FEDERATED MICROBURST DETECTION

• US 20180145906A1
• Filed: 11/22/2016
• Published: 05/24/2018
• Est. Priority Date: 11/22/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Yadav, Navindra, Attar, Mohammadreza Alizadeh, Gandham, Shashi, Singh, Abhishek, Chang, Shih-Chun
• Granted Patent: US 10,972,388 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/70 Routing based on monitoring results

Abstract

An example method includes a sensor detecting multiple packets of a flow during a specified total time period (e.g., a reporting time period). The total time period can be subdivided into multiple time periods. The sensor can analyze the detected packets to determine an amount of network utilization for each of the time periods. The sensor can then generate a flow summary based on the network utilization and the flow and send the flow summary to an analytics engine. Multiple other sensors can do similarly for their respective packets and flows. The analytics engine can receive the flow summaries from the various sensors and determine a correspondence between flow with high network utilization at a specific time period and a node or nodes. These nodes that experienced multiple flows with high network utilization for a certain period of time can be identified as experiencing a microburst.

Claims

1. A computer-implemented method comprising:

receiving, by a network device, within a specified total time period, a first set of packets associated with a first flow;

analyzing, by a sensor associated with the network device, the first set of packets to determine an amount of network utilization for each incremental time period of the specified total time period;

determining, by the sensor, a first incremental time period of the specified total time period associated with a maximum amount of network utilization; and

generating first flow summary data including an indication that the first incremental time period is associated with the maximum amount of network utilization and a first amount of network utilization associated with the first incremental time period.

2. The computer-implemented method of claim 1, further comprising:

receiving, by the network device, within the specified total time period, a second set of packets associated with a second flow;

analyzing, by the sensor, the second set of packets to determine an amount of network utilization for each incremental time period of the specified total time period;

determining, by the sensor, a second incremental time period of the specified total time period associated with a maximum amount of network utilization;

generating second flow summary data including an indication that the second incremental period is associated with the maximum amount of network utilization and a second amount of the network utilization associated with the second incremental period;

receiving the first flow summary data and the second flow summary data; and

determining that the first incremental time period and the second incremental period are a same time period.

3. The computer-implemented method of claim 2, further comprising:

determining an application dependency map; and

based on the application dependency map, determining a new route for the second flow so that the second flow does not pass through a same port of the network device or the network device.

4. The computer-implemented method of claim 1, further comprising:

determining that a first endpoint associated with the first flow and a second endpoint associated with the second flow are part of a same cluster based at least in part on one or more correspondences between the first flow and the second flow.

5. The computer-implemented method of claim 4, further comprising:

identifying a first process of the first endpoint; and

identifying a second process of the second endpoint,

wherein the one or more correspondences between the first flow and the second flow include the first process and the second process having at least one of a same process name, process argument, process identifier, parent process identifier, user name, or user identifier.

6. The computer-implemented method of claim 1, further comprising:

determining an application dependency map; and

determining, based on the application dependency map, the first flow summary data, the second flow summary a source endpoint associated with the first flow and the second flow.

7. The computer-implemented method of claim 1, wherein the sensor is implemented within an application-specific integrated circuit.

8. A non-transitory computer-readable medium comprising instructions that, when executed by a processor of a computing system, cause the computing system to:

receive, by a network device, within a specified total time period, a first set of packets associated with a first flow;

analyze, by a sensor associated with the network device, the first set of packets to determine an amount of network utilization for each incremental time period of the specified total time period;

determine, by the sensor, a first incremental time period of the specified total time period associated with a maximum amount of network utilization; and

generate first flow summary data including an indication that the first incremental time period is associated with the maximum amount of network utilization and a first amount of network utilization associated with the first incremental time period.

9. The non-transitory computer-readable medium of claim 8, wherein the instructions when executed further cause the computing system to:

receive, by the network device, within the specified total time period, a second set of packets associated with a second flow;

analyze, by the sensor, the second set of packets to determine an amount of network utilization for each incremental time period of the specified total time period;

determine, by the sensor, a second incremental time period of the specified total time period associated with a maximum amount of network utilization;

generate second flow summary data including an indication that the second incremental period is associated with the maximum amount of network utilization and a second amount of the network utilization associated with the second incremental period;

receive the first flow summary data and the second flow summary data; and

determine that the first incremental time period and the second incremental period are a same time period.

10. The non-transitory computer-readable medium of claim 9, wherein the instructions when executed further cause the computing system to:

determine an application dependency map; and

based on the application dependency map, determine a new route for the second flow so that the second flow does not pass through a same port of the network device or the network device.

11. The non-transitory computer-readable medium of claim 8, wherein the instructions when executed further cause the computing system to:

determine that the first network device and the second network device are part of a same cluster based at least in part on one or more correspondences between the first flow and the second flow.

12. The non-transitory computer-readable medium of claim 11, wherein the instructions when executed further cause the computing system to:

identify a first process of the first network device corresponding to the first flow; and

identify a second process of the second network device corresponding to the second flow,

wherein the one or more correspondences between the first flow and the second flow include the first process and the second process having at least one of a same process name, process argument, process identifier, parent process identifier, user name, or user identifier.

13. The non-transitory computer-readable medium of claim 8, wherein the instructions when executed further cause the computing system to:

determine an application dependency map; and

determine, based on the application dependency map and the flow summary, that a trigger network device caused at least part of the network utilization.

14. The non-transitory computer-readable medium of claim 8, wherein the first sensor is implemented within an application-specific integrated circuit.

15. A system comprising:

a processor; and

a memory device including instructions stored that, when executed by the processor, cause the system to;

receive, by a network device, within a specified total time period, a first set of packets associated with a first flow;

analyze, by a sensor associated with the network device, the first set of packets to determine an amount of network utilization for each incremental time period of the specified total time period;

determine, by the sensor, a first incremental time period of the specified total time period associated with a maximum amount of network utilization; and

generate first flow summary data including an indication that the first incremental time period is associated with the maximum amount of network utilization and a first amount of network utilization associated with the first incremental time period.

16. The system of claim 15, wherein the instructions, when executed by the processor, further cause the system to:

receive, by the network device, within the specified total time period, a second set of packets associated with a second flow;

analyze, by the sensor, the second set of packets to determine an amount of network utilization for each incremental time period of the specified total time period;

determine, by the sensor, a second incremental time period of the specified total time period associated with a maximum amount of network utilization;

generate second flow summary data including an indication that the second incremental period is associated with the maximum amount of network utilization and a second amount of the network utilization associated with the second incremental period;

receive the first flow summary data and the second flow summary data; and

determine that the first incremental time period and the second incremental period are a same time period.

17. The system of claim 16, wherein the instructions, when executed by the processor, further cause the system to:

determine an application dependency map; and

based on the application dependency map, determine a new route for the second flow so that the second flow does not pass through a same port of the network device or the network device.

18. The system of claim 15, wherein the instructions, when executed by the processor, further cause the system to:

determine that the first network device and the second network device are part of a same cluster based at least in part on one or more correspondences between the first flow and the second flow.

19. The system of claim 18, wherein the instructions, when executed by the processor, further cause the system to:

identify a first process of the first network device corresponding to the first flow; and

identify a second process of the second network device corresponding to the second flow,

wherein the one or more correspondences between the first flow and the second flow include the first process and the second process having at least one of a same process name, process argument, process identifier, parent process identifier, user name, or user identifier.

20. The system of claim 15, wherein the instructions, when executed by the processor, further cause the system to:

determine a first destination device of a first flow that corresponds to the maximum amount of network utilization;

determine a second destination device of a second flow that corresponds to the maximum amount of network utilization; and

determine that the first destination device and the second destination device are part of a same cluster based on the first flow and the second flow corresponding to the maximum amount of network utilization.