Apparatus and methods are disclosed for processing messages from agents of a network environment including the use of collectors. Collectors can use configurable pipelines to improve processing of messages received from the agents. In one example of the disclosed technology, a number of networked agents are configured to gather data describing operational aspects of an agent's computing host. A collector is configured to receive reports from the agent and send the gathered data to one or more destination agent data consumers designated by augmentation information in the reports. In some examples, the collector transforms data using one or more stage selector rules.

A visibility platform can be used to monitor traffic traversing private cloud infrastructures and/or public cloud infrastructures. In some instances, the traffic is provided to a set of network services that are accessible to the visibility platform. These network services can be provisioned in a serial or parallel fashion. Network service chaining can be used to ensure that traffic streams skip unnecessary network services and receive only those network services that are needed. For example, an email service chain can include virus, spam, and phishing detection, while a video streaming service chain can include traffic shaping policies to satisfy quality of service (QoS) guarantees. When the visibility platform is represented as a graph that makes use of action sets, network service chains can be readily created or destroyed on demand.

A visibility platform can be used to monitor traffic traversing private cloud infrastructures and/or public cloud infrastructures. In some instances, the traffic is provided to a set of network services that are accessible to the visibility platform. These network services can be provisioned in a serial or parallel fashion. Network service chaining can be used to ensure that traffic streams skip unnecessary network services and receive only those network services that are needed. For example, an email service chain can include virus, spam, and phishing detection, while a video streaming service chain can include traffic shaping policies to satisfy quality of service (QoS) guarantees. When the visibility platform is represented as a graph that makes use of action sets, network service chains can be readily created or destroyed on demand.

Examples relate to identifying heartbeat messages. In one example, a computing device may: obtain a plurality of messages that includes incoming messages and outgoing messages, each incoming message being sent from a server device to a client device, and each outgoing message being sent from the client device to the server device; identify candidate message pairs, each candidate message pair including one incoming message and one outgoing message; and identify a heartbeat message pair from the candidate message pairs based on at least one of: plurality of timestamps that includes i) incoming message timestamps that each correspond to one of the incoming messages, and ii) outgoing message timestamps that each correspond to one of the outgoing messages; a number of occurrences of each candidate message pair included a message log; or characteristics of data included in the incoming message and outgoing message of each candidate message pair.

An apparatus is provided for measuring the performance of a mobile communication system. The apparatus includes two measurement mobile interfaces and a measurement probe. The probe is connected to the backhauling interface of a base station of the system. Then, one measurement mobile interface transmits packets to the other measurement mobile interface via the base station. These packets are received at the base station, forwarded to the packet gateway of the system, sent back to the same base station, and finally received at the destination measurement mobile interface. Since the measurement probe belongs to the same apparatus as the mobile interfaces, it may detect the packets as transmitted/received at the backhauling interface. The probe then generates performance parameters relating to the packets as transmitted/received by the mobile interfaces and/or as detected at the backhauling interface. The system performance is then measured based on such parameters.

In one embodiment, a time period is identified in which probe packets are to be sent along a path in a network based on predicted user traffic along the path. The probe packets are then sent during the identified time period along the path. Conditions of the network path are monitored during the time period. The rate at which the packets are sent during the time period is dynamically adjusted based on the monitored conditions. Results of the monitored conditions are collected, to determine an available bandwidth limit along the path.

According to an embodiment a packet forwarding device is disclosed for forwarding data packets on a link within a communication network. The packet forwarding device is further configured to perform the following steps: measuring a load of the link; detecting if the load exceeds one of a plurality of threshold indicative for a level of congestion on the link; and sending a signal to another device in the communication network signalling the level of congestion.

Systems, methods, and computer-readable media provide for collection of statistics relating to network traffic between virtual machines (VMs) in a network. In an example embodiment, a virtual switch hosted on a physical server provides network address information of VMs deployed on the physical server to a virtual switch controller. The controller collects this network address information from each virtual switch under its control, and distributes the aggregate address information to each switch. In this manner, the controller and each switch within the controller's domain can learn the network address information of each VM deployed on physical servers hosting switches under the controller's control. Each virtual switch can determine a classification of a frame passing through the switch (e.g., intra-server, inter-server and intra-domain, or inter-domain traffic), and statistics relating to the traffic. In an example embodiment, the virtual switch controller can collect the statistics from each switch within its domain.

A method for profiling network traffic. The method includes capturing, from the network traffic using a packet capturing device, a plurality of packets, identifying a first portion of the plurality of packets as a first flow based at least on a common Internet Protocol (IP) address assigned to each packet of the first flow by a network address translation (NAT) device, extracting, by a hardware processor separate from the NAT device and based on an NAT profile of the NAT device, a first data item from the first flow, wherein the first data item is inserted into the first flow by the NAT device for identifying a first host device coupled to the NAT device, and determining, by the hardware processor based on the first data item, that the first flow is generated by the first host device.

It is disclosed a performance measurement application for a user communication device. The device runs at least one user application which exchanges at least one packet flow with a packet-switched communication network. When executed, the performance measurement application receives from an owner of the user communication device a request for performing a performance measurement. In response to such request, the performance measurement application activates a marking functionality comprising marking upstream packets of the packet flow to be measured and inducing the network node originating the downstream packets of the packet flow to be measured to mark them. The performance measurement application then provides performance parameter(s) relating to the marked upstream packets as transmitted and/or the marked downstream packets as received and, based on such parameter(s), provides a performance measurement. The measurement results are then shared with a measurement management server.