System and Method for Hierarchical Visualization of Data

Abstract

A system and method for monitoring IP flows in a network is disclosed. A plurality of monitor probes are coupled to links in the network, the monitor probes capture data packets from the links and determine protocols in OSI Layers 3, 4, and 5/7 of the packets. A user interface receives user inputs selecting the links and protocols for analysis. A display is coupled to the monitor probes and the user interface. The display and user interface receiving a user selection of links for analysis and display a first protocol analysis to the user, the first protocol analysis display comprising a pie chart representing all OSI Layer 3 protocols captured on the selected links, a pie chart representing all OSI Layer 4 protocols captured on the selected links, and a pie chart representing all OSI Layer 5/7 protocols captured on the selected links.

1 - 19 . (canceled) 
     
     
         20 . A network monitoring system, comprising:
 a processor; and   a memory coupled to the processor, the memory configured to store program instructions that, upon execution by the processor, cause the network monitoring system to:
 provide a first graphical representation, the first graphical representation having a first plurality of portions, each of the first plurality of portions having a size proportional to a characteristic of data packets belonging to a corresponding one of a first plurality of communication protocols of a first layer of the Open Systems Interconnection (OSI) model, the data packets having been captured from one or more links in a telecommunications network; 
 receive an indication of a selected one of the first plurality of portions; and 
 provide a second graphical representation, the second graphical representation having a second plurality of portions, each of the second plurality of portions having a size proportional to a characteristic of a subset of the data packets corresponding to the selected one of the first plurality of portions and belonging to a corresponding one of a second plurality of communication protocols of a second layer of the OSI model. 
   
     
     
         21 . The network monitoring system of  claim 20 , wherein the first and second graphical representations include pie charts, and wherein the first and second pluralities of portions include segments of the first and second pie charts, respectively. 
     
     
         22 . The network monitoring system of  claim 20 , wherein the characteristic is an amount of data packets. 
     
     
         23 . The network monitoring system of  claim 20 , wherein the characteristic is a Key Performance Indicator (KPI). 
     
     
         24 . The network monitoring system of  claim 20 , wherein at least one of the first plurality of portions has a size proportional to a characteristic of data packets belonging to two or more of the first plurality of communication protocols. 
     
     
         25 . The network monitoring system of  claim 24 , wherein the program instructions, upon execution by the processor, further cause the network monitoring system to receive an indication of a selected number of the first plurality of portions, the selected number smaller than a total number of protocols in the first plurality of communications protocols, the selected number determining how many of the two or more of the plurality of communication protocols is represented in the at least one of the plurality of portions. 
     
     
         26 . The network monitoring system of  claim 20 , wherein the first layer is a network layer, and wherein the second layer is a transport layer. 
     
     
         27 . The network monitoring system of  claim 26 , wherein the first plurality communication protocols includes an Internet Protocol (IP) version 6 (v6) and IPv4 protocol, and wherein the second plurality of communication protocols includes a Transmission Control Protocol (TCP) and a User Datagram Protocol (UDP). 
     
     
         28 . The network monitoring system of  claim 20 , wherein the first layer is a transport layer, and wherein the second layer is selected from the group consisting of: a session layer, and an application layer. 
     
     
         29 . The network monitoring system of  claim 28 , wherein the first plurality of communication protocols includes a Transmission Control Protocol (TCP) and a User Datagram Protocol (UDP), and wherein the second plurality of communication protocols includes one or more protocols selected from the group consisting of: Hypertext Transfer Protocol (HTTP), Network File System (NFS), and Domain Name System (DNS). 
     
     
         30 . A method, comprising:
 performing, by network monitoring system,
 providing a first graphical representation, the first graphical representation having a first plurality of portions, each of the first plurality of portions having a size proportional to a characteristic of data packets belonging to a corresponding one of a first plurality of communication protocols of a first layer of the Open Systems Interconnection (OSI) model, the data packets having been captured from one or more links in a telecommunications network; 
 receiving an indication of a selected one of the first plurality of portions; and 
 providing a second graphical representation, the second graphical representation having a second plurality of portions, each of the second plurality of portions having a size proportional to a characteristic of a subset of the data packets corresponding to the selected one of the first plurality of portions and belonging to a corresponding one of a second plurality of communication protocols of a second layer of the OSI model. 
   
     
     
         31 . The method of  claim 30 , wherein the first and second graphical representations include pie charts, and wherein the first and second pluralities of portions include segments of the first and second pie charts, respectively. 
     
     
         32 . The method of  claim 30 , wherein the characteristic is at least one of: an amount of data packets or a Key Performance Indicator (KPI). 
     
     
         33 . The method of  claim 30 , wherein at least one of the first plurality of portions has a size proportional to a characteristic of data packets belonging to two or more of the first plurality of communication protocols. 
     
     
         34 . The method of  claim 30 , further comprising:
 performing, by the network monitoring system,
 receiving an indication of a selected number of the first plurality of portions, the selected number smaller than a total number of protocols in the first plurality of communications protocols, the selected number determining how many of the two or more of the plurality of communication protocols is represented in the at least one of the plurality of portions. 
   
     
     
         35 . The method of  claim 30 , wherein the first layer is a network layer, and wherein the second layer is a transport layer. 
     
     
         36 . The method of  claim 30 , wherein the first layer is a transport layer, and wherein the second layer is selected from the group consisting of: a session layer, and an application layer. 
     
     
         37 . A non-transitory computer-readable storage medium having program instructions stored thereof that, upon execution by a network monitoring system, cause the network monitoring system to:
 provide a first graphical representation, the first graphical representation having a first plurality of portions, each of the first plurality of portions having a size proportional to a characteristic of data packets belonging to a corresponding one of a first plurality of communication protocols of a first layer of the Open Systems Interconnection (OSI) model, the data packets having been captured from one or more links in a telecommunications network;   receive an indication of a selected one of the first plurality of portions; and   provide a second graphical representation, the second graphical representation having a second plurality of portions, each of the second plurality of portions having a size proportional to a characteristic of a subset of the data packets corresponding to the selected one of the first plurality of portions and belonging to a corresponding one of a second plurality of communication protocols of a second layer of the OSI model.   
     
     
         38 . The non-transitory computer-readable storage medium of  claim 37 , wherein the first and second graphical representations include pie charts, wherein the first and second pluralities of portions include segments of the first and second pie charts, respectively, and wherein the characteristic is at least one of: an amount of data packets or a Key Performance Indicator (KPI). 
     
     
         39 . The non-transitory computer-readable storage medium of  claim 37 , wherein at least one of the first plurality of portions has a size proportional to a characteristic of data packets belonging to two or more of the first plurality of communication protocols, and wherein the program instructions, upon execution by the processor, further cause the network monitoring system to:
 receive an indication of a selected number of the first plurality of portions, the selected number smaller than a total number of protocols in the first plurality of communications protocols, the selected number determining how many of the two or more of the plurality of communication protocols is represented in the at least one of the plurality of portions.