METHOD FOR MONITORING TRAFFIC IN A NETWORK AND A NETWORK

• US 20120198062A1
• Filed: 10/09/2009
• Published: 08/02/2012
• Est. Priority Date: 10/09/2009
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Europe Ltd (NEC Corporation)
• Inventors: Niccolini, Saverio, Di Pietro, Andrea, Huici, Felipe
• Granted Patent: US 9,338,075 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/12 Network monitoring probes

Abstract

For providing a simple monitoring mechanism with reduced resource and performance requirements a method for monitoring traffic in a network is claimed, wherein a monitoring activity of at least two monitoring probes of the network is coordinated by a coordinating element, wherein at least two nodes of the network are able to operate as coordinating elements and wherein the responsibility for coordinating the monitoring activity of the monitoring probes is split between the nodes according to a compressed representation of flow parameter keys. Further, an according network is described, preferably for carrying out the above mentioned method.

Claims

1. A method for monitoring traffic in a network, wherein a monitoring activity of at least two monitoring probes of the network is coordinated by a coordinating means,

characterized in that at least two nodes of the network are able to operate as coordinating means and that the responsibility for coordinating the monitoring activity of the monitoring probes is splitted between the nodes according to a compressed representation of flow parameter keys.

2. A method according to claim 1, wherein the responsibility of monitoring a specific traffic flow is assigned to a single probe.

3. A method according to claim 1, wherein content based addressing is used within the network.

4. A method according to claim 1, wherein transparent handling of node failures and new node joins is used within the network.

5. A method according to claim 1, wherein the nodes belong to a peer-to-peer system.

6. A method according to claim 1, wherein the probes belong to a peer-to-peer system or to the same peer-to-peer system.

7. A method according to claim 5, wherein the probes are connected to the peer-to-peer system.

8. A method according to claim 1, wherein upon detection of a new flow at least one probe computes the hash value of one or more certain fields of the flow identifying the flow.

9. A method according to claim 8, wherein the hash is the flow 5-tuple consisting of IP source and destination addresses, protocol type, and source and destination ports.

10. A method according to claim 8, wherein after having computed the hash value, the probe performs a content-based lookup of the computed hash value for obtaining the address of the responsible node which will be responsible for coordinating the monitoring of the flow.

11. A method according to claim 10, wherein after having obtained the address of the responsible node, the probe sends a message to the responsible node including definable data types of the flow and/or a description of the flow.

12. A method according to claim 11, wherein the message is further comprising a report or data with regard to the state or availability of probe and/or monitoring resources.

13. A method according to claim 12, wherein the data are comprising available memory, bandwidth, CPU cycles, CPU utilization and/or a timestamp.

14. A method according to claim 11, wherein after having received the message from the probe or from more than one probe, the responsible node assigns the responsibility for monitoring the flow to a single suitable probe.

15. A method according to claim 14, wherein the decision for assignment by the responsible node is based on the report and/or data and/or on a local information and/or on a user-specified policy.

16. A method according to claim 11, wherein the message is comprising data types and/or a description of more than one detected flow.

17. A network, preferably for carrying out the method according to claim 1, wherein for monitoring traffic in the network a monitoring activity of at least two monitoring probes of the network is coordinated by a coordinating means,

characterized in that at least two nodes of the network are able to operate as coordinating means and that the responsibility for coordinating the monitoring activity of the monitoring probes is splitted between the nodes according to a compressed representation of flow parameter keys.

18. A method according to claim 2, wherein content based addressing is used within the network.

19. A method according to claim 9, wherein after having computed the hash value, the probe performs a content-based lookup of the computed hash value for obtaining the address of the responsible node which will be responsible for coordinating the monitoring of the flow.