Determining data flows in a network

• US 20070016670A1
• Filed: 06/22/2006
• Published: 01/18/2007
• Est. Priority Date: 06/24/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Cooper, Mark
• Granted Patent: US 8,898,265 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/12 Network monitoring probes

Abstract

Information about processes executing on a server together with network traffic and network state information such as ARP and routing tables is collected on each server in a network using a small piece of remote software running on the server. This information is sent to or gathered by a central collating and decoding program, which also obtains information from intervening network devices, such as routing tables, access control lists, load balancer maps and so on. This information is decoded to predict how the network traffic would look at all points in the network.

Claims

1. A system for determining data flows within a network configuration, the network configuration comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, each of the nodes having a plurality of processes executing thereon, the system comprising:

a plurality of remote agents for determining information about each of the plurality of nodes; and

a mapping engine for receiving the determined information from each of the remote agents, the mapping engine being configured to determine the data flows based on the information from the remote agents and configuration information relating to the network devices, wherein each of the remote agents is located at a respective one of the nodes and is arranged to obtain information about the processes executing on its respective node.

2. A system according to claim 1, wherein the mapping engine is configured to receive from the remote agents, information relating to the network device configuration information.

3. A system according to claim 1, wherein the mapping engine is configured to receive the network device configuration information other than from the remote agents.

4. A system according to claim 3, wherein the mapping engine receives the configuration information from one or more of periodic uploading of network configuration files into the mapping engine, polling a storage area for configuration files, querying of network devices, monitoring of network updates of the network devices and reception of update messages from the network devices.

5. A system according to claim 1, wherein the configuration information comprises information defining how a network device processes data arriving at the device.

6. A system according to claim 1, wherein the nodes comprise endnodes, said endnodes comprising respective servers on which a plurality of applications are executable, each of said applications giving rise to one or more processes.

7. A system according to claim 6, wherein the information from the remote agents comprises at least one of a list of processes currently executing on the respective servers and a list of processes communicating over the network configuration.

8. A system according to claim 7, wherein the information from the remote agents further comprises interface details for each interface supported by the respective servers.

9. A system according to claim 7, wherein the information from the remote agents further comprises routing information defining how data packets are routed from their respective servers to a destination.

10. A system according claim 7, wherein the information from the remote agents further comprises samples of network traffic.

11. A system according to claim 7, wherein the system is configured to link the determined data flows to one or more of the processes executing on a server.

12. A system according to claim 11, configured to link the determined data flows to an application executing on the server based on the processes started by the application.

13. A system according to claim 1, wherein the mapping engine is distributed throughout the network structure.

14. A method for determining data flows within a network configuration, the network configuration comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, the method comprising:

determining information about each of the plurality of nodes using a remote agent hosted at each node, the determined information comprising information about a plurality of processes executing on each of the plurality of nodes;

receiving the determined information from each of the remote agents at a mapping engine hosted on a further node, the mapping engine being configured to determine the data flows based on the information from the remote agents and configuration information relating to the network devices.

15. A method according to claim 14, wherein the mapping engine receives information relating to the network device configuration information from the remote agents.

16. A method according to claim 15, wherein the mapping engine is configured to receive the network device configuration information other than from the remote agents.

17. A method according to claim 16, further comprising comparing the information from the remote agents and the configuration information other than from the remote agents to indicate an error condition.

18. A method according to claim 14, further comprising linking the data flows to one or more processes executing on a node.

19. A method according to claim 14, further comprising displaying the data flows in real-time.

20. A distributed computer program product for determining data flows within a network structure, the network structure comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, the product comprising a mapping engine program executable on a first computer for receiving information from each of a plurality of remote agents, each of the plurality of remote agents comprising a remote agent program executable on a second computer remote from the first computer for determining information about the second computer, the mapping engine program being configured to determine the data flows based on the information from the remote agent programs and configuration information relating to the network devices, wherein each of the remote agent programs is arranged to obtain information about processes executing on a remote agent'"'"'s node.