Method and apparatus for discovering network topology

• US 5,886,643 A
• Filed: 09/17/1996
• Issued: 03/23/1999
• Est. Priority Date: 09/17/1996
• Status: Expired due to Term

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Concord Communications Incorporated (Broadcom, Inc.)
• Inventors: Wallace, Richard B., Engel, Ferdinand, Diebboll, Robert S.
• Primary Examiner(s): Zimmerman, Brian
• Assistant Examiner(s): WILSON JR, WILLIAM HALL
• Application Number:
  US08/715,186
• Time in Patent Office: 917 Days
• Field of Search: 340/825.08, 340/825.06, 340/825.17, 340/825.07, 395/284, 395/839, 395/800.01, 395/200.51, 395/200.54, 370/245, 370/248, 370/252, 370/254, 707/7, 1/1
• US Class Current: 709/224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 45/02 Topology update or discovery

Abstract

A method of processing data from a plurality of probes which monitor traffic over a network, which includes a plurality of segments to which are connected a plurality of nodes, the method including the steps of polling the probes for monitoring data; receiving polled data from the plurality of probes; storing the polled data in a plurality of records, each of the records identifying at least a probe, a source node, a destination node, and a measure of traffic between the identified source node and destination node in that record; for a selected source-destination node pair, determining which of the plurality of probes produced a most complete report of traffic associated with that selected source-destination node pair; identifying those records among the plurality of records that designate both the probe which produced the most complete report of traffic and the selected source-destination node pair; and distinguishing within the plurality of records the identified records from the other records.

Claims

1. A method of processing data from a plurality of probes which monitor traffic over a network, said network including a plurality of segments to which are connected a plurality of nodes, said method comprising:

polling said probes for monitoring data;

receiving polled data from the plurality of probes;

storing the polled data in a plurality of records, wherein each of said plurality of records identifies at least a probe, a source node, a destination node, and a measure of traffic between the identified source node and destination node in that record;

for a selected source-destination node pair, determining which of said plurality of probes produced a most complete report of traffic associated with that selected source-destination node pair;

identifying those records among said plurality of records that designate both the probe which produced the most complete report of traffic and the selected source-destination node pair; and

distinguishing within said plurality of records the identified records from the other records.

2. The method of claim 1 wherein the distinguishing step comprises tagging the identified records.

3. The method of claim 2 further comprising performing the determining step for each of a plurality of different source-destination node pairs.

4. The method of claim 3 further comprising generating a report about network activity by using only the tagged records.

5. The method of claim 2 further comprising identifying a plurality of different source-destination node pairs for which the plurality records have data and performing the determining step for each of said plurality of different source-destination node pairs.

6. The method of claim 2 wherein the step of determining comprises:

for each of said plurality of probes, aggregating the measure of traffic from all records which report traffic for the selected source-destination node pair to thereby generate a total measure of traffic; and

determining which one of said plurality of probes yields a highest total measure of traffic, wherein the probe that yields a highest total measure of traffic is the probe that produced the most complete report of traffic.

7. A method of processing data from a plurality of probes which monitor traffic over a network, said network including a plurality of segments to which are connected a plurality of nodes, said method comprising:

polling said probes for monitoring data;

receiving polled data from the plurality of probes;

storing the polled data in a plurality of records, wherein each of said plurality of records identifies at least a probe, a source node, a destination node, and a measure of traffic between the identified source node and destination node in that record;

for a selected one of said plurality of nodes, determining which one of said plurality of probes produced a highest total measure of traffic associated with that selected node;

forming a list for the identified probe; and

adding the selected node to that list.

8. The method of claim 7 further comprising performing the determining, forming, and adding steps for other nodes of said plurality of nodes to thereby generate a plurality of lists, each associated with a different one of said probes.

9. The method of claim 8 further comprising performing the determining, forming, and adding steps for all nodes of said plurality of nodes.

10. The method of claim 8 further comprising using information stored in said plurality of lists to generate a report about network activity.

11. A method of generating a view of a network from monitoring data collected from a plurality of probes which monitored traffic over the network, said network including a plurality of segments to which are connected a plurality of nodes, wherein said view is generated from data that was collected from said probes and is stored in a plurality of records, each of which identifies at least a probe, a source node, a destination node, and a measure of traffic between the identified source node and destination node in that record, said method comprising:

for a selected one of said plurality of nodes, determining which one of said plurality of probes produced a highest total measure of traffic associated with that selected node; and

forming a list for the identified probe and adding the selected node to that list.