NetScout Systems, Inc.

A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria. KPI session related data associated with a subscriber is generated in a clustered probe that receives the distributed packet from the smart cluster device/probe. Subscriber related data from each clustered probe is then aggregated with at least one monitoring device operably coupled to the clustered probes such that a user of the monitoring device is provided with the perception that the monitoring device is coupled to a single probe.

A method for assessing and improving network performance using video session data. Control plane signaling data comprising geographic location data from network monitoring equipment connected to a communications network is collected. Video session data comprising data of a plurality of video sessions from video monitoring equipment connected to the communications network is collected. The plurality of video sessions are associated with a plurality of mobile devices streaming videos on the respective mobile device across the communications network. The video session data and control plane signaling data within a cell of the communications network is correlated. The correlated data is provided to a communications network provider. The communications network is reorganized according to the correlated data.

A computer-implemented method for repurposing one or more software configurable layer 2 switches in an IP (Internet Protocal) computer network to function as a layer 1 switch. Ternary Content-Addressable Memory (TCAM) is reconfigured in each of the one or more layer 2 switches and one or more pipeline engines are routed to emulate layer 1 switching functionality in each of the one or more layer 2 switches.

Decrypting synthetic transactions with beacon packets is provided. A probe receives, from a client device, a start beacon packet that identifies a test of a service provided by one or more servers. The probe establishes, responsive to receipt of the start beacon packet, a log for the test. The probe stores, in the log established responsive to the start beacon packet, data packets transmitted between the client device and the one or more servers subsequent to the start beacon packet and encrypted with a key using a security protocol. The probe receives, from the client device, key information used to decrypt the data packets of the test encrypted with the key using the security protocol. The probe provides at least one of the data packets for evaluation or decryption using the key information to determine a performance of the service.

Internet protocol packets are statelessly identified as associated with a particular session-instance by identifying a key, or session-instance identifier, within the data (or payload) portion of a user plane packet. This identifier is specific to the session-instance and remains constant throughout the session-instance. Using this stateless identification, transmitted user plane packets are automatically routed at the transmission speed of the transmission link using a method that automatically balances the analysis processing load between network probes. The load is balanced by routing the user plane packet to a network probe that is either already analyzing the session-instance or by routing the user plane packet to a system that has processing capacity to analyze a new session-instance. The network probe then analyzes the user plane packet and the session-instance to measure the quality of the user experience of the session-instance and performance of the network.