Monitoring network performance remotely

A system comprising:

• a first network tap point configured to duplicate, in a non-intrusive manner, at least part of a network communication transmitted to and from an access point device that forms the boundary between a first network and a second network;
• a second network tap point configured to duplicate, in a non-intrusive manner, at least part of a network communication transmitted to and from a server computing device placed within, in a network topology sense, the second network;
• a client-side tap point analyzer device configured to:
• monitor, via the first network tap point, at least partially encrypted network communication between a client computing device that is within the first network and the server computing device,
• infer a network communication transaction based upon a first portion of the monitored at least partially encrypted network communication,
• generate an identifier for the inferred network communication transaction, and
• transmit the identifier of the inferred network communication transaction to a server-side tap point analyzer device;
• and
• the server-side tap point analyzer device configured to:
• monitor, via the second network tap point, the at least partially encrypted network communication between the client computing device and the server computing device,
• decrypt a second portion of the monitored at least partially encrypted network communication to derive a decrypted network communication transaction, and
• analyze the inferred network communication transaction and the decrypted network communication transaction to generate at least one set of metrics regarding the performance of the at least partially encrypted network communication between the client computing device and server computing device including compare and match the identifier of the inferred network communication with an identifier of the decrypted network communication.

A computer program product for managing a network, the computer program product being tangibly embodied on a non-transitory computer-readable medium and including executable code that, when executed, is configured to cause at least one processor to:

• monitor, via a first network tap point and a second network tap point, at least partially encrypted network communication between a client computing device that is within a first network and a server computing device that is within a second network;
• infer a network transaction from a first portion of the at least partially encrypted network communication viewed by the first network tap point;
• generate an identifier for the inferred network transaction;
• decrypt a second portion of the at least partially encrypted network communication viewed by the second network tap point to derive a decrypted network transaction using an encryption key associated with the server computing device;
• correlate the inferred network transaction with the decrypted network transaction based on the identifier for the inferred network transaction;
• and
• analyze the decrypted network transaction correlated with the inferred network transaction to generate at least one set of metrics regarding the performance of the at least partially encrypted network communication between the client computing device and server computing device including compare and match the identifier of the inferred network communication with an identifier of the decrypted network communication.