# US 8,751,624 B1 · System and method for identifying issues related to messages in a communication network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,624 B1 - Document ID: US8751624B1 - Status: Granted - Kind: B1 - Application number: 11/302,095 - Filed: 2005-12-12 - Granted: 2014-06-10 - Earliest claimed: 2004-12-10 - Assignees: Packet Design, Inc. - Applicants: Van Jacobson; Tina Wong - Inventors: Van Jacobson; Tina Wong - Web page: https://patentgrep.com/patent/US8751624B1 ## CPC - H04L 43/16: Threshold monitoring - H04L 41/0622: {based on time} - H04L 43/06: Generation of reports - H04L 43/062: related to network traffic - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method processes messages related to nodes in a network and provides reports according to those messages to allow analysis of the network. ## Claims ### Claim 1 A method of identifying issues in a network, comprising: a) receiving a plurality of messages, each of the plurality of messages describing at least one link in the network; b) storing each of the plurality of messages; c) for each link corresponding to at least some of the plurality of messages received, counting the number of messages received that describe said link and are not identified as explained; d) identifying a link with the highest number of messages per link and that are not identified as explained; e) for each message describing the link identified: i) assigning the message to a group; and ii) identifying the message as explained; repeating steps d and e, including e (i) and e (ii) at least once, using the messages not identified as explained; and f) displaying a report responsive to steps d and e, including e (i) and e (ii). ### Claim 2 (depends on 1) The method of claim 1, wherein at least some of steps c, d and e are responsive to a number of messages received during a period of time exceeding threshold. ### Claim 3 (depends on 2) The method of claim 2 wherein the threshold is identified relative to an average number of messages received during a similar length period of time. ### Claim 4 (depends on 1) The method of claim 1, wherein step e is responsive to the number of messages for the link identified in step d being higher than a threshold. ### Claim 5 (depends on 1) The method of claim 1, wherein the messages received at step a comprise messages about traffic carried through a plurality of autonomous systems. ### Claim 6 (depends on 1) The method of claim 1, wherein the messages received at step a comprise announce messages and withdraw messages. ### Claim 7 (depends on 1) The method of claim 1: additionally comprising: g) identifying at least a subset of the messages assigned to at least one group as corresponding to an oscillation responsive to addresses of the at least the subset of the messages; and wherein the report is responsive to step g. ### Claim 8 A computer program product comprising a non-transitory computer useable medium having computer readable program code embodied therein for identifying issues in a network, the computer program product comprising computer readable program code configured to cause a computer system to: a) receive a plurality of messages, each of the plurality of messages describing at least one link in the network; b) store each of the plurality of messages; c) for each link corresponding to at least some of the plurality of messages received, count the number of messages received that describe said link and are not identified as explained; d) identify a link with the highest number of messages per link and that are not identified as explained; e) for each message describing the link identified: i) assign the message to a group; and ii) identify the message as explained; repeating operation of computer readable program code d and e, including e (i) and e (ii) at least once using the messages not identified as explained; and f) display a report responsive to the computer readable program code d and e, including e (i) and e(ii). ### Claim 9 (depends on 8) The computer program product of claim 8, wherein at least some of computer readable program code c, d and e are responsive to a number of messages received during a period of time exceeding a threshold. ### Claim 10 (depends on 9) The computer program product of claim 9 wherein the threshold is identified relative to an average number of messages received during a similar length period of time. ### Claim 11 (depends on 8) The computer program product of claim 8, wherein computer readable program code e is responsive to the number of messages for the link identified in step d being higher than a threshold. ### Claim 12 (depends on 8) The computer program product of claim 8, wherein the messages received by computer readable code a comprise messages about traffic carried through a plurality of autonomous systems. ### Claim 13 (depends on 8) The computer program product of claim 8, wherein the messages received by computer readable program code a comprise announce messages and withdraw messages. ### Claim 14 (depends on 8) The computer program product of claim 8: additionally comprising computer readable program code configured to cause the computer system to: g) identify at least a subset of the messages assigned to at least one group as corresponding to an oscillation responsive to addresses of the at least the subset of the messages; and wherein the report is responsive to computer readable program code g. ### Claim 15 A system for identifying issues in a computer network, wherein the system comprises: a non-transitory computer useable medium having computer readable program code embodied therein for identifying issues in the computer network, the computer readable program code: a) receiving a plurality of messages, each of the plurality of messages describing at least one link in the computer network; b) storing each of the plurality of messages; c) for each link corresponding to at least some of the plurality of messages received, counting the number of messages received that describe said link and are not identified as explained; d) identifying a link with the highest number of messages per link and that are not identified as explained; e) for each message describing the link identified: i) assigning the message to a group; and ii) identifying the message as explained; f) repeating d and e, including e (i) and e (ii) at least once using the messages not identified as explained; and g) displaying a report responsive to the computer readable program code d and e, including e (i) and e(ii).