Enterprise network analyzer architecture framework

• US 6,754,705 B2
• Filed: 12/21/2001
• Issued: 06/22/2004
• Est. Priority Date: 12/21/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Joiner, Herbert V., Elwell, Ken W.
• Primary Examiner(s): EL HADY, NABIL M
• Application Number:
  US10/029,675
• Publication Number:
  US 20030140137A1
• Time in Patent Office: 914 Days
• Field of Search: 709/223, 709/224, 709/226, 709/230, 709/244
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A system and associated method and computer program product are provided for analyzing a network. Included is a plurality of agents coupled to a plurality of computers interconnected via a network. Each agent is adapted to collect information relating to at least one of the computers. Further provided is a plurality of host controllers coupled to the agents for collecting the information from the agents. Still yet, a plurality of zone controllers is coupled to the host controllers for collecting the information from the host controllers.

Claims

1. A system for analyzing a network, comprising:

(a) a plurality of agents coupled to a plurality of computers interconnected via a network, each agent adapted to collect information relating to at least one of the computers;

(b) a plurality of host controllers coupled to the agents for collecting the information from the agents; and

(c) a plurality of zone controllers coupled to the host controllers for collecting the information from the host controllers;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

2. The system as recited in claim 1, wherein each agent is adapted to collect the information relating to at least one of the computers for a first time interval.

3. The system as recited in claim 2, wherein the agents receive an indication of the first time interval from the host controllers.

4. The system as recited in claim 3, wherein the agents collect the information in response to a demand received from the host controllers.

5. The system as recited in claim 2, wherein the host controllers are adapted for collecting the information from the agents for a second time interval greater than the first time interval.

6. The system as recited in claim 5, wherein the zone controllers are adapted for collecting the information from the host controllers at intervals.

7. The system as recited in claim 2, wherein the host controllers receive an indication of the first time interval from the zone controllers.

8. The system as recited in claim 1, wherein the agents communicate with the host controllers utilizing a layer three protocol.

9. The system as recited in claim 1, wherein the agents are less than 1 MB in size.

10. The system as recited in claim 1, wherein the host controllers are adapted for generating a map based on the information.

11. The system as recited in claim 10, wherein the zone controllers are adapted for receiving the map from the host controllers.

12. The system as recited in claim 11, wherein the zone controllers are adapted for reporting on computers included in an associated zone based on the information and the map from the host controllers.

13. The system as recited in claim 1, wherein the host controllers communicate with the zone controllers utilizing an encrypted layer three protocol.

14. The system as recited in claim 1, wherein the information relates to wireless network traffic.

15. A method for analyzing a network, comprising:

(a) collecting information relating to a plurality of computers utilizing a plurality of agents coupled to the computers via a network;

(b) collecting the information from the agents utilizing a plurality of host controllers coupled to the agents; and

(c) collecting the information from the host controllers utilizing a plurality of zone controllers coupled to the host controllers;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

16. The method as recited in claim 15, wherein each agent is adapted to collect the information relating to at least one of the computers for a first time interval.

17. The method as recited in claim 16, wherein the agents receive an indication of the first time interval from the host controllers.

18. The method as recited in claim 17, wherein the agents collect the information in response to a demand received from the host controllers.

19. The method as recited in claim 16, wherein the host controllers are adapted for collecting the information from the agents for a second time interval greater than the first time interval.

20. The method as recited in claim 19, wherein the zone controllers are adapted for collecting the information from the host controllers at intervals.

21. The method as recited in claim 16, wherein the host controllers receive an indication of the first time interval from the zone controllers.

22. The method as recited in claim 15, wherein the agents communicate with the host controllers utilizing a layer three protocol.

23. The method as recited in claim 15, wherein the agents are less than 1 MB in size.

24. The method as recited in claim 15, wherein the host controllers are adapted for generating a map based on the information.

25. The method as recited in claim 24, wherein the zone controllers are adapted for receiving the map from the host controllers.

26. The method as recited in claim 25, wherein the zone controllers are adapted for reporting on computers included in an associated zone based on the information and the map from the host controllers.

27. The method as recited in claim 15, wherein the host controllers communicate with the zone controllers utilizing an encrypted layer three protocol.

28. A computer program product for analyzing a network, comprising:

(a) computer code for collecting information relating to a plurality of computers utilizing a plurality of agents coupled to the computers via a network;

(b) computer code for collecting the information from the agents utilizing a plurality of host controllers coupled to the agents; and

(c) computer code for collecting the information from the host controllers utilizing a plurality of zone controllers coupled to the host controllers;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

29. The computer program product as recited in claim 28, wherein each agent is adapted to collect the information relating to at least one of the computers for a first time interval.

30. The computer program product as recited in claim 29, wherein the agents receive an indication of the first time interval from the host controllers.

31. The computer program product as recited in claim 30, wherein the agents collect the information in response to a demand received from the host controllers.

32. The computer program product as recited in claim 29, wherein the host controllers are adapted for collecting the information from the agents for a second time interval greater than the first time interval.

33. The computer program product as recited in claim 29, wherein the host controllers receive an indication of the first time interval from the zone controllers.

34. The computer program product as recited in claim 33, wherein the zone controllers are adapted for collecting the information from the host controllers at intervals.

35. The computer program product as recited in claim 28, wherein the agents communicate with the host controllers utilizing a layer three protocol.

36. The computer program product as recited in claim 28, wherein the agents are less than 1 MB in size.

37. The computer program product as recited in claim 28, wherein the host controllers are adapted for generating a map based on the information.

38. The computer program product as recited in claim 37, wherein the zone controllers are adapted for receiving the map from the host controllers.

39. The computer program product as recited in claim 38, wherein the zone controllers are adapted for reporting on computers included in an associated zone based on the information and the map from the host controllers.

40. The computer program product as recited in claim 28, wherein the host controllers communicate with the zone controllers utilizing an encrypted layer three protocol.

41. A system for analyzing a network, comprising:

(a) logic for collecting information relating to a plurality of computers utilizing a plurality of agents coupled to the computers via a network;

(b) logic for collecting the information from the agents utilizing a plurality of host controllers coupled to the agents; and

(c) logic for collecting the information from the host controllers utilizing a plurality of zone controllers coupled to the host controllers;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

42. A system for analyzing a network, comprising:

(a) agent means coupled to a plurality of computers interconnected via a network, the agent means adapted to collect information relating to at least one of the computers;

(b) host controller means for collecting the information from the agent means; and

(c) zone controller means for collecting the information from the host controller means;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

43. A system for analyzing a network, comprising:

(a) a plurality of agents coupled to a plurality of computers interconnected via a network, each agent adapted to collect information relating to at least one of the computers for a first time interval;

(b) a plurality of host controllers coupled to the agents for collecting the information from the agents for a second time interval greater than the first time interval; and

(c) a plurality of zone controllers coupled to the host controllers for collecting the information from the host controllers at intervals;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

44. A system for analyzing a network, comprising:

a plurality of information collectors coupled to a plurality of computers interconnected via a network, each information collector adapted to collect information relating to at least one of the computers;

at least one information collector manager coupled to the information collectors for collecting the information from the information collectors and managing the information collectors; and

a plurality of consoles coupled to the information collector manager for collecting the information from the information collector manager and displaying the information from the information collector manager;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

45. A method for analyzing a network, comprising:

collecting information relating to a plurality of computers utilizing a plurality of information collectors coupled to the computers via a network;

collecting the information from the information collectors and managing the information collectors, utilizing at least one information collector manager coupled to the information collectors; and

collecting the information from the information collector manager and displaying the information from the information collector manager, utilizing a plurality of consoles coupled to the information collector manager;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

46. The method as recited in claim 45, wherein the information relates to wireless network traffic.

47. A computer program product for analyzing a network, comprising:

computer code for collecting information relating to a plurality of computers utilizing a plurality of information collectors coupled to the computers via a network;

computer code for collecting the information from the information collectors and managing the information collectors, utilizing at least one information collector manager coupled to the information collectors; and

computer code for collecting the information from the information collector manager and displaying the information from the information collector manager, utilizing a plurality of consoles coupled to the information collector managers;

wherein a report is generated including a plurality of objects in a tree representation;

wherein intrusion detection services are provided based on the information;

wherein a Simple Network Management Protocol (SNMP) trap capability is utilized.

48. The computer program product as recited in claim 47, wherein the information relates to wireless network traffic.