Generic discovery for computer networks

• US 10,523,543 B2
• Filed: 03/29/2018
• Issued: 12/31/2019
• Est. Priority Date: 12/06/2004
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Spinelli, Lionel, Chabrier, Jean-Claude, Germain, Pierre
• Primary Examiner(s): Chou, Alan S
• Application Number:
  US15/940,121
• Publication Number:
  US 20180219756A1
• Time in Patent Office: 642 Days
• Field of Search: 709228, 709224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A generic discovery methodology collects data pertaining to components of a computer network using various discovery technologies. From the collected data, the methodology identifies, filters and analyzes information related to inter-component communications. Using the communication and application information, the methodology determines reliable relationships for those components having sufficient information available. To qualify more components, the methodology implements a decision service to generate hypothetical relationships between components that are known and components that are unqualified or unknown. The hypothetical relationships are presented to a user for selection, and each hypothetical relationship is preferably associated with an indication of its reliability.

Claims

1. A component discovery method for identifying components undiscoverable by or unresponsive to active scanning or querying, the method comprising:

intercepting data communications occurring between components in a computer network;

identifying a subset of the intercepted data communications as important based on communication ports used in the data communications;

analyzing the important data communications to determine a quantity of the important data communications established by a first component; and

generating a hypothesis indicating the first component is a server host when the quantity meets a threshold.

2. The method of claim 1, further comprising:

determining, using the intercepted data communications, a second component that communicates with the first component more than a predetermined quantity of times;

identifying a first application installed on the second component;

determining which communication ports are used in communications between the first component and the second component; and

generating a second hypothesis about a second application installed on the first component, the second hypothesis based on the communication ports used in the data communications between the first component and the second component and based on the second application.

3. The method of claim 1, further comprising:

generating a second hypothesis indicating an operational relationship between the first component and a second component, the second hypothesis based on a first application installed on the second component and the communication ports used by the important data communications;

generating a third hypothesis indicating an operational relationship between the first component and the second component based on the first application and the communication ports used by the important data communications; and

enabling a user to select a relationship from the second hypothesis and the third hypothesis.

4. The method of claim 1, further comprising storing the important data communications in a memory device, the analyzing using the stored data communications.

5. The method of claim 1, wherein the important data communications include communications using predetermined communication ports.

6. The method of claim 1, wherein communications using predetermined communication ports are excluded from the important data communications.

7. The method of claim 1, further comprising:

intercepting data communications occurring between applications on the first component;

identifying a first application by determining that at least some of the intercepted data communications occurring between applications occur on predetermined communication ports between the first application and a second application, and

generating a second hypothesis about the first application on the first component based on the second application and the communication ports used in the data communications between the first application and the second application.

8. The method of claim 1, further comprising:

intercepting data communications occurring between applications on the first component; and

generating a second hypothesis indicating an operational relationship between the first application and the second application based on analyzing the data communications occurring between a first application and a second application to determine communication port ranges used.

9. The method of claim 1, further comprising:

identifying at least a first application on the first component by analyzing the important data communications occurring between the first component and a second component; and

generating a second hypothesis of an operational relationship between the first component and the second component based on the first application and the communication ports used by the important data communications.

10. The method of claim 9, wherein analyzing the important data communications includes:

determining listening ports used in the important communications;

determining open port ranges used in the important communications;

determining client ports used in the important communications; and

determining communication ports of the first component used to communicate with port ranges of the second component.

11. The method of claim 9, wherein analyzing the important data communications includes determining a network address of the first component and a network address of the second component.

12. The method of claim 1, further comprising building a model of an infrastructure of the computer network using the hypothesis.

13. A network discovery system for identifying network components undiscoverable by or unresponsive to active scanning or querying, the network discovery system comprising:

a communication network;

a plurality of components operatively coupled to the communication network, the plurality of components including at least a first component;

a computing device having at least one programmable control device and a storage device operatively coupled to the programmable control device, the storage device having stored therein instructions that, when executed by the programmable control device, cause the computing device to;

intercept data communications occurring between the plurality of components in the communication network,

identify a subset of the intercepted data communications as important based on communication ports used in the data communications,

analyze the important data communications to determine a quantity of the important data communications involving the first component, and

generate a hypothesis that the first component is a server host when the quantity meets a threshold.

14. The network discovery system of claim 13, wherein the instructions further include instructions that, when executed by the programmable control device, cause the computing device to:

determine, using the intercepted data communications, a second component that communicates with the first component more than a predetermined quantity of times;

identify a first application installed on the second component;

determine which communication ports are used in communications between the first component and the second component; and

generate a second hypothesis about a second application installed on the first component based on the communication ports used and the second application.

15. The network discovery system of claim 13, wherein the instructions further include instructions that, when executed by the programmable control device, cause the computing device to store the important data communications in a memory device, the identifying and analyzing using the stored data communications.

16. The network discovery system of claim 13, wherein the important data communications include communications using predetermined communication ports.

17. The network discovery system of claim 13, wherein the hypothesis is a first hypothesis and the instructions further include instructions that, when executed by the programmable control device, cause the computing device to:

intercept data communications occurring between applications installed on the first component;

generate a second hypothesis about an operational relationship between the first application and the second application based on analyzing the data communications occurring between a first application and a second application to determine communication port ranges used.

18. The network discovery system of claim 17, further comprising building a model of an infrastructure of the communication network using the first hypothesis and the second hypothesis.

19. The network discovery system of claim 13, wherein the instructions further include instructions that, when executed by the programmable control device, cause the computing device to:

identify at least a first application installed on the first component by analyzing the important data communications occurring between the first component and a second component; and

generate a second hypothesis of an operational relationship between the first component and the second component based on the first application and the communication ports used by the important data communications.

20. The network discovery system of claim 19, wherein analyzing the important data communications includes:

determining listening ports used in the important communications;

determining open port ranges used in the important communications;

determining client ports used in the important communications; and

determining communication ports of the first component used to communicate with port ranges of the second component.