A method and apparatus for reconstructing sessions on a network is
described. The method allows for monitoring of quality of service at an
application level as well as for understanding application specific
events. This allows the method to be used to generate service detail
records for usage based on application type for use in billing. It also
allows the qualitative and quantitative analysis of quality of service
based on application specific parameters. For example, for web
applications, quality of service can be measured by the time from
requesting a link till the close of the session by delivery of the whole
page. Similarly, for voice over IP calls, application events like adding
participants and removing participants can be detected and billed
accordingly. Also, the quality of service can be measured. For example,
the actual latency can be compared to a predetermined latency amount set
by a provider for voice over IP calls. Additionally, service detail
records can be generated based on application specific events instead of
generic flows, so usage billing can be performed based on factors such as
a price per minute per leg, etc, with application specific events
generated each time a leg is added or dropped. Further, because the
periodicity of the output can be controlled on a per application basis,
output for voice over IP calls can be generated more often than for other
applications. Additionally, embodiments of the invention can reconstruct
sessions that are flowing across multiple network devices.