus of claim 6 wherein said advisor means includes moderate recommendation means for recommending a moderate network data transfer capacity adjustment wherein an increase in capacity is recommended when said plurality of counter means indicate the occurrence of high utilization of data transfer capacity in excess of twenty-five percent of a user-specified time interval, and a decrease in capacity is recommended when said plurality of counter means indicate the occurrence of low utilization of data transfer capacity in excess of seventy-five percent of the user-specified interval.

9. The apparatus of claim 6 wherein said advisor means includes aggressive recommendation means for recommending a conservative network data transfer capacity adjustment wherein an increase in capacity is recommended when said plurality of counter means indicate the occurrence of high utilization of data transfer capacity in excess of fifty percent of a user-specified time interval, and a decrease in capacity is recommended when said plurality of counter means indicate the occurrence of low utilization of data transfer capacity in excess of fifty percent of the user-specified interval.

10. The apparatus of claim 1 wherein said console means includes display means for displaying the network data transfer capacity utilization in graphical form.

11. The apparatus of claim 10 wherein said display means includes means for displaying the network data transfer capacity utilization in the form of a bar graph for a user-specified time interval.

12. The apparatus of claim 11 wherein said display means further includes means for displaying the network data transfer capacity utilization in the form of a pie chart for a user-specified interval selected from said bar graph.

13. The apparatus of claim 6 further comprising report means for generating reports containing network data transfer capacity utilization information and said plurality of network data transfer capacity adjustments for a user-specified time interval.

14. The apparatus of claim 4 further including a plurality of said probe means coupled to said network wherein a probe means is disposed at each end of an individual network circuit to enable measurement of circuit data transfer capacity utilization for data traveling from each of the probes disposed at each end of the circuit.

15. A method for measuring peak throughput of a data network as a percentageof network data transfer capacity comprising the steps of: (a) measuring network throughput and generating information relating to the percentage utilization of the network data transfer capacity during a predetermined sampling interval by assigning each of a plurality of counters a different range of utilization percentages and incrementing one of said plurality of counters corresponding to the utilization percentage range encompassing the utilization percentage represented by the network throughput measured during the sampling interval; and

(b) processing said percentage utilization information in the form of counts from said counters to display network data transfer capacity utilization over a predetermined time interval.

16. The method of claim 15 wherein step (a) further includes:

(a.1) measuring throughput for data traveling in each direction to and from the network; and

(a.2) generating said information relating to the percentage utilization of the network data transfer capacity for each said direction as a function of a fixed network bandwidth.

17. The method of claim 16 wherein said plurality of counters includes five counters for each said direction, and step (a.2) includes:

(a.2.1 ) assigning each of said five counters a different utilization percentage range within an overall range between zero and one-hundred percent.

18. The method of claim 15 wherein step (a) further includes: (a.1 ) measuring throughput for individual network circuits; and

(a.2) generating said information relating to the percentage utilization of the circuit data transfer capacity for each circuit as a function of the circuit committed information rate.

19. The method of claim 18 wherein said plurality of counters includes five counters for each circuit, and step (a.2) includes:

(a.2.1) assigning each of said five counters a different utilization percentage range within an overall range between zero and two-hundred percent.

20. The method of claim 15 further comprising the step of:

(c) analyzing said utilization percentage information and recommending a plurality of network data transfer capacity adjustments.

21. The method of claim 20 wherein step (c) further includes: (c.1) recommending a conservative network data transfer capacity adjustment wherein an increase in capacity is recommended when said plurality of counters indicate the occurrence of high utilization of data transfer capacity in excess of ten percent of a user-specified time interval, and a decrease in capacity is recommended when said plurality of counters indicate the occurrence of low utilization of data transfer capacity in excess of ninety percent of the user-specified interval.

22. The method of claim 20 wherein step (c) further includes:

(c.1) recommending a moderate network data transfer capacity adjustment wherein an increase in capacity is recommended when said plurality of counters indicate the occurrence of high utilization of data transfer capacity in excess of twenty-five percent of a user-specified time interval, and a decrease in capacity is recommended when said plurality of counters indicate the occurrence of low utilization of data transfer capacity in excess of seventy-five percent of the user- specified interval.

23. The method of claim 20 wherein step (c) further includes: (c.1) recommending an aggressive network data transfer capacity adjustment wherein an increase in capacity is recommended when said plurality of counters indicate the occurrence of high utilization of data transfer capacity in excess of fifty percent of a user-specified time interval, and a decrease in capacity is recommended when said plurality of counters indicate the occurrence of low utilization of data transfer capacity in excess of fifty percent of the user-specified interval.

24. The method of claim 15 wherein step (b) includes:

(b.1) displaying the network data transfer capacity utilization in graphical form.

25. The method of claim 24 wherein step (b.1 ) further includes:

(b.1.1 ) displaying the network data transfer capacity utilization in the form of a bar graph for a user-specified interval.

26. The method of claim 24 wherein step (b.1) further includes: (b.1.2) displaying the network data transfer capacity utilization in the form of a pie chart for a user-specified interval selected from said bar graph.

27. The method of claim 20 further comprising the step of:

(d) selectively generating reports containing network data transfer capacity information and said plurality of network data transfer capacity adjustments for a user-specified time interval.

28. The method of claim 18 wherein step (a.1 ) includes:

(a.1.1) measuring circuit data transfer capacity for data traveling in each direction on a circuit.

29. A method for measuring peak throughput of a data network as a percentage of network data transfer capacity compπsing the steps of:

(a) measuring utilization percentage of network data transfer capacity as a function of an amount of time within a time period that the percentage of data transfer capacity utilization resides in different utilization percentage ranges; and

(b) displaying the network data transfer capacity utilization for a user- specified time interval in relation to the amount of time the network data transfer capacity utilization percentage resided in said utilization percentage ranges.