Network analysis system and method

A computer-implemented method for analyzing packet flow among devices in a wireless mesh network, comprising:

• receiving packet records corresponding to packets communicated over the network and store the packet records in a data store;
• monitoring, by capture devices each including a capture clock, packets communicated over the network, creating corresponding packet records, and including a timestamp in each packet record corresponding to a capture clock time the capture device detects the start of frame of a packet;
• timestamp synchronizing the packet records stored in the data store with received packet records by designating a first capture device as a master capture device;
• identifying duplicate records for packets communicated over the network by other capture devices, each other capture device being different from the master capture device and each duplicate record being record of a packet communicated over the network received from one of the other capture devices for which there is also a record of the same packet being communicated over the network received from the master capture device;
• determining a timing offset between the master capture device and at least one of the other capture devices based at least in part on a time difference between a time a particular packet was received by the master capture device as specified in a first packet record and a time the particular packet was received by the at least one of the other capture devices as specified in a duplicate record of the first packet record;
• time synchronizing one or more packet records received from the at least one of the other capture devices to the master capture device based at least in part on the timing offset;
• generating a plurality of correlated packet records from the packet records stored in the data store, the correlated packet records comprising hop data and timing data representative of a packet path and packet transmission times in the network for each corresponding packet, the correlated packet records filtered of packet records for duplicate packet transmissions and packet retransmissions and being representative of an order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data, application layer data and network layer data for each corresponding packet;
• generating network topology data representative of the network topology;
• generating packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer;
• generating application layer endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding device in the network and a corresponding application layer functionality;
• and
• generating endpoint bindings data defining bindings between the source endpoints and the destination endpoints, each binding being a logical link between a source endpoint and cluster identifier and destination endpoint.

A packet-based network analysis device for analyzing packet flow among devices in a wireless network, comprising:

• means for receiving packet records corresponding to packets communicated over the network and store the packet records in a data store;
• means for monitoring packets communicated over the network, for creating corresponding packet records, and for including a timestamp in each packet record corresponding to a capture clock time a capture device detects the start of frame of a packet;
• means for timestamp synchronizing the packet records stored in the data store with received packet records by designating a first capture device as a master capture device;
• means for identifying duplicate records for packets communicated over the network by other capture devices, each other capture device being different from the master capture device and each duplicate record being record of a packet communicated over the network received from one of the other capture devices for which there is also a record of the same packet being communicated over the network received from the master capture device;
• means for determining a timing offset between the master capture device and at least one of the other capture devices based at least in part on a time difference between a time a particular packet was received by the master capture device as specified in a first packet record and a time the particular packet was received by the at least one of the other capture devices as specified in a duplicate record of the first packet record;
• means for time synchronizing one or more packet records received from the at least one of the other capture devices to the master capture device based at least in part on the timing offset;
• means for generating a plurality of correlated packet records from the packet records stored in the data store, the correlated packet records comprising hop data and timing data representative of a packet path and packet transmission times in the network for each corresponding packet, the correlated packet records filtered of packet records for duplicate packet transmissions and packet retransmissions and being representative of an order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data and network layer data for each corresponding packet;
• means for generating network topology data representative of the network topology;
• means for generating packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer;
• means for generating measurement data relating to the packet flow data;
• means for generating application layer endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding device in the network and a correspond application layer functionality;
• and
• means for generating endpoint bindings between the source endpoints and the destination endpoints, each binding being a logical link between a source endpoint and cluster identifier and destination endpoint.