# US 11,445,423 B2 · Network environment health monitoring

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,445,423 B2
- Document ID: US11445423B2
- Status: Granted
- Kind: B2
- Application number: 16/888,314
- Filed: 2020-05-29
- Published: 2021-12-02
- Granted: 2022-09-13
- Earliest claimed: 2020-05-29
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Vishal S. Desai; Benjamin J. Cizdziel; Santosh B. Kulkarni; Young Il Choi
- Web page: https://patentgrep.com/patent/US11445423B2

## CPC

- H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- H04W 36/0085: {Hand-off measurements}
- H04L 41/0661: {by reconfiguring faulty entities}
- H04L 41/5022: by giving priorities, e.g. assigning classes of service
- H04L 43/065: related to network devices
- H04L 43/0811: by checking connectivity
- H04L 43/0876: Network utilisation, e.g. volume of load or congestion level
- H04W 24/04: Arrangements for maintaining operational condition
- H04W 36/0061: {of neighbour cell information}
- H04W 36/302: {due to low signal strength}
- H04W 84/12: WLAN [Wireless Local Area Networks]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Network environment health monitoring is provided by receiving an alert indicating that a first station (STA) is experiencing a connection with a first Access Point (AP) below a quality threshold; identifying a set of APs connected to a shared network with the first AP within one hop of the first AP; aggregating signal metrics for the first STA from the first AP and each AP of the set of APs; identifying a cause for the connection performing below the quality threshold based on the signal metrics as aggregated; and performing a remediation strategy based on the cause as identified.

## Claims

### Claim 1

A method, comprising:
receiving, at a network controller, an alert indicating that a first station (STA) is experiencing a connection with a first Access Point (AP) below a quality threshold;
identifying a set of APs connected to a shared network with the first AP within one hop of the first AP;
aggregating signal metrics for the first STA from the first AP and each AP of the set of APs;
identifying a cause for the connection performing below the quality threshold based on the signal metrics as aggregated; and
performing a remediation strategy based on the cause as identified.

### Claim 2 (depends on 1)

The method of claim 1, wherein identifying the set of APs further comprises:
receiving a list of APs from the first STA that the first STA can hear; and
removing APs from the set of APs that are absent from the list of APs.

### Claim 3 (depends on 1)

The method of claim 1, wherein identifying the set of APs further comprises:
removing APs from the set of APs that cannot hear a beacon from the first AP; and
removing APs from the set of APs that cannot decode a MAC header in messages sent from the first STA to the first AP.

### Claim 4 (depends on 1)

The method of claim 1, wherein identifying the set of APs further comprises:
adding and removing APs to the set of APs over a period of time based on a predicted path of the first STA in a physical environment and physical locations of the APs in the physical environment.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
receiving a second alert from a second STA indicating that the second STA is experiencing a second connection with the first AP below the quality threshold; and
in response to determining that the first AP is experiencing one of network congestion or interference local to the first AP, the remediation strategy includes, before identifying the set of APs, signaling the second STA to handoff to a second AP.

### Claim 6 (depends on 1)

The method of claim 1, in response to determining that the cause is due to a rogue AP that is not part of the shared network, the remediation strategy includes:
sending a de-authentication packet to a rogue STA connected to the rogue AP.

### Claim 7 (depends on 1)

The method of claim 1, wherein the connection carries encrypted communications between the first STA and the first AP, further comprising:
sharing decryption keys from the first AP to the set of APs; and
wherein the signal metrics are based on decrypted communications between the first STA and the first AP as received at individual APs of the set of APs.

### Claim 8 (depends on 1)

The method of claim 1, wherein a given AP of the set of APs is serving a second STA:
adding a MAC addresses of the first STA and the first AP to a rogue monitoring list on the given AP;
receiving communications transmitted between the first STA and the first AP at the given AP that include data frames; and
in response to the MAC addresses in the communications matching the MAC addresses of the first STA and the first AP, analyzing the data frames to ascertain networking conditions for the connection between the first STA and the first AP.

### Claim 9 (depends on 8)

The method of claim 8, wherein a given channel used by the given AP to serve the second STA is not a first channel used by the first AP to serve the first STA, the method further comprises:
performing off-channel scans to receive the communications sent over the first channel used by the first AP to serve the first STA.

### Claim 10

A non-transitory computer readable storage device including instructions that when performed by a processor enable performance of an operation comprising:
receiving, at a network controller, an alert indicating that a first station (STA) is experiencing a connection with a first Access Point (AP) below a quality threshold;
identifying a set of APs connected to a shared network with the first AP within one hop of the first AP;
aggregating signal metrics for the first STA from the first AP and each AP of the set of APs;
identifying a cause for the connection performing below the quality threshold based on the signal metrics as aggregated; and
performing a remediation strategy based on the cause as identified.

### Claim 11 (depends on 10)

The computer readable storage device of claim 10, wherein identifying the set of APs further comprises:
receiving a list of APs from the first STA that the first STA can hear; and
removing APs from the set of APs that are absent from the list of APs.

### Claim 12 (depends on 10)

The computer readable storage device of claim 10, wherein identifying the set of APs further comprises:
removing APs from the set of APs that cannot hear a beacon from the first AP; and
removing APs from the set of APs that cannot decode a MAC header in messages sent from the first STA to the first AP.

### Claim 13 (depends on 10)

The computer readable storage device of claim 10, wherein identifying the set of APs further comprises:
adding and removing APs to the set of APs over a period of time based on a predicted path of the first STA in a physical environment and physical locations of the APs in the physical environment.

### Claim 14 (depends on 10)

The computer readable storage device of claim 10, wherein the operation further comprises:
receiving a second alert from a second STA indicating that the second STA is experiencing a second connection with the first AP below the quality threshold; and
in response to determining that the first AP is experiencing one of network congestion or interference local to the first AP and before identifying the set of APs, signaling the second STA to handoff to a second AP.

### Claim 15 (depends on 10)

The computer readable storage device of claim 10, wherein the remediation strategy includes, in response to determining that the cause is due to a rogue AP that is not part of the shared network, sending a de-authentication packet to a rogue STA connected to the rogue AP.

### Claim 16 (depends on 10)

The computer readable storage device of claim 10, wherein the connection carries encrypted communications between the first STA and the first AP, the operation further comprises:
sharing decryption keys from the first AP to the set of APs; and
wherein the signal metrics are based on decrypted communications between the first STA and the first AP as received at individual APs of the set of APs.

### Claim 17 (depends on 10)

The computer readable storage device of claim 10, wherein a given AP of the set of APs is serving a second STA, the operation further comprises:
adding a MAC addresses of the first STA and the first AP to a rogue monitoring list on the given AP;
receiving communications transmitted between the first STA and the first AP at the given AP that include data frames; and
in response to the MAC addresses in the communications matching the MAC addresses of the first STA and the first AP, analyzing the data frames to ascertain networking conditions for the connection between the first STA and the first AP.

### Claim 18 (depends on 17)

The computer readable storage device of claim 17, wherein a given channel used by the given AP to serve the second STA is not a first channel used by the first AP to serve the first STA, wherein the operation further comprises:
performing off-channel scans to receive the communications sent over the first channel used by the first AP to serve the first STA.

### Claim 19

A device, comprising:
a processor; and
a memory storage device, including instructions that when executed by the processor enable the device to:
receive, at a network controller, an alert indicating that a first station (STA) is experiencing a connection with a first Access Point (AP) below a quality threshold;
identify a set of APs connected to a shared network with the first AP within one hop of the first AP that can hear a beacon transmitted from the first AP;
receive a list of APs from the first STA that the first STA can hear;
select a subset of APs from the set of APs by removing APs appearing on the list of APs from the set of APs;
aggregate signal metrics for the first STA from the first AP and each AP of the subset of APs;
identify a cause for the connection performing below the quality threshold based on the signal metrics as aggregated; and
transmit a remediation strategy to the first STA based on the cause as identified.

### Claim 20 (depends on 19)

The device of claim 19, wherein the instructions further enable the device to:
receive a MAC addresses of a second STA connected to a second AP;
add the second STA and the second AP to a rogue monitoring list;
receive communications transmitted between the second STA and the second AP that include data frames; and
in response to the MAC addresses in the communications matching the MAC addresses of the second STA and the second AP, analyze the data frames to ascertain networking conditions for the connection between the second STA and the second AP.