# US 10,374,912 B2 · Detecting and measuring microbursts in a networking device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,912 B2 - Document ID: US10374912B2 - Status: Granted - Kind: B2 - Application number: 15/222,839 - Filed: 2016-07-28 - Published: 2018-02-01 - Granted: 2019-08-06 - Earliest claimed: 2016-07-28 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Krishnan Subramani; Vinod Mitulal; Kinjal Shah; Georges Akis - Web page: https://patentgrep.com/patent/US10374912B2 ## CPC - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/067: using time frame reporting - H04L 43/0817: by checking functioning - H04L 43/16: Threshold monitoring - H04L 47/30: in combination with information about buffer occupancy at either end or at transit nodes - H04L 41/5096: {wherein the managed service relates to distributed or central networked applications} - H04L 47/62: characterised by scheduling criteria - H04L 49/90: Buffering arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and computer-readable storage media for monitoring queue occupancy in a network buffer, detecting microbursts, and analyzing the same. An ASIC device can monitor a queue occupancy value of a network buffer, detect when the queue occupancy value exceeds a first predetermined threshold queue occupancy, create a record with a time that the queue occupancy value exceeds the first predetermined threshold queue occupancy, a queue occupancy value at the time that the queue occupancy value exceeds the first predetermined threshold queue occupancy, detect when the queue occupancy value falls below a second predetermined threshold queue occupancy, and determine a maximum queue occupancy value between the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy and a time that the queue occupancy value falls below the second predetermined threshold queue occupancy, and add to the record the maximum queue occupancy value, a time of the maximum queue occupancy value, the time that the queue that the queue occupancy value falls below the second predetermined threshold queue occupancy and the queue occupancy value at the time that the queue occupancy value falls below the second predetermined threshold queue occupancy. ## Claims ### Claim 1 A computer-implemented method for detecting a microburst, comprising: monitoring a queue occupancy value of a network buffer; setting a first and second predetermined threshold queue occupancy, wherein the second predetermined threshold queue occupancy cannot be set within one maximum transmission unit of a network from the first predetermined threshold queue occupancy; detecting when the queue occupancy value exceeds the first predetermined threshold queue occupancy value; creating a record with a time that the queue occupancy value exceeds the first predetermined threshold queue occupancy; detecting when the queue occupancy value falls below the second predetermined threshold queue occupancy, the second predetermined threshold queue occupancy being less than the first predetermined threshold queue occupancy; determining a maximum queue occupancy value between the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy and a time that the queue occupancy value falls below the second predetermined threshold queue occupancy; adding to the record the maximum queue occupancy value, a time of the maximum queue occupancy value, and the time that the queue that the queue occupancy value falls below the second predetermined threshold queue occupancy; and diagnosing location, duration, and source of the microburst based on the record. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: adding to the record the queue occupancy value at the time that the queue occupancy value exceeds the first predetermined threshold queue occupancy and the queue occupancy value at the time that the queue that the queue occupancy value falls below the second predetermined threshold queue occupancy. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, from a network device, an instruction effective to define one or more of the first predetermined threshold queue occupancy and the second predetermined threshold queue occupancy. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: transmitting the record to an analytics device. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the second predetermined threshold queue occupancy is less than the first predetermined threshold queue occupancy value by a maximum transmission unit of a network. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: detecting, before detecting when the queue occupancy value falls below the second predetermined threshold queue occupancy, the expiration of a timer; determining a local maximum queue occupancy value between earlier of the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy and the time a timer was re-started and a time when the timer expired; and creating a periodic record with the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy, the maximum queue occupancy value, a time of the maximum queue occupancy value, and the time that the timer expired. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, further comprising: adding to the record the queue occupancy value at the earlier of time that the queue occupancy value exceeds the first predetermined threshold queue occupancy and the time a timer was re-started; adding to the record the queue occupancy value at the time that the timer expired. ### Claim 8 (depends on 6) The computer-implemented method of claim 6, further comprising: transmitting the record and the period record to an analytics device. ### Claim 9 (depends on 6) The computer-implemented method of claim 6, further comprising: restarting the timer with a same duration upon the expiration of the timer; and creating an additional periodic record with a time that timer was restarted. ### Claim 10 (depends on 6) The computer-implemented method of claim 6, further comprising: receiving, from a network device, an instruction effective to define a duration of the timer. ### Claim 11 A microburst analyzer comprising: a processor; and a computer-readable storage medium having stored therein instructions which, when executed by the processor, cause the processor to perform operations comprising: monitoring a queue occupancy value of a network buffer; setting a first and second predetermined threshold queue occupancy, wherein the second predetermined threshold queue occupancy cannot be set within one maximum transmission unit of a network from the first predetermined threshold queue occupancy; detecting when the queue occupancy value exceeds the first predetermined threshold queue occupancy; creating a record with a time that the queue occupancy value exceeds the first predetermined threshold queue occupancy; detecting when the queue occupancy value falls below the second predetermined threshold queue occupancy, the second predetermined threshold queue occupancy being less than the first predetermined threshold queue occupancy; determining a maximum queue occupancy value between the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy and a time that the queue occupancy value falls below the second predetermined threshold queue occupancy; adding to the record the maximum queue occupancy value, a time of the maximum queue occupancy value, and the time that the queue that the queue occupancy value falls below the second predetermined threshold queue occupancy; and diagnosing location, duration, and source of the microburst based on the record. ### Claim 12 (depends on 11) The microburst analyzer of claim 11, wherein the instructions further cause the processor to perform operations comprising: adding to the record the queue occupancy value at the time that the queue occupancy value exceeds the first predetermined threshold queue occupancy and the queue occupancy value at the time that the queue that the queue occupancy value falls below the second predetermined threshold queue occupancy. ### Claim 13 (depends on 11) The microburst analyzer of claim 11, wherein the instructions further cause the processor to perform operations comprising: detecting, before detecting when the queue occupancy value falls below the second predetermined threshold queue occupancy, the expiration of a timer; determining a local maximum queue occupancy value between earlier of the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy and the time a timer was re-started and a time when the timer expired; and creating a periodic record with the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy, the maximum queue occupancy value, a time of the maximum queue occupancy value, and the time that the timer expired. ### Claim 14 (depends on 13) The microburst analyzer of claim 13, wherein the instructions further cause the processor to perform operations comprising: adding to the record the queue occupancy value at the earlier of time that the queue occupancy value exceeds the first predetermined threshold queue occupancy and the time a timer was re-started; adding to the record the queue occupancy value at the time that the timer expired. ### Claim 15 (depends on 13) The microburst analyzer of claim 13, wherein the instructions further cause the processor to perform operations comprising: restarting the timer with a same duration upon the expiration of the timer; and creating an additional periodic record with a time that timer was restarted. ### Claim 16 A non-transitory computer-readable storage medium having stored therein instructions for detecting a microburst which, when executed by a processor, cause the processor to perform operations comprising: monitoring a queue occupancy value of a network buffer; setting a first and second predetermined threshold queue occupancy, wherein the second predetermined threshold queue occupancy cannot be set within one maximum transmission unit of a network from the first predetermined threshold queue occupancy; detecting when the queue occupancy value exceeds the first predetermined threshold queue occupancy; creating a record with a time that the queue occupancy value exceeds the first predetermined threshold queue occupancy; detecting when the queue occupancy value falls below the second predetermined threshold queue occupancy, the second predetermined threshold queue occupancy being less than the first predetermined threshold queue occupancy; determining a maximum queue occupancy value between the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy and a time that the queue occupancy value falls below the second predetermined threshold queue occupancy; adding to the record the maximum queue occupancy value, a time of the maximum queue occupancy value, and the time that the queue that the queue occupancy value falls below the second predetermined threshold queue occupancy; and diagnosing location, duration, and source of the microburst based on the record. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the instructions further cause the processor to perform operations comprising: adding to the record the queue occupancy value at the time that the queue occupancy value exceeds the first predetermined threshold queue occupancy and the queue occupancy value at the time that the queue that the queue occupancy value falls below the second predetermined threshold queue occupancy. ### Claim 18 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the instructions further cause the processor to perform operations comprising: detecting, before detecting when the queue occupancy value falls below the second predetermined threshold queue occupancy, the expiration of a timer; determining a local maximum queue occupancy value between earlier of the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy and the time a timer was re-started and a time when the timer expired; creating a periodic record with the time that the queue occupancy value exceeded the first predetermined threshold queue occupancy, the maximum queue occupancy value, a time of the maximum queue occupancy value, and the time that the timer expired; adding to the record the queue occupancy value at the earlier of time that the queue occupancy value exceeds the first predetermined threshold queue occupancy and the time a timer was re-started; adding to the record the queue occupancy value at the time that the timer expired; and restarting the timer.