DYNAMIC COLLECTION OF NETWORK METRICS FOR PREDICTIVE ANALYTICS

• US 20150333992A1
• Filed: 05/13/2014
• Published: 11/19/2015
• Est. Priority Date: 05/13/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Vasseur, Jean-Philippe, Dasgupta, Sukrit
• Granted Patent: US 9,654,361 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/149 for prediction of maintenance
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/02 Capturing of monitoring data
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

In one embodiment, data is received at a device regarding a network-monitoring process in which one or more nodes in a network export network metrics to one or more collector nodes. A change to the network-monitoring process is determined based on the received data. The device also adjusts the network-monitoring process to implement the determined change.

Claims

1. A method, comprising:

receiving, at a device, data regarding a network-monitoring process in which one or more nodes in a network export network metrics to one or more collector nodes;

determining a change to the network-monitoring process based on the received data; and

adjusting, by the device, the network-monitoring process to implement the determined change.

2. The method as in claim 1, wherein determining the change to the network-monitoring process comprises:

determining that the network-monitoring process has an adverse effect on the network based on the received data.

3. The method as in claim 2, wherein adjusting the network-monitoring process further comprises:

instructing a particular node to stop exporting network metrics.

4. The method as in claim 2, wherein adjusting the network-monitoring process further comprises:

instructing a particular node to export fewer network metrics.

5. The method as in claim 2, wherein adjusting the network-monitoring process further comprises:

instructing a particular node to export network metrics less frequently.

6. The method as in claim 2, wherein adjusting the network-monitoring process further comprises:

instructing a particular node to aggregate metrics prior to exporting the aggregated metrics.

7. The method as in claim 2, wherein adjusting the network-monitoring process further comprises:

instructing a particular node to stop collecting network metrics.

8. The method as in claim 2, wherein the adverse effect corresponds to at least one of:

increased traffic along a particular network link, redundant collection of network metrics from two or more nodes, or a decrease in performance for a particular application.

9. The method as in claim 1, further comprising:

detecting a traffic pattern anomaly in the network;

identifying one or more metrics regarding the anomaly to monitor; and

instructing a particular node to export the one or more metrics.

10. The method as in claim 9, wherein the traffic pattern anomaly corresponds to a change in at least one of:

an average utilization of a path, a number of active applications, a rate of new traffic flows, or a duration of a traffic flow.

11. The method as in claim 9, wherein the one or more metrics regarding the anomaly are identified based on a mapping between network anomalies and metrics to monitor.

12. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

receive data regarding a network-monitoring process in which one or more nodes in the network export network metrics to one or more collector nodes;

determine a change to the network-monitoring process based on the received data; and

adjust the network-monitoring process to implement the determined change.

13. The apparatus as in claim 12, wherein the process when executed is further operable to:

determine that the network-monitoring process has an adverse effect on the network based on the received data.

14. The apparatus as in claim 13, wherein the process when executed is further operable to:

instruct a particular node to stop exporting network metrics.

15. The apparatus as in claim 13, wherein the process when executed is further operable to:

instruct a particular node to export fewer network metrics.

16. The apparatus as in claim 13, wherein the process when executed is further operable to:

instruct a particular node to export network metrics less frequently.

17. The apparatus as in claim 13, wherein the process when executed is further operable to:

instruct a particular node to aggregate metrics prior to exporting the aggregated metrics.

18. The apparatus as in claim 13, wherein the process when executed is further operable to:

instruct a particular node to stop collecting network metrics.

19. The apparatus as in claim 13, wherein the adverse effect corresponds to at least one of:

increased traffic along a particular network link, redundant collection of network metrics from two or more nodes, or a decrease in performance for a particular application.

20. The apparatus as in claim 12, wherein the process when executed is further operable to:

detect a traffic pattern anomaly in the network;

identify one or more metrics regarding the anomaly to monitor; and

instruct a particular node to export the one or more metrics.

21. The apparatus as in claim 20, wherein the traffic pattern anomaly corresponds to a change in at least one of:

an average utilization of a path, a number of active applications, a rate of new traffic flows, or a duration of a traffic flow.

22. The apparatus as in claim 20, wherein the one or more metrics regarding the anomaly are identified based on a mapping between network anomalies and metrics to monitor.

23. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:

receive data regarding a network-monitoring process in which one or more nodes in a network export network metrics to one or more collector nodes;

determine a change to the network-monitoring process based on the received data; and

adjust the network-monitoring process to implement the determined change.