Methods for facilitating network traffic analytics and devices thereof

• US 10,505,792 B1
• Filed: 09/29/2017
• Issued: 12/10/2019
• Est. Priority Date: 11/02/2016
• Status: Active Grant

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Duke, Martin, Amdahl, Saxon
• Primary Examiner(s): Nguyen, Quang N
• Application Number:
  US15/721,198
• Time in Patent Office: 802 Days
• Field of Search: 709203, 709206, 709217, 709219, 709223, 709224, 709226, 709228, 709230, 709232, 709238, 707694, 370252
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

Methods, non-transitory computer readable media, network traffic management apparatuses, and network traffic management systems that determine when an event has occurred. The event is defined in an obtained rule and is associated in the rule with a key. The key is attached to a connection associated with received network traffic that triggered the event, when the determining indicates that the event has occurred. The connection is associated with a first layer, the key comprises an input string value or corresponds to a portion of data associated with a second layer associated with the network traffic, and the second layer is different from the first layer. The connection is then monitored to obtain statistics for the connection and store or report the statistics as associated with the key.

Claims

1. A method for facilitating improved network traffic analytics implemented by a network traffic management system comprising one or more network traffic management apparatuses, client devices, administrator devices, or server devices, the method comprising:

determining when an event has occurred, wherein the event is defined in a rule comprising one or more conditions and the event is associated with a key;

determining when data associated with a first network layer within network traffic satisfies at least one of the conditions in the rule;

associating the key to a connection associated with the network traffic that triggered the event, wherein the connection is associated with a second network layer within the network traffic that is different from the first network layer within the network traffic and the key comprises an input string value or corresponds to a portion of the data associated with the first network layer; and

monitoring the connection to obtain statistics for the connection and storing or reporting the statistics as associated with the key.

2. The method of claim 1, further comprising storing or reporting the statistics indexed based on one or more predefined entities, when the determining indicates that the event has not occurred or the data does not satisfy the at least one of the conditions.

3. The method of claim 1, further comprising:

storing the statistics associated with the key in a database;

receiving a query comprising the key;

retrieving at least a portion of the statistics from the database using the key; and

outputting the at least a portion of the statistics in response to the received query.

4. The method of claim 1, wherein the first network layer is a transport layer, the connection is a transport control protocol (TCP) connection, the second network layer is an application layer, and the rule is event-driven and implemented according to a cross-layer messaging protocol.

5. A network traffic management apparatus, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

determine when an event has occurred, wherein the event is defined in a rule comprising one or more conditions and the event is associated with a key;

determine when data associated with a first network layer within network traffic satisfies at least one of the conditions in the rule;

associate the key to a connection associated with the network traffic that triggered the event, wherein the connection is associated with a second network layer within the network traffic that is different from the first network layer within the network traffic and the key comprises an input string value or corresponds to a portion of the data associated with the first network layer; and

monitor the connection to obtain statistics for the connection and store or report the statistics as associated with the key.

6. The network traffic management apparatus of claim 5, wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to store or report the statistics indexed based on one or more predefined entities, when the determining indicates that the event has not occurred or the data does not satisfy the at least one of the conditions.

7. The network traffic management apparatus of claim 5, wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to:

store the statistics associated with the key in a database;

receive a query comprising the key;

retrieve at least a portion of the statistics from the database using the key; and

output the at least a portion of the statistics in response to the received query.

8. The network traffic management apparatus of claim 5, wherein the first network layer is a transport layer, the connection is a transport control protocol (TCP) connection, the second network layer is an application layer, and the rule is event-driven and implemented according to a cross-layer messaging protocol.

9. A non-transitory computer readable medium having stored thereon instructions for facilitating network traffic analytics comprising executable code which when executed by one or more processors, causes the one or more processors to:

determine when an event has occurred, wherein the event is defined in a rule comprising one or more conditions and the event is associated with a key;

determine when data associated with a first network layer within network traffic satisfies at least one of the conditions in the rule;

associate the key to a connection associated with the network traffic that triggered the event, wherein the connection is associated with a second network layer within the network traffic that is different from the first network layer within the network traffic and the key comprises an input string value or corresponds to a portion of the data associated with the first network layer; and

monitor the connection to obtain statistics for the connection and store or report the statistics as associated with the key.

10. The non-transitory computer readable medium of claim 9, wherein the executable code when executed by the one or more processors further causes the one or more processors to store or report the statistics indexed based on one or more predefined entities, when the determining indicates that the event has not occurred or the data does not satisfy the at least one of the conditions.

11. The non-transitory computer readable medium of claim 9, wherein the executable code when executed by the one or more processors further causes the one or more processors to:

store the statistics associated with the key in a database;

receive a query comprising the key;

retrieve at least a portion of the statistics from the database using the key; and

output the at least a portion of the statistics in response to the received query.

12. The non-transitory computer readable medium of claim 9, wherein the first network layer is a transport layer, the connection is a transport control protocol (TCP) connection, the second network layer is an application layer, and the rule is event-driven and implemented according to a cross-layer messaging protocol.

13. A network traffic management system, comprising one or more traffic management apparatuses, client devices, administrator devices, or server devices, the network traffic management system comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

determine when an event has occurred, wherein the event is defined in a rule comprising one or more conditions and the event is associated with a key;

determine when data associated with a first network layer within network traffic satisfies at least one of the conditions in the rule;

associate the key to a connection associated with the network traffic that triggered the event, wherein the connection is associated with a second network layer within the network traffic that is different from the first network layer within the network traffic and the key comprises an input string value or corresponds to a portion of the data associated with the first network layer; and

monitor the connection to obtain statistics for the connection and store or report the statistics as associated with the key.

14. The network traffic management system of claim 13, wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to store or report the statistics indexed based on one or more predefined entities, when the determining indicates that the event has not occurred or the data does not satisfy the at least one of the conditions.

15. The network traffic management system of claim 13, wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to:

store the statistics associated with the key in a database;

receive a query comprising the key;

retrieve at least a portion of the statistics from the database using the key; and

output the at least a portion of the statistics in response to the received query.

16. The network traffic management system of claim 13, wherein the first network layer is a transport layer, the connection is a transport control protocol (TCP) connection, the second network layer is an application layer, and the rule is event-driven and implemented according to a cross-layer messaging protocol.