Automated load balancer discovery

• US 10,348,599 B2
• Filed: 11/09/2018
• Issued: 07/09/2019
• Est. Priority Date: 11/10/2017
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Edgewise Networks, Inc. (Zscaler Incorporated)
• Inventors: O'Neil, John, Keiser, Jr., Thomas Evan, Smith, Peter
• Primary Examiner(s): Nguyen, Quang N
• Application Number:
  US16/185,295
• Publication Number:
  US 20190149444A1
• Time in Patent Office: 242 Days
• Field of Search: 709203, 709206, 709217, 709219, 709223, 709224, 709226, 709228, 709230, 709232, 709238
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 67/1004 Server selection for load balancing
• CPC Class Codes: H04L 67/1031 Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Computer-implemented systems and methods automatically identify computers that act as load balancers on a digital communications network, using data collected from one or more computers on that network. Once a load balancer has been identified, the communications between two hosts may be connected across the identified load balancer, thereby making it possible to better analyze the behavior of hosts and applications on that network.

Claims

1. A method performed by at least one computer processor executing computer program instructions stored on at least one non-transitory computer-readable medium, the method comprising:

receiving information about a plurality of incoming communications, over a network, to a computer;

receiving information about a plurality of outgoing communications, over a network, from the computer;

identifying, for each of the plurality of incoming communications, a corresponding invariant scalar quantity;

identifying, for each of the plurality of outgoing communications, a corresponding invariant scalar quantity;

determining whether a sum of the corresponding invariant scalar quantities for each of the plurality of incoming communications is equal to a sum of the corresponding invariant scalar quantities for each of the plurality of outgoing communications;

if the sum of the corresponding invariant scalar quantities for each of the plurality of incoming communications is determined to be equal to the sum of the corresponding invariant scalar quantities for each of the plurality of outgoing communications, then determining that the computer is a load balancer; and

otherwise, determining that the computer is not a load balancer;

wherein the scalar invariant quantity corresponding to each of the plurality of incoming communications comprises a size of a payload of the incoming communication and the scalar invariant quantity corresponding to each of the plurality of outgoing communications comprises a size of a payload of the outgoing communication.

2. The method of claim 1, wherein the plurality of incoming communications comprises a plurality of messages transmitted by a plurality of computers, and wherein the step of receiving information about a plurality of incoming communications comprises receiving the plurality of messages at a computer that is not within the plurality of computers.

3. The method of claim 1, wherein the plurality of incoming communications comprises a plurality of messages transmitted by a plurality of computers, and wherein the step of receiving information about a plurality of incoming communications comprises receiving, at a computer that is not within the plurality of computers, communications from a management server containing information about the plurality of messages.

4. A system comprising at least one non-transitory computer-readable medium having computer program instructions stored thereon, the computer program instructions being executable by at least one computer processor to perform a method, the method comprising:

receiving information about a plurality of incoming communications, over a network, to a computer;

receiving information about a plurality of outgoing communications, over a network, from the computer;

identifying, for each of the plurality of incoming communications, a corresponding invariant scalar quantity;

identifying, for each of the plurality of outgoing communications, a corresponding invariant scalar quantity;

determining whether a sum of the corresponding invariant scalar quantities for each of the plurality of incoming communications is equal to a sum of the corresponding invariant scalar quantities for each of the plurality of outgoing communications;

if the sum of the corresponding invariant scalar quantities for each of the plurality of incoming communications is determined to be equal to the sum of the corresponding invariant scalar quantities for each of the plurality of outgoing communications, then determining that the computer is a load balancer; and

otherwise, determining that the computer is not a load balancer;

wherein the scalar invariant quantity corresponding to each of the plurality of incoming communications comprises a size of a payload of the incoming communication and the scalar invariant quantity corresponding to each of the plurality of outgoing communications comprises a size of a payload of the outgoing communication.

5. The system of claim 4, wherein the plurality of incoming communications comprises a plurality of messages transmitted by a plurality of computers, and wherein the step of receiving information about a plurality of incoming communications comprises receiving the plurality of messages at a computer that is not within the plurality of computers.

6. The system of claim 4, wherein the plurality of incoming communications comprises a plurality of messages transmitted by a plurality of computers, and wherein the step of receiving information about a plurality of incoming communications comprises receiving, at a computer that is not within the plurality of computers, communications from a management server containing information about the plurality of messages.