Localizing network faults through differential analysis of tcp telemetry
AssigneeMicrosoft Technology Licensing, LLC
InventorsGeoff OUTHRED, Selim CIRACI
Life of this patent
Estimating the term…
Abstract
A server includes a processor and memory. An operating system is executed by the processor and memory. A network interface is run by the operating system and sends and receives flows using transmission control protocol (TCP). An agent application is run by the operating system and is configured to a) retrieve and store TCP telemetry data for the flows in a flow table; b) move selected ones of the flows from the flow table to a closed connections table when the flow is closed; and c) periodically send the flow table and the closed connections table via the network interface to a remote server.
Claims20
A method, comprising:
- receiving and storing transmission control protocol (TCP) telemetry data including associated geo-tags from a remote server in a database;
- in response to identifying a network error at a source server:
- retrieving the TCP telemetry data and associated geo-tags during a first period before the network error began and during a second period after the network error began or ended for the source server;
- and
- identifying comparison servers communicating with the source server and retrieve the TCP telemetry data and associated geo-tags during the first period before the error began and during the second period after the error began or ended for the comparison servers;
- and
- performing at least one function on the TCP telemetry data and associated geo-tags for at least one of the source server and the comparison servers.
A system, comprising:
- one or more processors;
- memory in electronic communication with the one or more processors;
- and
- instructions stored in the memory, the instructions being executable by the one or more processors to cause a server device to:
- receive and store transmission control protocol (TCP) telemetry data including associated geo-tags from a remote server in a database;
- in response to identifying a network error at a source server:
- retrieve the TCP telemetry data and associated geo-tags during a first period before the network error began and during a second period after the network error began or ended for the source server;
- and
- identify comparison servers communicating with the source server and retrieve the TCP telemetry data and associated geo-tags during the first period before the error began and during the second period after the error began or ended for the comparison servers;
- and
- perform at least one function on the TCP telemetry data and associated geo-tags for at least one of the source server and the comparison servers.
A non-transitory computer-readable storage medium comprising instructions thereon that, when executed by one or more processors, causes a server device to:
- receive and store transmission control protocol (TCP) telemetry data including associated geo-tags from a remote server in a database;
- in response to identifying a network error at a source server:
- retrieve the TCP telemetry data and associated geo-tags during a first period before the network error began and during a second period after the network error began or ended for the source server;
- and
- identify comparison servers communicating with the source server and retrieve the TCP telemetry data and associated geo-tags during the first period before the error began and during the second period after the error began or ended for the comparison servers;
- and
- perform at least one function on the TCP telemetry data and associated geo-tags for at least one of the source server and the comparison servers.
Dependencies are inferred from the claim text.