TECHNIQUES FOR DETERMINING NETWORK ANOMALIES IN DATA CENTER NETWORKS
First Claim
1. A method comprising:
- monitoring, by a network monitoring device, a plurality of nodes in a data center network;
determining, by the network monitoring device, one or more latency distributions of response times for messages exchanged between pairs of nodes of the plurality of nodes;
determining a network topology for the plurality of nodes consistent with the one or more latency distributions, the network topology includes one or more communication links interconnecting nodes of the plurality of nodes and a relative position for each node of the plurality of nodes;
determining a representative response time for each communication link of the one or more communication links based on the one or more latency distributions;
comparing, by the network monitoring device, a current response time for at least one message exchanged between one pair of nodes to the representative response time for the communication link interconnecting the one pair of nodes; and
identifying, by the network monitoring device, a network anomaly when the current response time deviates from the representative response time for the communication link interconnecting the one pair of nodes by a threshold amount.
1 Assignment
0 Petitions
Accused Products
Abstract
A monitoring device/module monitors a plurality of nodes in a data center network, and determines one or more latency distributions of response times for messages exchanged between pairs of nodes of the plurality of nodes. The network monitoring device determines a network topology, including one or more communication links interconnecting nodes of the plurality of nodes, consistent with the one or more latency distributions. The network monitoring device also determines a representative response time for each communication link based on the one or more latency distributions, and compares a current response time a message exchanged between one pair of nodes to the representative response time for the communication link interconnecting the one pair of nodes. The network monitoring device identifies a network anomaly when the current response time deviates from the representative response time for the communication link interconnecting the one pair of nodes by a threshold amount.
-
Citations
20 Claims
-
1. A method comprising:
-
monitoring, by a network monitoring device, a plurality of nodes in a data center network; determining, by the network monitoring device, one or more latency distributions of response times for messages exchanged between pairs of nodes of the plurality of nodes; determining a network topology for the plurality of nodes consistent with the one or more latency distributions, the network topology includes one or more communication links interconnecting nodes of the plurality of nodes and a relative position for each node of the plurality of nodes; determining a representative response time for each communication link of the one or more communication links based on the one or more latency distributions; comparing, by the network monitoring device, a current response time for at least one message exchanged between one pair of nodes to the representative response time for the communication link interconnecting the one pair of nodes; and identifying, by the network monitoring device, a network anomaly when the current response time deviates from the representative response time for the communication link interconnecting the one pair of nodes by a threshold amount. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A monitoring device, comprising:
-
one or more network interfaces to communicate within a data center network; a processor coupled to the network interfaces and adapted to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to; monitor a plurality of nodes in a data center network; determine one or more latency distributions of response times for messages exchanged between pairs of nodes of the plurality of nodes; determine a network topology for the plurality of nodes consistent with the one or more latency distributions, the network topology includes one or more communication links interconnecting nodes of the plurality of nodes and a relative position for each node of the plurality of nodes; determine a representative response time for each communication link of the one or more communication links based on the one or more latency distributions; compare a current response time for at least one message exchanged between one pair of nodes to the representative response time for the communication link interconnecting the one pair of nodes; and identify a network anomaly when the current response time deviates from the representative response time for the communication link interconnecting the one pair of nodes by a threshold amount. - View Dependent Claims (12, 13, 14, 15, 16, 17)
-
-
18. A tangible, non-transitory, computer-readable media having software encoded thereon, the software, when executed by a processor, operable to:
-
monitor a plurality of nodes in a data center network; determine one or more latency distributions of response times for messages exchanged between pairs of nodes of the plurality of nodes; determine a network topology for the plurality of nodes consistent with the one or more latency distributions, the network topology includes one or more communication links interconnecting nodes of the plurality of nodes and a relative position for each node of the plurality of nodes; determine a representative response time for each communication link of the one or more communication links based on the one or more latency distributions; compare a current response time for at least one message exchanged between one pair of nodes to the representative response time for the communication link interconnecting the one pair of nodes; and identify a network anomaly when the current response time deviates from the representative response time for the communication link interconnecting the one pair of nodes by a threshold amount. - View Dependent Claims (19, 20)
-
Specification