# US 2004/0073655 A1 · Packet sequence number network monitoring system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2004/0073655 A1 - Document ID: US20040073655A1 - Status: Published application - Kind: A1 - Application number: 10/267,813 - Filed: 2002-10-09 - Published: 2004-04-15 - Earliest claimed: 2002-10-09 - Assignees: Alcatel Lucent - Inventors: Chao Kan; Pierrick Guingo; Emanuele Jones; Hubert Ogier; Thierry Labbe - Web page: https://patentgrep.com/patent/US20040073655A1 ## CPC - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] - H04L 43/00: Arrangements for monitoring or testing data switching networks - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 43/026: using flow identification - H04L 43/028: by filtering - H04L 43/0817: by checking functioning - H04L 43/0829: Packet loss - H04L 43/0858: {One way delays} - H04L 43/087: Jitter - H04L 43/0888: Throughput - H04L 43/12: Network monitoring probes - H04L 43/16: Threshold monitoring - H04L 43/18: Protocol analysers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network monitoring system (60). The system comprises storage circuitry (32) for storing network packet information, wherein the network packet information includes a predicted identifier. The network monitoring system also comprises at least one monitoring circuit (36) coupled to a network (70) along which network traffic flows in a form of packets. The at least one monitoring circuit programmed to perform the steps (44) of receiving a packet communicated along the network and determining whether the received packet is communicated between a source and destination in a first set of network nodes. Each packet in a sequence of communications between the source and the destination comprises a packet identifier that uniquely identifies the packet from all other communications in a flow between the source and the destination. The at least one monitoring circuit programmed to perform the step of, responsive to determining the received packet is communicated between a source and destination in the first set of network nodes, comparing the packet identifier of the received packet to the predicted identifier to determine an identifier deviation between the packet identifier and the predicted identifier for identifying an irregularity in the network traffic. ## Claims ### Claim 1 A network monitoring system, comprising: storage circuitry for storing network packet information, wherein the network packet information includes a predicted identifier; and at least one monitoring circuit coupled to a network along which network traffic flows in a form of packets, the at least one monitoring circuit programmed to perform the steps of: receiving a packet communicated along the network; determining whether the received packet is communicated between a source and destination in a first set of network nodes, wherein each packet in a sequence of communications between the source and the destination comprises a packet identifier that uniquely identifies the packet from all other communications in a flow between the source and the destination; and responsive to determining the received packet is communicated between a source and destination in the first set of network nodes, comparing the packet identifier of the received packet to the predicted identifier to determine an identifier deviation between the packet identifier and the predicted identifier for identifying an irregularity in the network traffic. ### Claim 2 (depends on 1) The system of claim 1 wherein the at least one monitoring circuit is programmed to further perform the steps of: comparing the identifier deviation to a threshold; and responsive to the identifier deviation exceeding a threshold, indicating an alarm. ### Claim 3 (depends on 1) The system of claim 1 wherein the at least one monitoring circuit is programmed to further perform the steps of: comparing the identifier deviation to a threshold; and responsive to the identifier deviation exceeding a threshold, adjusting packet communications between the source and the destination. ### Claim 4 (depends on 3) The system of claim 3: wherein the at least one monitoring circuit monitors packets between core routers; and wherein the adjusting step adjusts packet communications at an edge router. ### Claim 5 (depends on 1) The system of claim 1 wherein the packet identifier comprises a sequence number. ### Claim 6 (depends on 1) The system of claim 1: wherein the packet comprises a TCP packet; and wherein the packet identifier comprises a TCP sequence number. ### Claim 7 (depends on 1) The system of claim 1 wherein the at least one monitoring circuit is programmed to further perform, prior to the comparing step, the steps of: receiving a plurality of packets communicated along the network; for each packet in the plurality of packets: determining whether the received packet is communicated between a source and destination in the first set of network nodes; and responsive to determining the received packet is communicated between a source and destination in the first set of network nodes, storing in the storage circuitry the packet identifier of the received packet. ### Claim 8 (depends on 7) The system of claim 7 wherein the at least one monitoring circuit is programmed to further perform the step of determining the predicted identifier in response to a plurality of packet identifiers stored by the storing step corresponding to a plurality of packets in the first set. ### Claim 9 (depends on 8) The system of claim 8 wherein the at least one monitoring circuit is programmed to further perform the step of determining the predicted identifier as a most common one of the plurality of packet identifiers. ### Claim 10 (depends on 1) The system of claim 1 wherein the at least one monitoring circuit is programmed to further perform the step of, responsive to determining the received packet is communicated between a source and destination in the first set of network nodes, comparing a time of arrival of the received packet to a predicted time of arrival to determine a time deviation between the time of arrival and the predicted time of arrival. ### Claim 11 (depends on 10) The system of claim 10 wherein the at least one monitoring circuit is programmed to further perform the steps of: comparing the time deviation to a threshold; and responsive to the time deviation exceeding a threshold, indicating an alarm. ### Claim 12 (depends on 10) The system of claim 10 wherein the at least one monitoring circuit is programmed to further perform the steps of: comparing the time deviation to a threshold; and responsive to the time deviation exceeding a threshold, adjusting packet communications between the source and the destination. ### Claim 13 (depends on 10) The system of claim 10 wherein the at least one monitoring circuit is programmed to further perform, prior to the step of comparing a time of arrival, the step of determining the predicted time of arrival in response to a difference in time between two successively-received packets between the source and the destination in the first set of network nodes. ### Claim 14 (depends on 1) The system of claim 1 wherein the first set consists of a single source and a single destination node. ### Claim 15 (depends on 1) The system of claim 1 wherein the first set comprises a plurality of source nodes in a first physical sub-network and a plurality of destination nodes in a second physical sub-network that differs from the first physical sub-network. ### Claim 16 (depends on 1) The system of claim 1 wherein the at least one monitoring circuit is programmed to further perform the steps of, responsive to determining that the identifier deviation exceeds a threshold: receiving an additional packet communicated along the network; determining whether the additional packet is communicated between the source and the destination in the first set of network nodes; and responsive to determining the additional packet is communicated between a source and destination in the first set of network nodes, comparing the packet identifier of the additional packet to a predicted identifier to determine an identifier deviation between the packet identifier of the additional packet and a predicted identifier. ### Claim 17 (depends on 16) The system of claim 16 wherein the at least one monitoring circuit is programmed to further perform, responsive to determining that the identifier deviation between the packet identifier of the additional packet to a predicted identifier exceeds a threshold, the steps of: receiving a plurality of packets communicated along the network; and determining whether each packet in the plurality of packets is communicated between a source and destination in a second set of network nodes, wherein the second set of network nodes comprises the first set of network nodes. ### Claim 18 (depends on 17) The system of claim 17: wherein the first set consists of a first number of nodes; and wherein the second set consists of a second number of nodes greater than the first set of nodes. ### Claim 19 (depends on 18) The system of claim 18 wherein the first set consists of a single source and a single destination node. ### Claim 20 (depends on 18) The system of claim 18: wherein the single source node corresponds to a first physical sub-network and the single destination node corresponds to a second physical sub-network; and wherein the second set comprises a plurality of source nodes corresponding to the first physical sub-network and a plurality of destination nodes corresponding to the second physical network. ### Claim 21 (depends on 17) The system of claim 17 wherein the at least one monitoring circuit is programmed to further perform, relative to each packet in the plurality of packets and determined to be communicated between a source and destination in the second set of network nodes, the step of comparing the packet identifier of each respective received packet to a predicted identifier to determine a respective identifier deviation between the packet identifier of the respective received packet and the predicted identifier. ### Claim 22 (depends on 21) The system of claim 21 wherein the at least one monitoring circuit is programmed to further perform, relative to each packet in the plurality of packets and determined to be communicated between a source and destination in a second set of network nodes, the steps of: comparing the respective identifier deviation to a threshold; and responsive to the respective identifier deviation exceeding a threshold, adjusting packet communications along the second set of network nodes. ### Claim 23 (depends on 22) The system of claim 22 wherein the step of adjusting packet communications along the second set of network nodes comprises adjusting packet communications at least one an edge router. ### Claim 24 (depends on 21) The system of claim 21 wherein the at least one monitoring circuit is programmed to further perform, relative to each packet in the plurality of packets and determined to be communicated between a source and destination in a second set of network nodes, the steps of: comparing the respective identifier deviation to a threshold; and responsive to the respective deviation exceeding a threshold, indicating an alarm. ### Claim 25 (depends on 16) The system of claim 16 wherein the at least one monitoring circuit is programmed to further perform the step of, responsive to determining the additional packet is communicated between a source and destination in the first set of network nodes, comparing a time of arrival of the additional packet to a first predicted time of arrival to determine a time deviation between the time of arrival of the additional packet and the first predicted time of arrival. ### Claim 26 (depends on 25) The system of claim 25 wherein the at least one monitoring circuit is programmed to further perform, responsive to determining that the time deviation exceeds a threshold, the steps of: receiving a plurality of packets communicated along the network; and determining whether each packet in the plurality of packets is communicated between a source and destination in a second set of network nodes, wherein the second set of network nodes comprises the first set of network nodes. ### Claim 27 (depends on 26) The system of claim 26 wherein the at least one monitoring circuit is programmed to further perform, relative to each packet in the plurality of packets and determined to be communicated between a source and destination in a second set of network nodes, the step of comparing a time of arrival of the packet to a corresponding predicted time of arrival to determine a corresponding time deviation between the time of arrival of the packet and the corresponding predicted time of arrival. ### Claim 28 (depends on 27) The system of claim 27 wherein the at least one monitoring circuit is programmed to further perform the steps of: comparing the corresponding time deviation to a threshold; and responsive to the corresponding time deviation exceeding a threshold, indicating an alarm. ### Claim 29 (depends on 27) The system of claim 27 wherein the at least one monitoring circuit is programmed to further perform the steps of: comparing the corresponding time deviation to a threshold; and responsive to the corresponding time deviation exceeding a threshold, adjusting packet communications between at least some of the second set of nodes. ### Claim 30 (depends on 1) The system of claim 1 wherein the network comprises an internet protocol network. ### Claim 31 (depends on 1) The system of claim 1 wherein the internet protocol network comprises the global internet. ### Claim 32 (depends on 1) The system of claim 1 and further comprising a plurality of monitoring circuit, each coupled to the network, and each programmed to perform the steps of: receiving a packet communicated along the network; determining whether the received packet is communicated between a source and destination in a first set of network nodes, wherein each packet in a sequence of communications between the source and the destination comprises a packet identifier that uniquely identifies the packet from all other communications in a flow between the source and the destination; and responsive to determining the received packet is communicated between a source and destination in the first set of network nodes, comparing the packet identifier of the received packet to the predicted identifier to determine an identifier deviation between the packet identifier and the predicted identifier for identifying an irregularity in the network traffic. ### Claim 33 A method of monitoring a network along which network traffic flows in a form of packets, the method comprising: storing network packet information in storing circuitry, wherein the network packet information includes a predicted identifier and wherein the storing circuitry is accessible to the network; and operating at least one monitoring circuit coupled to the network along which network traffic flows in a form of packets, the operating step comprising the steps of: receiving a packet communicated along the network; determining whether the received packet is communicated between a source and destination in a first set of network nodes, wherein each packet in a sequence of communications between the source and the destination comprises a packet identifier that uniquely identifies the packet from all other communications in a flow between the source and the destination; and responsive to determining the received packet is communicated between a source and destination in the first set of network nodes, comparing the packet identifier of the received packet to the predicted identifier to determine an identifier deviation between the packet identifier and the predicted identifier for identifying an irregularity in the network traffic. ### Claim 34 (depends on 33) The method of claim 33, wherein the operating step further comprises: comparing the identifier deviation to a threshold; and responsive to the identifier deviation exceeding a threshold, one of the steps from the group consisting of indicating an alarm and adjusting packet communications between the source and the destination. ### Claim 35 (depends on 33) The method of claim 33 wherein the packet identifier comprises a sequence number. ### Claim 36 (depends on 33) The method of claim 33, wherein the operating step further comprises, responsive to determining the received packet is communicated between a source and destination in the first set of network nodes, comparing a time of arrival of the received packet to a predicted time of arrival to determine a time deviation between the time of arrival and the predicted time of arrival. ### Claim 37 (depends on 36) The method of claim 36 wherein the operating step further comprises: comparing the time deviation to a threshold; and responsive to the time deviation exceeding a threshold, one of the steps from the group consisting of indicating an alarm and adjusting packet communications between the source and the destination. ### Claim 38 (depends on 33) The method of claim 33 wherein the operating step further comprises, after determining that the identifier deviation between the packet identifier of the packet to a predicted identifier exceeds a threshold, the steps of: receiving a plurality of packets communicated along the network; and determining whether each packet in the plurality of packets is communicated between a source and destination in a second set of network nodes. ### Claim 39 (depends on 38) The method of claim 38 wherein the second set of network nodes comprises the first set of network nodes and wherein the second set consists of a number of nodes greater a number of nodes in the first set of nodes. ### Claim 40 (depends on 38) The method of claim 38 wherein the operating step further comprises, relative to each packet in the plurality of packets and determined to be communicated between a source and destination in the second set of network nodes, the steps of: comparing the packet identifier of each respective received packet to a predicted identifier to determine a respective identifier deviation between the packet identifier of the respective received packet and the predicted identifier; comparing the respective identifier deviation to a threshold; and responsive to the respective identifier deviation exceeding a threshold, one of the steps from the group consisting of indicating an alarm and adjusting packet communications between the network.