Distributed network management

• US 20070058631A1
• Filed: 08/12/2005
• Published: 03/15/2007
• Est. Priority Date: 08/12/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mortier, Richard, Isaacs, Rebecca, Barham, Paul
• Granted Patent: US 8,077,718 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/042 comprising distributed management centres cooperatively managing the network
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/44 Distributed routing

Abstract

Hosts or end-systems residing at the edges of a network gather data about the traffic they transmit into and receive from the network. The network'"'"'s routing protocol (typically a link-state protocol such as OSPF) is monitored and routing data or packets are used to recover the network'"'"'s current status and topology. This data can be collected, fused, and maintained and a platform, preferably distributed, can be provided to query the data, thus enabling a variety of network management applications.

Claims

1. A method of providing information for managing an autonomous IP network, the method comprising:

providing access to flow information that associates host identities with information about instances of communication between the identified hosts over the IP network, where the flow information is captured by the hosts as the communication occurs, and where the hosts are on the edge of the IP network and are not routers;

providing access to information describing the topology of the IP network, where the information about the topology is based on or comprises routing information collected from routers that route traffic on the network; and

answering queries about the network by using both the collected routes and the collected flows.

2. A method according to claim 1, wherein answers to some queries comprise information about flow along routing paths within the network.

3. A method according to claim 1, further comprising distributing the flow information to different hosts on the network and answering queries in a distributed manner using those different hosts.

4. A method according to claim 1, wherein the routing information collected from the routers comprises link state advertisements transmitted between the routers.

5. A method according to claim 1, wherein the flow information comprises indicia of hosts that are sources and/or destinations of corresponding flows and application-level information corresponding to the flows.

6. A method according to claim 1, further comprising using an answer to a query to automatically reconfigure one or more routers of the network.

7. A method of providing information about a network, the method comprising:

receiving a query and answering the query by searching flow data self-captured by end-systems as they communicate over the network and by using topology information describing the topology of the network, where the topology information comprises routing information captured from routers in the network or information derived therefrom.

8. A method according to claim 7, wherein the query is received by an end-system that forwards the query to other end-systems that then answer the query.

9. A method according to claim 8, wherein end-system uses the topology information to determine which of the other end-systems to forward the query to.

10. A method according to claim 7, wherein the query requests information for a particular application, or for a particular port number, or for a particular application-level protocol.

11. A method according to claim 7, further comprising passing the query to a distributed database, comprised of end-systems, that stores the flow data and that performs the query in distributed fashion.

12. A method according to claim 11, wherein the routing information comprises information derived from link state routing packets received by a router configured to collect the routing information and provide it to the distributed database.

13. A method according to claim 7, wherein an end-system produces flow data by receiving packets from the network and recording information about the packets.

14. A method according to claim 13, wherein the sending or receiving of a packet updates the flow data at the end-system.

15. A method according to claim 7, wherein the query comprises a request for information about traffic on a link in the network, wherein the information comprises routes on the network, and the query is answered by searching for flow data determined to have flowed along those of the routes that include the link.

16. A system for collecting and providing information about an IP network, the system comprising:

a plurality of end-system computers configured to capture flow records comprising information about flows of which respective end-system computers are a source or destination on the IP network;

a collector configured to collect routing information from a network of routing devices, the routing information providing information about the topology of the IP network; and

a query system comprising one or more end-system computers on the IP network and servicing queries about the IP network by matching routes through the IP network with the captured flow records, where the one or more end-system computers do or do not self-capture flow records, and where the routes comprise or are derived from the collected routing information.

17. A system according to claim 16, wherein applications on end-systems submit to the query system queries relating to their own behavior on the network and adapt their own behavior according to network conditions indicated by answers to the queries.

18. A system according to claim 16, where an end-system is configured to generate flow information about a particular sub-component or particular behavior of an application and queries can be posed about the performance of the sub-component or behavior.

19. A system according to claim 18, wherein the system is configured to model hypothetical scenarios in real time using repeated queries about the particular sub-component or particular behavior.

20. A system according to claim 16, wherein the query system services queries by also using network flow information obtained from a network flow monitor running on a router.