Enterprise network analyzer host controller/zone controller interface system and method

• US 6,892,227 B1
• Filed: 12/21/2001
• Issued: 05/10/2005
• Est. Priority Date: 12/21/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Joiner, Herbert V., Elwell, Ken W.
• Primary Examiner(s): Jean, Frantz B.
• Application Number:
  US10/029,688
• Time in Patent Office: 1,236 Days
• Field of Search: 709/217, 709/218, 709/223, 709/224, 714/4, 714/50
• US Class Current: 709/218
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A system, method and computer program product are provided for analyzing a network utilizing a host controller/zone controller interface. Initially, network traffic information is collected utilizing a host controller. Then, a predetermined interval setting is tracked, and the system polls for the receipt of a demand over the network. In response to the demand or the cessation of the predetermined interval setting, the network traffic information is transmitted to a zone controller over the network.

Claims

1. A method for analyzing a network utilizing a host controller, comprising:

(a) accumulating network traffic information;

(b) tracking a predetermined interval setting;

(c) polling for the receipt of a demand over a network; and

(d) in response to the demand or the cessation of the predetermined interval setting, transmitting the network traffic information to a zone controller;

wherein enterprise latency mapping is performed, where at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to a plurality of agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise;

wherein a man of a network is generated based on the network traffic information;

wherein intrusion detection services are provided based on the network traffic information.

2. The method as recited in claim 1, wherein the network traffic information is received from the agents distributed over the network.

3. The method as recited in claim 1, and farther comprising receiving the interval setting from the zone controller.

4. The method as recited in claim 3, and further comprising controlling the agents to accumulate network traffic information based on the interval setting.

5. The method as recited in claim 1, and further comprising transmitting the map to the zone controller.

6. The method as recited in claim 1, and further comprising synchronizing a first clock of the host controller and a second clock of the zone controller.

7. A computer program product for analyzing a network utilizing a host controller, comprising:

(a) computer code for accumulating network traffic information;

(b) computer code for tracking a predetermined interval setting;

(c) computer code for polling for the receipt of a demand over a network; and

(d) computer code for transmitting the network traffic information to a zone controller, in response to the demand or the cessation of the predetermined interval setting;

wherein enterprise latency mapping is performed, where at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to a plurality of agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise;

wherein a map of a network is generated based on the network traffic information;

wherein intrusion detection services are provided based on the network traffic information.

8. The computer program product as recited in claim 7, wherein the network traffic information is received from the agents distributed over the network.

9. The computer program product as recited in claim 7, and further comprising computer code for receiving the interval setting from the zone controller.

10. The computer program product as recited in claim 9, and further comprising computer code for controlling the agents to accumulate network traffic information based on the interval setting.

11. The computer program product as recited in claim 7 and further comprising computer code for transmitting the map to the zone controller.

12. The computer program product as recited in claim 7, and further comprising computer code for synchronizing a first clock of the host controller and a second clock of the zone controller.

13. A system for analyzing a network utilizing a host controller, comprising:

(a) logic for accumulating network traffic information;

(b) logic for tracking a predetermined interval setting;

(c) logic for polling for the receipt of a demand over a network; and

(d) logic for transmitting the network traffic information to a zone controller, in response to the demand or the cessation of the predetermined interval setting;

wherein enterprise latency mapping is performed, where at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to a plurality of agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise;

wherein a map of a network is generated based on the network traffic information;

wherein intrusion detection services are provided based on the network traffic information.

14. The system as recited in claim 13, wherein the network traffic information is received from the agents distributed over the network.

15. The system as recited in claim 13, and further comprising logic for receiving the interval setting from the zone controller.

16. The system as recited in claim 15, and further comprising logic for controlling the agents to accumulate network traffic information based on the interval setting.

17. The system as recited in claim 13, and further comprising logic for transmitting the map to the zone controller.

18. The system as recited in claim 13, and further comprising logic for synchronizing a first clock of the host controller and a second clock of the zone controller.

19. A method for analyzing a network utilizing a host controller, comprising:

(a) accumulating network traffic information;

(b) transmitting the network traffic information to a zone controller;

(c) generating a map of the network based on the network traffic information; and

(d) transmitting the map to the zone controller;

wherein enterprise latency mapping is performed, where at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to a plurality of agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise;

wherein intrusion detection services are provided based on the network traffic information.

20. A method for analyzing a network utilizing a host controller, comprising:

(a) receiving an interval setting from a zone controller;

(b) accumulating network traffic information from a plurality of agents distributed over a network based on the zone controller;

(c) tracking a predetermined interval setting;

(d) polling for the receipt of a demand over the network;

(e) in response to the demand or the cessation of the predetermined interval setting, transmitting the network traffic information to the zone controller;

(f) generating a map of the network based on the network traffic information;

(g) transmitting the map to the zone controller; and

(h) synchronizing a clock between the host controller and the zone controller;

wherein enterprise latency mapping is performed, where at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise;

wherein intrusion detection services are provided based on the network traffic information.

21. A method for analyzing a network, comprising:

accumulating network traffic information from at least one computer utilizing an information collector;

transmitting the network traffic information to an information collector manager; and

generating a map of the network based on the network traffic information;

wherein enterprise latency mapping is performed, where at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the information collector managers in an associated zone, and the information collector managers push the configuration requests to a plurality of the information collectors so that the information collectors begin to monitor a port associated with the port number, such that monitor data is sent from the information collectors to the information collector managers and buffered, whereafter the information collector managers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise;

wherein intrusion detection services are provided based on the network traffic information.

22. The method as recited in claim 21, wherein the information relates to wireless network traffic.

23. The method as recited in claim 21, wherein the map includes a correlation among computers associated with the network traffic information.

24. The method as recited in claim 21, wherein the map includes a mapping of computers associated with the network traffic information.

25. A computer program product for analyzing a network, comprising:

computer code for accumulating network traffic information from at least one source utilizing an information collector;

computer code for transmitting the network traffic information to an information collector manager; and

computer code for generating a map of the network based on the network traffic information;

wherein enterprise latency mapping is performed, where at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the information collector managers in an associated zone, and the information collector managers push the configuration requests to a plurality of the information collectors so that the information collectors begin to monitor a port associated with the port number, such that monitor data is sent from the information collectors to the information collector managers and buffered, whereafter the information collector managers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct a picture of latency throughout an enterprise;

wherein intrusion detection services are provided based on the network traffic information.

26. The computer program product as recited in claim 25,

wherein the information relates to wireless network traffic.

27. The computer program product as recited in claim 25, wherein the map includes a correlation among computers associated with the network traffic information.

28. The computer program product as recited in claim 25, wherein the map includes a mapping of computers associated with the network traffic information.