Aggregating select network traffic statistics
First Claim
Patent Images
1. A method for aggregating select network traffic statistics for each of a plurality of network appliances connected in a communication network, the method comprising:
- for each flow from a first network appliance, extracting a first attribute value of a first flow attribute;
for each flow from the first network appliance, extracting a second attribute value of a second flow attribute;
building at least one hierarchical string with the extracted first attribute value and the extracted second attribute value,wherein the hierarchical string represents a subset of network traffic statistics collected for the first network appliance, andthe second attribute of the hierarchical string is more specific than the first attribute of the hierarchical string;
extracting at least one network metric for at least one network characteristic associated with the at least one hierarchical string;
aggregating the at least one network metric for the at least one network characteristic over a plurality of flows to and from the first network appliance in the communication network;
generating an accumulating map that is updated in substantially real time, the accumulating map comprising the at least one hierarchical string and associated aggregated network metrics for the first flow attribute and the second flow attribute of the hierarchical string,wherein the accumulating map has a target number of entries for a specified time period and an eviction policy determines how information is aggregated once the accumulating map reaches its target number of entries for the specified time period,the eviction policy determining that a record is aggregated into a higher level record of the accumulating map and is evicted from the accumulating map; and
transmitting the accumulating map to a network information collector in communication with the plurality of network appliance.
5 Assignments
0 Petitions
Accused Products
Abstract
Disclosed herein are systems and methods for the collection, aggregation, and processing of network traffic statistics for a plurality of network appliances in a wide area network. Select network traffic statistics can be collected and associated with a hierarchical string, and aggregated over time. In this way, only information that is likely to be relevant is gathered and maintained, allowing for the maintenance of select network traffic statistics for large-scale operations.
-
Citations
20 Claims
-
1. A method for aggregating select network traffic statistics for each of a plurality of network appliances connected in a communication network, the method comprising:
-
for each flow from a first network appliance, extracting a first attribute value of a first flow attribute; for each flow from the first network appliance, extracting a second attribute value of a second flow attribute; building at least one hierarchical string with the extracted first attribute value and the extracted second attribute value, wherein the hierarchical string represents a subset of network traffic statistics collected for the first network appliance, and the second attribute of the hierarchical string is more specific than the first attribute of the hierarchical string; extracting at least one network metric for at least one network characteristic associated with the at least one hierarchical string; aggregating the at least one network metric for the at least one network characteristic over a plurality of flows to and from the first network appliance in the communication network; generating an accumulating map that is updated in substantially real time, the accumulating map comprising the at least one hierarchical string and associated aggregated network metrics for the first flow attribute and the second flow attribute of the hierarchical string, wherein the accumulating map has a target number of entries for a specified time period and an eviction policy determines how information is aggregated once the accumulating map reaches its target number of entries for the specified time period, the eviction policy determining that a record is aggregated into a higher level record of the accumulating map and is evicted from the accumulating map; and transmitting the accumulating map to a network information collector in communication with the plurality of network appliance. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
-
-
15. A system for aggregating select network traffic statistics, comprising:
-
a plurality of network appliances in a communication network, each of the plurality of network appliances configured to; collect a plurality of flow attributes for network traffic through each network appliance; build at least one hierarchical string of network traffic flow attributes with an extracted first attribute value and an extracted second attribute value of the collected flow attributes, wherein the hierarchical string represents a subset of the collected flow attributes for the network appliance, and the second attribute of the hierarchical string is more specific than the first attribute of the hierarchical string; extract at least one network metric for at least one network characteristic associated with each of the at least one hierarchical string; aggregate the at least one network metric for the at least one network characteristic over a plurality of flows to or from the network appliance; generate an accumulating map that is updated in substantially real time, the accumulating map comprising the at least one hierarchical string and associated aggregated network metrics for a first flow attribute and a second flow attribute of the hierarchical string, wherein the accumulating map has a target number of entries for a specified time period and an eviction policy determines that a record is aggregated into a higher level record of the accumulating map and is evicted from the accumulating map when the accumulating map reaches the target number of entries for the specified time period; and transmit the accumulating map to a network information collector in communication with each network appliance; and the network information collector configured to receive information from each network appliance, and provide the information to a user on a graphical user display. - View Dependent Claims (16, 17, 18, 19, 20)
-
Specification