Method and apparatus for generating a network topology representation based on inspection of application messages at a network device

• US 20060123477A1
• Filed: 03/24/2005
• Published: 06/08/2006
• Est. Priority Date: 12/06/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Oleson, Parley Van, Cho, Stephen, Potti, Sunil, De Datta, Raj, Raghavan, Kollivakkam, Anthias, Tefcros
• Granted Patent: US 7,996,556 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion

Abstract

A method is disclosed for generating a network topology representation based on inspection of application messages at a network device. According to one aspect, a network device receives a request packet, routes the packet to the destination, and extracts and stores correlation information from a copy of the request packet. When the network device receives a response packet, it examines the contents of a copy of the response packet using context-based correlation rules and matches the response packet with the appropriate stored request packet correlation information. It analyzes recorded correlation information to determine application-to-application mapping and calculate application response times. Another embodiment inserts custom headers that contain information used to match a response packet with a request packet into request packets.

Claims

1. A method of generating a network topology representation based on inspection of application messages at a network device, the method comprising the computer-implemented steps of:

receiving a request packet at the network device;

associating correlation information for a message in the request packet at the network device;

storing the request packet correlation information; and

routing the request packet to the appropriate destination.

2. A method as recited in claim 1, further comprising:

receiving a response packet at the network device;

correlating the response packet correlation information with stored request packet correlation information;

collecting information from the response message with the correlated stored request message correlation information; and

routing the response packet to the appropriate destination

3. A method as recited in claim 2, further comprising:

analyzing recorded correlation information;

wherein the analyzing step determines application-to-application mapping; and

wherein the analyzing step calculates application response times and/or any other relevant metric.

4. A method as recited in claim 3, wherein the application-to-application mapping information and the calculated response times and/or other metrics are published to outside applications.

5. A method as recited in claim 3, further comprising:

reporting an alarm if a given metric violates a predetermined threshold level.

6. A method as recited in claim 2, wherein the correlating step uses content-based correlation rules to correlate application interactions.

7. A method as recited in claim 2, wherein a sliding window is implemented where stored correlation information that falls outside of the sliding window is discarded.

8. A method as recited in claim 1, further comprising:

reporting an alarm if a response packet is not received for a request packet and/or violates a predetermined metric.

9-16. -16. (canceled)

17. A computer-readable medium carrying one or more sequences of instructions for generating a network topology representation based on inspection of application messages at a network device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving a request packet at the network device;

associating correlation information for a message in the request packet at the network device;

storing the request packet correlation information; and

routing the request packet to the appropriate destination.

18. A computer-readable medium as recited in claim 17, further comprising:

receiving a response packet at the network device;

correlating the response packet correlation information with stored request packet correlation information;

collecting information from the response packet message with the correlated stored request packet message correlation information; and

routing the response packet to the appropriate destination.

19. A computer-readable medium as recited in claim 18, further comprising:

analyzing recorded correlation information;

wherein the analyzing step determines application-to-application mapping; and

wherein the analyzing step calculates application response times and/or any other relevant metric.

20. A computer-readable medium as recited in claim 19, wherein the application-to-application mapping information and the calculated response times and/or any other relevant metric are published to outside applications.

21. A computer-readable medium as recited in claim 19, further comprising:

reporting an alarm if a given metric violates a predetermined threshold level.

22. A computer-readable medium as recited in claim 18, wherein the correlating step uses content-based correlation rules to correlate application interactions.

23. A computer-readable medium as recited in claim 18, wherein a sliding window is implemented where stored correlation information that falls outside of the sliding window is discarded.

24. A computer-readable medium as recited in claim 17, further comprising:

reporting an alarm if a response packet is not received for a request packet and/or violates a predetermined metric.

25-32. -32. (canceled)

33. An apparatus for generating a network topology representation based on inspection of application messages at a network device, comprising:

means for receiving a request packet at the network device;

means for associating correlation information for a message in the request packet at the network device;

means for storing the request packet correlation information; and

means for routing the request packet to the appropriate destination.

34. An apparatus as recited in claim 33, further comprising:

means for receiving a response packet at the network device;

means for correlating the response packet correlation information with stored request packet correlation information;

means for collecting information from the response packet message with the correlated stored request packet message correlation information; and

means for routing the response packet to the appropriate destination.

35. An apparatus as recited in claim 34, further comprising:

means for analyzing recorded correlation information;

wherein the analyzing means determines application-to-application mapping; and

wherein the analyzing means calculates application response times and/or any other relevant metric.

36. An apparatus as recited in claim 35, wherein the application-to-application mapping information and the calculated response times and/or any other relevant metric are published to outside applications.

37. An apparatus as recited in claim 35, further comprising:

means for reporting an alarm if a given metric violates a predetermined threshold level.

38. An apparatus as recited in claim 34, wherein the correlating means uses content-based correlation rules to correlate application interactions.

39. An apparatus as recited in claim 34, wherein a sliding window is implemented where stored correlation information that falls outside of the sliding window is discarded.

40. An apparatus as recited in claim 33, further comprising:

means for reporting an alarm if a response packet is not received for a request packet and/or violates a predetermined metric.

41-48. -48. (canceled)