Late data detection in data center
First Claim
1. A method comprising:
- receiving, by a device from a first sensor at a first node, a first report comprising a network activity of which the first node was at least one of a source or a destination of the network activity and a first timestamp relative to a first clock of the first node;
receiving, by the device from a second sensor at a second node, a second report comprising the network activity of which the second node was a hop of the network activity and a second timestamp relative to a second clock of the second node;
determining, by the device, a first clock skew between a third clock of the device and the first clock of the first node based on the first timestamp and when the device received the first report from the first sensor at the first node and a second clock skew between the third clock and the second clock of the second node based on the second timestamp and when the device received the second report from the second sensor at the second node;
determining, by the device, a first communication latency associated with a first communication channel between the device and the first sensor and a second communication latency associated with a second communication channel between the device and the second sensor;
determining, by the device, a first adjusted timestamp of the first report based on the first communication latency and the first clock skew and a second adjusted timestamp of the second report based on the second communication latency and the second clock skew; and
generating, by the device, a timeline of the network activity by correlating the network activity in the first report and the network activity in the second report based on the first adjusted timestamp and the second adjusted timestamp.
1 Assignment
0 Petitions
Accused Products
Abstract
Systems, methods, and non-transitory computer-readable storage media for synchronizing timestamps of a sensor report to the clock of a device. In one embodiment, the device receives a report from a sensor of a node. The report can include a network activity of the node captured by the sensor and a first timestamp relative to the clock of the node. The device can then determine a second timestamp relative to the clock of the collector indicating receipt of the report by the device and from the sensor at the node. The device can also determine a delta between the first timestamp and the second timestamp, and a communication latency associated with a communication channel between the device and the sensor. Next, the device can adjust the delta based on the communication latency, and generate a third timestamp based on the adjusted delta.
623 Citations
17 Claims
-
1. A method comprising:
-
receiving, by a device from a first sensor at a first node, a first report comprising a network activity of which the first node was at least one of a source or a destination of the network activity and a first timestamp relative to a first clock of the first node; receiving, by the device from a second sensor at a second node, a second report comprising the network activity of which the second node was a hop of the network activity and a second timestamp relative to a second clock of the second node; determining, by the device, a first clock skew between a third clock of the device and the first clock of the first node based on the first timestamp and when the device received the first report from the first sensor at the first node and a second clock skew between the third clock and the second clock of the second node based on the second timestamp and when the device received the second report from the second sensor at the second node; determining, by the device, a first communication latency associated with a first communication channel between the device and the first sensor and a second communication latency associated with a second communication channel between the device and the second sensor; determining, by the device, a first adjusted timestamp of the first report based on the first communication latency and the first clock skew and a second adjusted timestamp of the second report based on the second communication latency and the second clock skew; and generating, by the device, a timeline of the network activity by correlating the network activity in the first report and the network activity in the second report based on the first adjusted timestamp and the second adjusted timestamp. - View Dependent Claims (2, 3, 4, 5)
-
-
6. A non-transitory computer-readable medium having instructions stored on the non-transitory computer-readable medium that, when executed, are effective to cause a computing device to:
-
receive, from a first sensor at a first node, a first report comprising a network activity of which the first node was at least one of a source or a destination of the network activity and a first timestamp relative to a first clock of the first node; receive, from a second sensor at a second node, a second report comprising the network activity of which the second node was a hop of the network activity and a second timestamp relative to a second clock of the second node; determine a first clock skew between a third clock of the computing device and the first clock of the first node based on the first timestamp and when the computing device received the first report from the first sensor at the first node and a second clock skew between the third clock and the second clock of the second node based on the second timestamp and when the computing device received the second report from the second sensor at the second node; determine a first communication latency associated with a first communication channel between the computing device and the first sensor and a second communication latency associated with a second communication channel between the computing device and the second sensor; determine a first adjusted timestamp of the first report based on the first communication latency and the first clock skew and a second adjusted timestamp of the second report based on the second communication latency and the second clock skew; and generate a timeline of the network activity by correlating the network activity in the first report and the network activity in the second report based on the first adjusted timestamp and the second adjusted timestamp. - View Dependent Claims (7, 8, 9, 10, 11)
-
-
12. A computing system comprising:
-
one or more processors; and a memory containing instructions that, when executed by the one or more processors, cause the computing system to; receive, from a first sensor at a first node, a first report comprising a network activity of which the first node was at least one of a source or a destination of the network activity and a first timestamp relative to a first clock of the first node; receive, from a second sensor at a second node, a second report comprising the network activity of which the second node was a hop of the network activity and a second timestamp relative to a second clock of the second node; determine a first clock skew between a third clock of the computing system and the first clock of the first node based on the first timestamp and when the computing system received the first report from the first sensor at the first node and a second clock skew between the third clock and the second clock of the second node based on the second timestamp and when the computing system received the second report from the second sensor at the second node; determine a first communication latency associated with a first communication channel between the computing system and the first sensor and a second communication latency associated with a second communication channel between the computing system and the second sensor; determine a first adjusted timestamp of the first report based on the first communication latency and the first clock skew and a second adjusted timestamp of the second report based on the second communication latency and the second clock skew; and generate a timeline of the network activity by correlating the network activity in the first report and the network activity in the second report based on the first adjusted timestamp and the second adjusted timestamp. - View Dependent Claims (13, 14, 15, 16, 17)
-
Specification