Enterprise network analyzer host controller/agent interface system and method

• US 6,789,117 B1
• Filed: 12/21/2001
• Issued: 09/07/2004
• Est. Priority Date: 12/21/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Verma, Ravi, Joiner, Herbert V., Raghuraman, Praveen, Elwell, Ken W.
• Primary Examiner(s): Burgess, Glenton B.
• Assistant Examiner(s): Choudhary, Anita
• Application Number:
  US10/029,746
• Time in Patent Office: 991 Days
• Field of Search: 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system, method, and computer program product are provided for analyzing a network utilizing an agent/host controller interface. Initially, an agent is sent an interval setting from a host controller. Such agent is adapted to transmit network traffic information based on the interval setting. Such network traffic information is then received from the agent in accordance with the interval setting.

Claims

1. A method for analyzing a network utilizing an information collector manager, comprising:

(a) sending an agent an interval setting utilizing an information collector manager, wherein the agent transmits network traffic information related to network traffic based on the interval setting; and

(b) receiving the network traffic information from the agent at the interval setting;

wherein a plurality of consoles are coupled to the information collector manager for collecting the network traffic information from the information collector manager and displaying the network traffic information from the information collector manager, wherein a user interface is adapted for analyzing an output;

wherein a map of a network is generated based on the network traffic information;

wherein the network traffic information relates to wireless network traffic;

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information is sent to the information collector manager securely;

wherein the network traffic information is reported to a user utilizing a plurality of zone collectors coupled to a plurality of the information collector managers, and a reoccurring fee associated with the reporting is determined based on the number of the agents, the information collector managers, and the zone controllers;

wherein enterprise latency mapping is performed, where at least one of the zone controllers chooses a port number associated with an application and pushes a configuration request to a plurality of the information collector managers in an associated zone, and the information collector managers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the information collector managers and buffered, whereafter the information collector managers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise.

2. The method as recited in claim 1, and further comprising receiving a signal from the agent.

3. The method as recited in claim 2, wherein the interval setting is sent in response the receipt of the signal.

4. The method as recited in claim 1, wherein configuration data sent with the interval setting.

5. The method as recited in claim 4, wherein the agent is adapted to operate based at least in part on the configuration data.

6. The method as recited in claim 1, and further comprising filtering unicast network traffic.

7. The method as recited in claim 1, and further comprising synchronizing the receipt of the network traffic information from a plurality of the agents.

8. The method as recited in claim 1, wherein the information collector manager communicates with the agent utilizing a layer three protocol.

9. A computer program product for analyzing a network utilizing an information collector manager, comprising:

(a) computer code for sending an agent an interval setting utilizing an information collector manager, wherein the agent transmits network traffic information related to network traffic based on the interval setting; and

(b) computer code for receiving the network traffic information from the agent at the interval setting;

wherein a plurality of consoles are coupled to the information collector manager for collecting the network traffic information from the information collector manager and displaying the network traffic information from the information collector manager, wherein a user interface is adapted for analyzing an output;

wherein a map of a network is generated based on the network traffic information;

wherein the network traffic information relates to wireless network traffic,

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information is sent to the information collector manager securely;

wherein the network traffic information is reported to a user utilizing a plurality of zone controllers coupled to a plurality of the information collector managers, and a reoccurring fee associated with the reporting is determined based on the number of the agents, the information collector managers, and the zone controllers;

wherein enterprise latency mapping is performed, where at least one of the zone controllers chooses a port number associated with an application and pushes a configuration request to a plurality of the information collector managers in an associated zone, and the information collector managers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the information collector managers and buffered, whereafter the information collector managers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise.

10. The computer program product as recited in claim 9, and further comprising computer code for receiving a signal from the agent.

11. The computer program product as recited in claim 10, wherein the interval setting is sent in response the receipt of the signal.

12. The computer program product as recited in claim 9, wherein configuration data sent with the interval setting.

13. The computer program product as recited in claim 12, wherein the agent is adapted to operate based at least in part on the configuration data.

14. The computer program product as recited in claim 9, and further comprising computer code for filtering unicast network traffic.

15. The computer program product as recited in claim 9, and further comprising computer code for synchronizing the receipt of the network traffic information from a plurality of the agents.

16. The computer program product as recited in claim 9, wherein the information collector manager communicates with the agent utilizing a layer three protocol.

17. A system for analyzing a network utilizing an information collector manager, comprising:

(a) logic for sending an agent an interval setting utilizing an information collector manager, wherein the agent transmits network traffic information related to network traffic based on the interval setting; and

(b) logic for receiving the network traffic information from the agent at the interval setting;

wherein a plurality of consoles are coupled to the information collector manager for collecting the network traffic information from the information collector manager and displaying the network traffic information from the information collector manager, wherein a user interface is adapted for analyzing an output;

wherein a map of a network is generated based on the network traffic information;

wherein the network traffic information relates to wireless network traffic;

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information is sent to the information collector manager securely;

wherein the network traffic information is reported to a user utilizing a plurality of zone controllers coupled to a plurality of the information collector managers, and a reoccurring fee associated with the reporting is determined based on the number of the agents, the information collector managers, and the zone controllers;

wherein enterprise latency mapping is performed, where at least one of the zone controllers chooses a port number associated with an application and pushes a configuration request to a plurality of the information collector managers in an associated zone, and the information collector managers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the information collector managers and buffered, whereafter the information collector managers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise.

18. The system as recited in claim 17, and further comprising logic for receiving a signal from the agent.

19. The system as recited in claim 18, wherein the interval setting is sent in response the receipt of the signal.

20. The system as recited in claim 17, wherein configuration data sent with the interval setting.

21. The system as recited in claim 20, wherein the agent is adapted to operate based at least in part on the configuration data.

22. The system as recited in claim 17, and further comprising logic for filtering unicast network traffic.

23. The system as recited in claim 17, and further comprising logic for synchronizing the receipt of the network traffic information from a plurality of the agents.

24. The system as recited in claim 17, wherein the information collector manager communicates with the agent utilizing a layer three protocol.

25. A method for analyzing a network utilizing an information collector manager, comprising:

sending an information collector interval setting configuration data utilizing an information collector manager, wherein the information collector sends network traffic information related to network traffic based on the configuration data;

receiving the network traffic information from the information collector; and

managing the receipt of the network traffic information from a plurality of the information collectors;

wherein a plurality of consoles are coupled to the information collector manager for collecting the network traffic information from the information collector manager and displaying the network traffic information from the information collector manager, wherein a user interface is adapted for analyzing an output;

wherein a map of a network is generated based on the network traffic information;

wherein the network traffic information relates to wireless network traffic;

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information is sent to the information collector manager securely;

wherein the network traffic information is reported to a user utilizing a plurality of zone controllers coupled to a plurality of the information collector managers, and a reoccurring fee associated with the reporting is determined based on the number of the agents, the information collector managers, and the zone controllers;

wherein enterprise latency mapping is performed, where at least one of the zone controllers chooses a port number associated with an application and pushes a configuration request to a plurality of the information collector managers in an associated zone, and the information collector managers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the information collector managers and buffered, whereafter the information collector managers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise.

26. A computer program product for analyzing a network utilizing an information collector manager, comprising:

computer code for sending an information collector interval setting configuration data utilizing an information collector manager, wherein the information collector sends network traffic information related to network traffic based on the configuration data;

computer code for receiving the network traffic information from the information collector; and

computer code for managing the receipt of the network traffic information from a plurality of the information collectors;

wherein a plurality of consoles are coupled to the information collector manager for collecting the network traffic information from the information collector manager and displaying the network traffic information from the information collector manager, wherein a user interface is adapted for analyzing an output;

wherein a map of a network is generated based on the network traffic information;

wherein the network traffic information relates to wireless network traffic;

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information is sent to the information collector manager securely;

wherein the network traffic information is reported to a user utilizing a plurality of zone controllers coupled to a plurality of the information collector managers, and a reoccurring fee associated with the reporting is determined based on the number of the agents, the information collector managers, and the zone controllers;

wherein enterprise latency mapping is performed, where at least one of the zone controllers chooses a port number associated with an application and pushes a configuration request to a plurality of the information collector managers in an associated zone, and the information collector managers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the information collector managers and buffered, whereafter the information collector managers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise.