METHOD AND SYSTEM FOR MONITORING CONDITIONS IN A DYNAMIC NETWORK ENVIRONMENT

• US 20150120905A1
• Filed: 10/25/2013
• Published: 04/30/2015
• Est. Priority Date: 10/25/2013
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: PLUMgrid, Inc.
• Inventors: MONCLUS, PERE, LEOGRANDE, MARCO, NEMAT, AWAIS, Singh, Sushil
• Granted Patent: US 9,755,942 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method for monitoring network conditions by receiving a first condition definition describing a first network condition to be monitored in a network and an activation definition, determining a network topology of the network, and compiling the first condition definition to generate a first data plane component, a first control plane component, and an activation component. The method also includes deploying the first data plane component into a data plane of the network, where the data plane component captures and synthesizes a first stream of network events to generate a first modified stream of network events. The method also includes deploying the control plane component into a network operating system for the network. The control plane component receives and correlates the first modified stream of network events. The method also includes deploying an activation component that, upon receiving the correlated stream of events, initiates the activation definition.

Claims

1. A method for monitoring network conditions, the method comprising:

receiving a first condition definition describing a first network condition to be monitored in a network and an activation definition;

receiving a network topology definition indicating a location in the network to monitor for the first network condition;

compiling the first condition definition to generate a first data plane component, a first control plane component, and an activation component;

deploying the first data plane component into a data plane of the network, wherein the data plane component captures a first stream of network events as described in the first condition definition, and synthesizes the first stream of network events to generate a first modified stream of network events;

deploying the control plane component into a network operating system for the network, wherein the control plane component receives the first modified stream of network events and correlates the modified stream of events into a correlated stream of events;

deploying an activation component, wherein the activation component, upon receiving the correlated stream of events, initiates the activation definition.

2. The method of claim 1, wherein initiation of the activation definition comprises a visualization definition that presents the correlated stream of events in a visualization type defined by the visualization definition.

3. The method of claim 2, wherein the activation component modifies the visualization dynamically during operation of the network to reflect real-time changes in the network.

4. The method of claim 1, further comprising, during operation of the network:

determining, that the network topology of the network has been modified to a modified network topology;

in response to determining that the network topology has been modified;

recompiling the first condition definition to generate a first modified data plane component, a first modified control plane component, and a modified activation component;

replacing the first data plane component with the first modified data plane component;

replacing the first control plane component with a first modified control plane component; and

replacing the activation component with the first modified activation component.

5. The method of claim 1,

wherein the condition definition further comprises a trigger description that describes a user-defined executable instruction, and

wherein the activation component is further configured to:

determine that the network condition is met, and

in response to determining that the network condition is met, execute the user-defined instruction.

6. The method of claim 1, further comprising:

receiving a second condition definition indicating a second network condition to be monitored in the network during execution of the network;

synthesizing the first condition definition and the second condition definition to identify a redundant network condition;

generating a modified condition definition to include the first condition and the second condition definition using only a single instance of the redundant network condition;

compiling the modified condition definition to generate a first modified data plane component, a first modified control plane component, and a modified activation component;

replacing the first data plane component with the first modified data plane component;

replacing the first control plane component with a first modified control plane component; and

replacing the activation component with the first modified activation component.

7. The method of claim 2, further comprising:

receiving a modified activation definition during operation of the network; and

in response to receiving the modified activation definition;

generating a modified activation module to reflect the modified activation definition, and

deploying the modified activation module to replace the activation module, wherein the modified activation module generates a modified visualization in real time during operation of the network.

8. A system for monitoring network conditions, the system comprising:

a computer processor; and

a computer readable storage device, wherein the computer readable storage device comprises computer code which, when executed by the computer processor, causes the computer processor to;

receive a first condition definition describing a first network condition to be monitored in a network and an activation definition;

receive a network topology definition indicating a location in the network to monitor for the first network condition;

compile the first condition definition to generate a first data plane component, a first control plane component, and an activation component;

deploy the first data plane component into a data plane of the network, wherein the data plane component captures a first stream of network events as described in the first condition definition, and synthesizes the first stream of network events to generate a first modified stream of network events;

deploy the control plane component into a network operating system for the network, wherein the control plane component receives the first modified stream of network events and correlates the modified stream of events into a correlated stream of events; and

deploy an activation component, wherein the activation component, upon receiving the correlated stream of events, initiates the activation definition.

9. The system of claim 8, wherein initiation of the activation definition comprises a visualization definition that presents the correlated stream of events in a visualization type defined by the visualization definition.

10. The system of claim 9, wherein the activation component modifies the visualization dynamically during operation of the network to reflect real-time changes in the network.

11. The system of claim 8, wherein the computer readable storage device further comprises compute code which, when executed by the computer processor during operation of the network, causes the processor to:

determine, that the network topology of the network has been modified to a modified network topology;

in response to determining that the network topology has been modified;

recompile the first condition definition to generate a first modified data plane component, a first modified control plane component, and a modified activation component;

replace the first data plane component with the first modified data plane component;

replace the first control plane component with a first modified control plane component; and

replace the activation component with the first modified activation component.

12. The system of claim 8,

wherein the condition definition further comprises a trigger description that describes a user-defined executable instruction, and

wherein the activation component is further configured to:

determine that the network condition is met, and

in response to determining that the network condition is met, execute the user-defined instruction.

13. The system of claim 8, wherein the computer readable storage device further comprises compute code which, when executed by the computer processor during operation of the network, causes the processor to:

receive a second condition definition indicating a second network condition to be monitored in the network during execution of the network;

synthesize the first condition definition and the second condition definition to identify a redundant network condition;

generate a modified condition definition to include the first condition and the second condition definition using only a single instance of the redundant network condition;

compile the modified condition definition to generate a first modified data plane component, a first modified control plane component, and a modified activation component;

replace the first data plane component with the first modified data plane component;

replace the first control plane component with a first modified control plane component; and

replace the activation component with the first modified activation component.

14. The system of claim 8, the computer readable storage device further comprising compute code which, when executed by the computer processor during operation of the network, causes the processor to:

receive a modified activation definition during operation of the network; and

in response to receiving the modified activation definition;

generate a modified activation module to reflect the modified activation definition, and

deploy the modified activation module to replace the activation module, wherein the modified activation module generates a modified visualization in real time during operation of the network.

15. A computer program product for monitoring network conditions, the system comprising a computer readable storage device comprising computer code which, when executed by a computer processor, causes the computer processor to:

receive a first condition definition describing a first network condition to be monitored in a network and an activation definition;

receive a network topology definition indicating a location in the network to monitor for the first network condition;

compile the first condition definition to generate a first data plane component, a first control plane component, and an activation component;

deploy the first data plane component into a data plane of the network, wherein the data plane component captures a first stream of network events as described in the first condition definition, and synthesizes the first stream of network events to generate a first modified stream of network events;

deploy the control plane component into a network operating system for the network, wherein the control plane component receives the first modified stream of network events and correlates the modified stream of events into a correlated stream of events; and

deploy an activation component, wherein the activation component, upon receiving the correlated stream of events, initiates the activation definition.

16. The computer program product of claim 15, wherein initiation of the activation definition comprises a visualization definition that presents the correlated stream of events in a visualization type defined by the visualization definition.

17. The computer program product of claim 16, wherein the activation component modifies the visualization dynamically during operation of the network to reflect real-time changes in the network.

18. The computer program product of claim 15, wherein the computer readable storage device further comprises compute code which, when executed by the computer processor during operation of the network, causes the processor to:

determine, that the network topology of the network has been modified to a modified network topology;

in response to determining that the network topology has been modified;

recompile the first condition definition to generate a first modified data plane component, a first modified control plane component, and a modified activation component;

replace the first data plane component with the first modified data plane component;

replace the first control plane component with a first modified control plane component; and

replace the activation component with the first modified activation component.

19. The computer program product of claim 15, wherein the computer readable storage device further comprises compute code which, when executed by the computer processor during operation of the network, causes the processor to:

receive a second condition definition indicating a second network condition to be monitored in the network during execution of the network;

synthesize the first condition definition and the second condition definition to identify a redundant network condition;

generate a modified condition definition to include the first condition and the second condition definition using only a single instance of the redundant network condition;

compile the modified condition definition to generate a first modified data plane component, a first modified control plane component, and a modified activation component;

replace the first data plane component with the first modified data plane component;

replace the first control plane component with a first modified control plane component; and

replace the activation component with the first modified activation component.

20. The computer program product of claim 15, the computer readable storage device further comprising compute code which, when executed by the computer processor during operation of the network, causes the processor to:

receive a modified activation definition during operation of the network; and

in response to receiving the modified activation definition;

generate a modified activation module to reflect the modified activation definition, and

deploy the modified activation module to replace the activation module, wherein the modified activation module generates a modified visualization in real time during operation of the network.