NETWORK TOPOLOGY

• US 20120023230A1
• Filed: 03/25/2010
• Published: 01/26/2012
• Est. Priority Date: 03/25/2009
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Hosking, Michael R., Beddus, Simon A., Bruce, Gary L.
• Granted Patent: US 8,935,386 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data

Abstract

A method of determining the topology of at least part of a network comprising the steps of: monitoring traffic to and/or from a plurality of computers in the network; storing information relating to the monitored traffic for each of the plurality of computers, the information including an identifier of a requested service; selecting a first computer of the plurality of computers; reading the stored information related to the first computer and identifying, using the stored identifier of the requested service, at least one traffic flow to or from the first computer that corresponds to the requested service; using the stored information to identify the destination or origin of the identified traffic flow for the first computer, which traffic flow information includes the identifier of the requested service; using the identified destination or origin to identify one or more computers that are immediately upstream or downstream of the first computer, and determining a topology based on the identified one or more upstream or downstream computers.

Claims

1. A method of determining the topology of at least part of a network comprising the steps of:

(a) either (i) monitoring traffic to, and/or from, a plurality of computers in the network, storing information relating to the monitored traffic for each of the plurality of computers, the information including an identifier of a requested service;

or

(ii) receiving and storing information relating to traffic to, and/or from, a plurality of computers in the network, for each of the plurality of computers on the network the information including an identifier of a requested service; and

(b) selecting a first computer of the plurality of computers;

(c) reading the stored information related to the first computer and identifying, using the stored identifier of the requested service, at least one traffic flow to or from the first computer that corresponds to the requested service;

(d) using the stored information to identify the destination or origin of the identified traffic flow for the first computer, which traffic flow information includes the identifier of the requested service;

(e) using the identified destination or origin to identify one or more computers that are immediately upstream or downstream of the first computer; and

(f) determining a topology based on the identified one or more upstream or downstream computers.

2. The method of claim 1, further including:

using the stored information to identify the destination and/or origin of traffic to and/or from the one or more, and preferably each of the, identified upstream or downstream computers, which traffic includes the identifier of the requested service; and

using the identified destination or origin to identify one or more computers that are immediately upstream of an identified upstream computer or downstream of an identified downstream computer.

3. The method of claim 1, further including:

determining the role of at least one of the plurality of computers based on the stored information by comparing the stored information relating to the traffic for one or more computers with at least one expected behaviour of traffic for a computer fulfilling a role.

4. The method of claim 3, wherein the first computer is a computer which has had its role determined by the step of determining the role of at least one of the plurality of computers.

5. The method of claim 3, wherein the stored information includes identifiers for a plurality of services, a plurality of traffic flows corresponding to the computer with determined role are identified, and the steps of using the stored information and identifying upstream and downstream computers are performed for more than one, and preferably each, of the plurality of traffic flows.

6. The method of claim 3, wherein the step of determining the role of at least one of the plurality of computers identifies a server by finding a computer with a terminating traffic flow that is not resent to another computer and/or comparing to the expected behaviour of a server as a computer with a terminating traffic flow that is not resent to another computer

7. The method of claim 3, wherein the role of two or more computers and preferably each of the plurality of computers is determined.

8. The method of claim 7, wherein the steps of reading the stored information, using the stored information and using the identified destination or origin performed for the first computer, are repeated for each computer determined to be a server.

9. The method of claim 1, wherein the first computer is a computer identified as a server.

10. The method of claim 1, wherein the stored information includes the source address and destination address of traffic.

11. The method of claim 10, wherein a traffic flow is defined as traffic with the same service identifier and wherein when it is incoming traffic it is traffic with the same source address and when it is outgoing traffic it is traffic with the same destination address.

12. The method of claim 10, wherein the next upstream or downstream computer is found by reading the destination or source address respectively of the traffic flow in the stored information and matching this to the address of one or more computers, preferably of the plurality of computers.

13. The method of claim 1, comprising the step of marking a first item of traffic or a first traffic flow, in the stored information, as corresponding to a second item of traffic or a second traffic flow, in the stored information, for one or more and preferably each of the plurality of computers, when the identifier of the first and second traffic items/flows are the same but the first item/flow of traffic is traffic to the computer to which the stored information relates and the second item/flow is traffic from the computer to which the stored information relates.

14. The method of claim 13, wherein whether the traffic is moving to or from the computer to which the stored information relates is assessed by reading the stored destination or source address and comparing to the address of the computer to which the stored information relates.

15. The method of claim 1, wherein the stored information includes the type of content of the traffic and the step of determining the topology is further based on the content type of traffic in the stored information.

16. A computer readable medium containing computer executable instructions which when run on a plurality of computers on a network causes the computers to perform the method of claim 1, or

which when run on a central processor in communication with a plurality of computers in a network which have been configured to perform the step of monitoring traffic to and/or from a plurality of computers in the network, and transmit information relating to the monitored traffic, the information including an identifier of a requested service, cause the central processor to perform when that method includes step (a)(ii).

17. Computer apparatus for determining the topology of at least part of a network, the apparatus comprising a processor, a memory and an input in communication with, or comprising, a plurality of computers in a network each of which have been configured to monitor traffic to and/or from one of the plurality of computers and to transmit information relating to the monitored traffic to the input, the information including an identifier of a requested service;

the computer apparatus configured to select a first computer of the plurality of computers, read the stored information related to the first computer and identify, using the stored identifier of the requested service, at least one traffic flow, to and/or from the first computer, that corresponds to the requested service;

use the stored information to identify the destination and/or origin of the identified traffic flow for the first computer, which traffic flow information includes the identifier of the requested service;

use the identified destination and/or origin to identify one or more computers that are immediately upstream and/or downstream of the first computer; and

determine a topology based on the identified one or more upstream and/or downstream computers.