1. The Field of the Invention
The present invention relates generally to protocol analyzer systems. More particularly, the present invention relates to methods and systems to synchronize timestamps and the capture of data across serially chained boxes that are used together to monitor and capture network data.
2. The Relevant Technology
Computer and data communications networks continue to develop and expand due to declining costs, improved performance of computer and networking equipment, and increasing demand for communication bandwidth. Communications networks, including for example, wide area networks (“WANs”), local area networks (“LANs”), and storage area networks (“SANs”) allow increased productivity and utilization of distributed computers or stations through the sharing of resources, the transfer of voice and data, and the processing of voice, data, and related information at the most efficient locations. Moreover, as organizations have recognized the economic benefits of using communications networks, network applications such as electronic mail, voice and data transfer, host access, and shared and distributed databases are increasingly used as a means to increase user productivity. This increased demand, together with the growing number of distributed computing resources, has resulted in a rapid expansion of the number of installed networks.
As the demand for networks has grown, network technology has grown to include many different physical configurations. Examples include Gigabit Ethernet, Fiber Distributed Data Interface (“FDDI”), Fibre Channel, and InfiniBand networks. These and the many other types of networks that have been developed typically utilize different cabling systems, different bandwidths and typically transmit data at different speeds. In addition, each of the different network types has different sets of standards, referred to as protocols, which set forth the rules for accessing the network and for communicating among the resources on the network.
Typically, transmissions between two network connected devices are passed through a hierarchy of protocol layers at each of the connected devices. Each layer in the first network connected device essentially carries on a conversation with a corresponding layer in the second network connected device, in accordance with an established protocol that defines the rules of communication between the layers.
As communication networks have increased in number, size and complexity however, they have become more likely to develop a variety of problems that are increasingly difficult to diagnose and resolve. Moreover, the demands for network operational reliability and increased network capacity, for example, emphasize the need for adequate diagnostic and remedial systems, methods and devices.
Exemplary causes of network performance problems include the transmission of unnecessarily small frames of information, inefficient or incorrect routing of information, improper network configuration and superfluous network traffic, to name just a few. Such problems are aggravated by the fact that many networks are continually changing and evolving due to growth, reconfiguration and introduction of new network typologies and protocols, as well as the use of new interconnection devices and software applications.
Consequently, as high speed data communications mature, many designs increasingly focus on reliability and performance issues. In particular, communications systems have been designed to respond to a variety of network errors and problems, thereby minimizing the occurrence of network failures and downtimes. In addition, equipment, systems and methods have been developed that allow for the testing and monitoring of the ability of a communications system to respond to and deal with specific types of error conditions on a network. In general, such equipment, systems, and methods provide the ability to selectively alter channel data, including the introduction of errors into channel data paths.
One device that is used to detect these errors is a protocol analyzer, also called a network analyzer. A protocol analyzer runs in the background of a network, capturing, examining and logging packet traffic. Protocol analyzers can, for example, be configured to watch for unusual IP addresses, time stamps and data packets, and most have a user interface for enabling the network administrator to have access to information representing the analysis performed by the protocol analyzers. Protocol analyzers are thus a fundamental and highly useful tool for testing and debugging various types of communications networks, including computing and computer storage networks. A protocol analyzer operates by capturing selected portions of data from a data stream that is transmitted via the communications network. The captured information may then be analyzed in greater detail by the protocol analyzer to extract desired information. For instance, data transmission faults or errors, or performance errors, known generally as problem conditions, may be diagnosed by examining the captured data that is related to the problem. Hacking can also be detected through a protocol analyzer.
Protocol analyzers can be transparent to a network(s) or be configured as gateways or switching networks. Regardless, they include ports (physical connections) to the networks. The ports provide connectivity to the networks and permit the protocol analyzers to receive and capture network data. The ports are often provided on a blade (or card) that is often contained in a chassis (or box) with a common backplane or bus. The box may be modular, thereby allowing multiple boxes to be mounted to a rack in a customizable and expandable system. Such multi-box protocol analyzer systems provide access to a large number of ports over numerous blades that can be used for various purposes.
The increasing numbers of ports that have been developed enable network administrators to configure protocol analyzers for use with different data links or channels as well as to be used in coordination even though the individual ports analyzers are located on different boxes. Control signals to coordinate the boxes are typically transmitted between the boxes over inter-box cables. Thus, a network administrator can send a control signal over the cables to each of the boxes to initiate a coordinated network traffic analysis.
However, the cables, or other devices, used to interconnect boxes create a data transmission latency between the boxes, resulting in boxes receiving and implementing a control signal at different times depending on their distance from the source of the control signal. Although this latency is small (i.e. microseconds), it is enough to make accurately interpreting activity across various ports over multiple boxes difficult. Accordingly, there is a continuing need for improved methods and devices for synchronously operating protocol analyzers that are configured as multi-box systems.