Method and apparatus for analyzing source internet protocol activity in a network

Abstract

Method and apparatus for analyzing source Internet protocol (SIP) activity in a network is described. In one example, a SIP address is obtained. Log data collected over a predefined time period by a plurality of network facilities is automatically queried using the SIP address as parametric input to generate a report. The report includes sample activity for the SIP and statistics for targeted network facilities, firewall activity, targeted network spaces, and targeted IP addresses.

1 . A method of analyzing source internet protocol (SIP) activity in a network, comprising:
 obtaining a SIP address; and   automatically querying log data collected over a predefined time period by a plurality of network facilities using the SIP address as parametric input to generate a report having sample activity for the SIP address and statistics for targeted network facilities, firewall activity, targeted network spaces, and targeted IP addresses.   
     
     
         2 . The method of  claim 1 , wherein the automatically querying comprises:
 adding user statistics to the report if the SIP address is associated with one or more session identifiers.   
     
     
         3 . The method of  claim 2 , wherein the one or more session identifiers comprise one or more virtual private network (VPN) session identifiers or one or more dynamic host control protocol (DHCP) session identifiers respectively associated with one or more users, and wherein the user statistics comprise, for each of the one or more users, at least one of: logon time, logoff time, or internet service provider (ISP) address. 
     
     
         4 . The method of  claim 1 , wherein the statistics for targeted network facilities include at least one of: a number of events recorded in the log data across the plurality of facilities, a number of the plurality of facilities reporting events in the log data, a list of the plurality of facilities, or a percentage of events across the plurality of facilities. 
     
     
         5 . The method of  claim 1 , further comprising:
 displaying the report on a graphical user interface (GUI).   
     
     
         6 . Apparatus for analyzing source internet protocol (SIP) activity in a network, comprising:
 means for obtaining a SIP address; and   means for automatically querying log data collected over a predefined time period by a plurality of network facilities using the SIP address as parametric input to generate a report having sample activity for the SIP address and statistics for targeted network facilities, firewall activity, targeted network spaces, and targeted IP addresses.   
     
     
         7 . The apparatus of  claim 6 , wherein the means for automatically querying comprises:
 means for adding user statistics to the report if the SIP address is associated with one or more session identifiers.   
     
     
         8 . The apparatus of  claim 7 , wherein the one or more session identifiers comprise one or more virtual private network (VPN) session identifiers or one or more dynamic host control protocol (DHCP) session identifiers respectively associated with one or more users, and wherein the user statistics comprise, for each of the one or more users, at least one of: logon time, logoff time, or internet service provider (ISP) address. 
     
     
         9 . The apparatus of  claim 6 , wherein the statistics for targeted network facilities include at least one of: a number of events recorded in the log data across the plurality of facilities, a number of the plurality of facilities reporting events in the log data, a list of the plurality of facilities, or a percentage of events across the plurality of facilities. 
     
     
         10 . The apparatus of  claim 6 , further comprising:
 means for displaying the report on a graphical user interface (GUI).   
     
     
         11 . A computer readable medium having stored thereon instructions that, when executed by a processor, cause the processor to perform a method of analyzing source internet protocol (SIP) activity in a network, comprising:
 obtaining a SIP address; and   automatically querying log data collected over a predefined time period by a plurality of network facilities using the SIP address as parametric input to generate a report having sample activity for the SIP address and statistics for targeted network facilities, firewall activity, targeted network spaces, and targeted IP addresses.   
     
     
         12 . The computer readable medium of  claim 11 , wherein the automatically querying comprises:
 adding user statistics to the report if the SIP address is associated with one or more session identifiers.   
     
     
         13 . The computer readable medium of  claim 13 , wherein the one or more session identifiers comprise one or more virtual private network (VPN) session identifiers or one or more dynamic host control protocol (DHCP) session identifiers respectively associated with one or more users, and wherein the user statistics comprise, for each of the one or more users, at least one of: logon time, logoff time, or internet service provider (ISP) address. 
     
     
         14 . The computer readable medium of  claim 11 , wherein the statistics for targeted network facilities include at least one of: a number of events recorded in the log data across the plurality of facilities, a number of the plurality of facilities reporting events in the log data, a list of the plurality of facilities, or a percentage of events across the plurality of facilities. 
     
     
         15 . The computer readable medium of  claim 1 , further comprising:
 displaying the report on a graphical user interface (GUI).