Method and apparatus for determining a polling interval in a network management system

[0001] 1. Field of the Invention

[0002] The present invention relates to the retrieval of data by polling a device on a network, and more particularly to a method for adjusting the polling interval according to characteristics of the network.

[0003] 2. Description of the Related Art

[0004] The present invention will be described in relation to the retrieval of network management data by a network management software application. However, the skilled person will appreciate that the invention can be used for many other purposes in which data is collected by periodically polling a device on a network.

[0005] Network management applications are commonly used to monitor the performance of a network. For example, a network management application may monitor network activity to determine that the devices and links forming the network are operating efficiently, and are not unduly congested with network traffic. Monitoring typically includes “polling” network devices. Polling may involve performing tests for device activity and service availability, and sending requests to managed network devices for management data indicative of device and link operation, at predetermined periodic intervals.

[0006] For example GB-A-2 350 035 describes a network management application which performs periodic polling of devices on a Local Area Network (LAN), and which retrieves network management data using the Simple Network Management Protocol (SNMP). In accordance with the SNMP protocol, the SNMP manager in the network management station, running the network management application, sends polling requests, at periodic intervals, to the SNMP agents of managed network devices on the network to retrieve specified SNMP MIB data relating to characteristics, such as traffic activity or errors occurring at a particular port, for processing by the network management station. In addition, the network management station performs polling tests at periodic intervals, including sending ICMP Ping requests to each device on the network, and sending selected requests for services such as SMTP, NFS and DNS to servers, and monitoring the time taken to receive a response. If a response is not received in a predetermined time interval a “timeout” is recorded which may indicate that the monitored device is not operating correctly or there is a problem with a link between the monitored device and the network management station.

[0007] An example of a network management application which performs periodic polling of network devices is the 3Com® Network Supervisor, available from 3Com Corporation of Santa Clara, USA.

[0008] The polling interval for a particular request or test sent to a particular network device is typically preset in the network management application, and is dependent upon the monitored characteristic, the type of device being polled etc. Typically the polling interval is in the range of 30 seconds to 5 minutes, which, if a large number of network devices are being monitored, generates a significant quantity of network traffic that may cause congestion on the network. Moreover, if links between monitored network devices and the management station running the network management application are relatively slow speed links, the delays in the monitoring traffic may cause problems.

[0009] For example, if a network administrator is running a network management application at a location remote from the monitored network, for example via a modem connection (via the PSTN) or a Wide Area Network (WAN) link, the slow speed of the link may cause polling requests and polling responses to be delayed, thus resulting in the network management application reporting “timeouts”. Such timeouts may give the network administrator a false impression about the state of the network by suggesting that there are problems on the monitored network that do not exist.

[0010] In addition, the problem of congestion increases if a link between the network management station and the monitored network is shared with other network users, as is the case with a WAN link, since the congestion caused by the network management traffic may unacceptably slow reduce the bandwidth available to other users, thus slowing down network communications for other users.

[0011] Finally, another problem arises if the network management traffic utilised a “dial-on-demand” link, such as an ISDN line, in which the link is made upon data being sent and broken a predetermined time after the link stops being used. In particular, polling may cause the link to be continually made and broken, for example if the polling interval is 2 minutes and the line is automatically disconnected after 60 seconds of inactivity, which has undesirable cost implications and represents a poor use of the link.

[0012] In order to address these problems, the present invention provides a method for adapting the polling interval for the monitoring of a particular characteristic of a device on a network according to network characteristics, and in particular according to the nature of the links carrying the monitoring requests and responses.

[0013] In accordance with a first aspect, the present invention provides a method for determining a time interval for periodically polling a device on a network, the method comprising determining the most restrictive link to the network device, the most restrictive link being dependent on the nature of the link, and determining the time interval in accordance with the nature of the most restrictive link.

[0014] By determining the polling interval according to the nature (e.g. type and speed) of the most restrictive link to the polled network device, congestion due to polling traffic can be minimised (i.e. by increasing the polling interval for slower and/or shared links), unnecessary use of dial on demand links can be avoided (e.g. by increasing the polling interval), and more polling information can be gathered where link speed and bandwidth is available (i.e. by reducing the polling interval where the default polling interval is unnecessarily high).

[0015] Preferably, the method is performed by a polling device on a network, the polling device periodically polling a plurality of devices on the network.

[0016] In a preferred embodiment the nature of the most restrictive link is determined using the steps of: determining the nature of the link of the local network to which the polling device is connected; determining the nature of the restrictive link to the subnet to which the polled device is connected, and comparing the nature of the determined links.

[0017] In accordance with a second aspect, the present invention provides a computer program for carrying out a method in accordance with a first aspect of the present invention.

[0018] In accordance with a third aspect, the present invention provides a network management apparatus for periodically polling devices on a network, the apparatus configured to determine a time interval for periodically polling a device on a network by determining the most restrictive link to the network device, the apparatus being configured to determine the time interval in accordance with the nature of the most restrictive link.

[0019] Further preferred features and advantages of the present invention will be apparent from the following description and accompanying claims.

[0023] FIG. 1 shows a simple example of a Wide Area Network (WAN) 1 comprising a plurality of Local Area Network (LAN) subnets 1A, 1B and 1C (only LANA is shown in detail; the skilled person will appreciated that LANs B and C have similar configurations). Each subnet comprises a plurality of network devices comprising a router 9 connecting the subnet to the WAN by means of WAN links, and one or more core SNMP managed network devices 7 such as switches or hubs, and unmanaged workstations and PCs 3, all connected by media links 5 (which may be coaxial, twisted pair or fibre optic cable, or wireless links). As well known in the art, each managed network device includes an SNMP agent capable of monitoring data packets and storing MIB (Management Information Base) data which can be retrieved by an SNMP manager, in a network management station, in response to SNMP requests.

[0024] A network management station 3A includes a network management application which monitors the network by polling network devices by performing tests and sending requests to retrieve SNMP MIB data as described above.

[0025] The time interval between polling a particular network device is typically set to a default value in the network management application, the default value being dependent upon the characteristic of the network device being monitored. The default value for each characteristic is determined by the application vendor based on typical network configurations. Thus, the polling interval is not tailored to the particular network or networks being monitored by the network management application.

[0026] The method and apparatus of the present invention adjusts the polling interval for each monitored characteristic and for each device according to the network, specifically according to the nature (type and speed (data rate/bandwidth)) of the links between the network management station 3A, running the network management application, and the monitored network.

[0027] FIG. 2 illustrates a method for adjusting a polling interval in accordance with a preferred embodiment of the present invention. In order to implement the method of the present invention, all that is required is a list of the network devices to be polled, which may be stored in memory as a list of the IP addresses (or equivalent) of the network devices. It will be appreciated that in some embodiments, more detailed information about the topology of the network may be available.

[0028] The method is preferably implemented in the form of a computer program forming part of a network management application. The computer program is preferably provided in the form of a computer readable medium such as a magnetic or optical disk, for loading onto the network management station 3A, or may be downloaded as a carrier wave over a suitable communications medium from a website, for example. It will be appreciated that the method may also be implemented in other forms such as hardware.

[0029] The program starts at step 110 by determining the nature of the link of the local network on which the network management station 3A, running the network management application, is located. In particular, the network management application determines the type and speed of the network link to which the management station 3A is connected. This can be done using conventional techniques, well known in the art.

[0030] For example, the type and speed of the link can be determined from SNMP MIB data retrieved from the SNMP managed device to which the network management station 3A is connected. In particular, the standard SNMP “ifTable” in MIB II includes the variables “ifType” and “ifSpeed”, which can be read for the particular link concerned. The “ifType” value is defined as “the type of interface, distinguished according to the physical/link protocol(s) immediately ‘below’ the network layer in the protocol stack” thus indicates the type of link. The “ifSpeed” value is defined as “an estimate of the interface's current bandwidth in bits per second” and indicates the operating speed of the link.

[0031] At step 120, the program then selects a first subnet, e.g. LANA, of the monitored network (WAN 1). The selection of a subnet can be performed on the basis of the IP addresses of the network devices to be polled. In particular, the program can identify a subnet from the “subnet number” within the IP addresses of the network devices.

[0032] At step 130, the program determines the path between the network management station 3A and the relevant subnet 1A (LANA). This is performed using conventional techniques. For example, the path may be determined using network topology information (if available) or by using the well known ICMP-based “TraceRoute” technique which finds routers on the path to the subnet 1A. In the illustrated embodiment, the determined path to the subnet only includes the links between LANs (i.e. the links connecting all the routers between the network management station and the subnet). It is not generally necessary to determine the unique paths to individual network devices on the subnet, since the links connecting devices on a subnet (LAN) are generally short and high speed, and so rarely introduce delays to polling traffic. Nevertheless, in other embodiments, it may be desirable to determine the paths to selected or all polled devices, including the subnet (LAN) links.

[0033] At step 140, the program determines the nature, specifically the speed and optionally the type, of each link on the path to the subnet determined in step 130. The speed and type of each link can be determined using conventional techniques, for instance using SNMP as described above in relation to step 110. Alternatively, the type and speed of one or more of the links may be obtained from the Telnet or web interface of a device connected to the link.

[0034] At step 150, the program identifies the most “restrictive” link of the links in the path to the subnet 1A based on the speed, and optionally the type, of links in the path, determined at step 140. The most restrictive link may be determined simply by comparing the speed (data rate) of the links in the path to the subnet, the most restrictive link being the link with the lowest link speed. Alternatively, in more complex embodiments, a “restrictiveness value” may be assigned for each type and speed of link, and the restrictiveness values for the links in the path compared in order to determine the most restrictive link. Thus, for example, a POTS link may have a highest restrictiveness value of, say 10, indicting the most restrictive link type and speed, and a dial on demand ISDN link may similarly have a high restrictiveness value of, say 9. In contrast, a high speed/bandwidth link may have relatively low restrictiveness value indicating a least restrictive link. A wireless link may have a moderate restrictiveness value, according to its type and speed, and so on.

[0035] At step 160 the program compares the speed and type of the most restrictive link, as determined at step 150, with the speed and type of the local link, and determines which is the most restrictive. Again, this may be performed by simply comparing the speed of the links, or by comparing “restrictiveness values” as described above.

[0036] If step 160 determines that the local link is the most restrictive link, the program proceeds to step 170 and determines the polling interval(s) according to the speed and type of the local link, as described below.

[0037] Alternatively, if step 160 determines that the local link is not the most restrictive link, the program proceeds to step 180 and determines the polling interval(s) according to the speed and type of the most restrictive link in the path, as determined at step 150, as described below.

[0038] At step 190, the program determines whether there are any more subnets to be considered by considering the list of IP addresses of network devices to be polled.

[0039] If there are more subnets to be considered, the program returns to step 120 and selects the next subnet. The program then proceeds with steps 130 to 170/180 for the new subnet.

[0040] The program continues until step 190 determined that there are no more subnets to consider and then ends.

[0041] The determination of the polling interval, at step 170 or step 180 according to the appropriate (most restrictive) link is performed as follows.

[0042] The polling interval needs to be chosen in order to limit the proportion of the bandwidth used by monitoring traffic over a given time period. The proportion of the bandwidth that may be used for monitoring traffic will depend on the nature of the most restrictive link. Thus for a high speed link, with relatively little other traffic, a greater proportion of the bandwidth may be appropriate, whereas a low speed shared link carrying large quantities of other traffic a lower proportion of the bandwidth. The polling interval is then determined based on the proportion of the bandwidth that is available for monitoring traffic, based on these factors.

[0043] For example, say for a particular type of link, up to 10% of the bandwidth is available for monitoring traffic. Then the threshold for link utilisation for monitoring traffic is 10% or 0.1.

[0044] The utilisation of the link by monitoring traffic is determined as an average utilisation over a time period, expressed as a percentage of the overall bandwidth.

[0045] Thus, the utilisation by monitoring traffic, U, is defined by the equation:

[0046] $U=\frac{N/P}{B}$
where:

• [0047] B=the bandwidth of the link (in b/s)
• [0048] N=the number of data bits sent and received per poll
• [0049] P=polling interval (in s)

[0050] Since the bandwidth B is a fixed value (i.e. the link speed 64 kb/s, 10 Mb/s etc) and the number of data bits sent per poll N can be determined by the polling device, the polling interval P can be calculated so that the utilisation U is less that the threshold U_T(e.g. 0.1 for 10%) using the equation:

[0051] $P\ge \frac{N}{U_{T}B}$

[0052] For dial on demand link types such as ISDN, for which a connection has to be established, the “period of inactivity”, which leads to the link being broken, may also be taken into consideration when determining the polling interval. The period of inactivity which causes such a link to be broken may be entered manually by a network administrator, or determined by other conventional methods. The polling interval may be increased or reduced according to the period of inactivity and the available bandwidth. Alternatively, the method may determine that polling interval based on the link speed, and maintain the link in a constantly active state, by sending relatively small data packets on the link at periodic intervals less than the period of inactivity associated with the link.

[0053] Accordingly, the present invention enables the adaptation of the polling interval according to the polling environment. The present invention may be used to dynamically modify the polling interval, for each polled device (or for each polled device on a subnet), by monitoring the amount of polling traffic, particularly polling traffic sent on the most restrictive link or links to the device, in order to maintain the volume polling traffic below predetermined acceptable threshold levels.

[0054] As the skilled person will appreciate, various modifications and changes may be made to the described embodiments. It is intended to include all such variations, modifications and equivalents which fall within the spirit and scope of the present invention as defined in the accompanying claims.