Enterprise interface for network analysis reporting

• US 6,941,358 B1
• Filed: 12/21/2001
• Issued: 09/06/2005
• Est. Priority Date: 12/21/2001
• Status: Expired due to Term

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Joiner, Herbert V., Raghuraman, Praveen, Elwell, Ken W.
• Primary Examiner(s): WINDER, PATRICE L
• Application Number:
  US10/029,687
• Time in Patent Office: 1,355 Days
• Field of Search: 345/764, 709220-222, 709223-224, 703/13, 707/103.R
• US Class Current: 709/220
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method and computer program product are provided for reporting on network analysis. Initially, network traffic information is collected utilizing a plurality of agents installed in computers distributed among a plurality of zones. Next, the network traffic information collected from the agents associated with each zone is received at separate controllers. Next, a report on the network traffic information is sent from one of the controllers to a computer coupled thereto via a network.

Claims

1. A method for reporting on network analysis, comprising:

(a) collecting network traffic information utilizing a plurality of agents installed in computers distributed among a plurality of zones;

(b) receiving the network traffic information collected from the agents associated with each zone at a separate host controller; and

(c) transmitting a report on the network traffic information from the host controller to a computer coupled thereto via a network;

wherein a plurality of consoles are coupled to the host controller for collecting the network traffic information from the host controller and displaying the network traffic information from the host controller, wherein a user interface is adapted for analyzing an output;

wherein a map of the network is generated based on the network traffic information;

wherein the report includes a plurality of objects in a tree representation, where the objects are displayed in the tree representation;

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information relates to wireless network traffic;

wherein at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct an enterprise picture of latency;

wherein each host controller interfaces with at least one of the agents by determining whether a signal has been received from the at least one agent, where, in response to the signal, the at least one agent is sent commands including a first interval setting and configuration data such that the at least one agent transmits the network traffic information in a manner that is based on the configuration data and at a first time interval based on the first interval setting, each host controller being adapted for filtering unicast network traffic, thereby picking up flooded traffic on a domain to ensure that utilization calculations are correct;

wherein each host controller interfaces with the at least one zone controller by determining whether instructions are received from the at least one zone controller the instructions including a second interval setting indicating a second time interval based on which the network traffic information is sent to the at least one zone controller and dictating the manner in which the at least one agent operates per the commands sent from each host controller to the agents, wherein the second interval setting is monitored and each host controller polls for the receipt of a demand over the network, the network traffic information being transmitted to the at least one zone controller in response to at least one of the demand and the cessation of the second time interval.

2. The method as recited in claim 1, wherein the report is capable of being displayed on the computer utilizing a network browser.

3. The method as recited in claim 1, wherein the network includes the Internet.

4. The method as recited in claim 1, and further comprising receiving a request at one of the host controllers for a report on the network traffic information corresponding to the zone associated with the host controller.

5. The method as recited in claim 4, wherein the report is transmitted in response to the request.

6. The method as recited in claim 1, wherein the report includes a network analyzer report.

7. A computer program product for reporting on network analysis, comprising:

(a) computer code for collecting network traffic information utilizing a plurality of agents installed in computers distributed among a plurality of zones;

(b) computer code for receiving the network traffic information collected from the agents associated with each zone at a separate host controller; and

(c) computer code for transmitting a report on the network traffic information from the host controller to a computer coupled thereto via a network;

wherein a plurality of consoles are coupled to the host controller for collecting the network traffic information from the host controller and displaying the network traffic information from the host controller, wherein a user interface is adapted for analyzing an output;

wherein a map of the network is generated based on the network traffic information;

wherein the report includes a plurality of objects in a tree representation, where the objects are displayed in the tree representation;

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information relates to wireless network traffic;

wherein at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct an enterprise picture of latency;

wherein each host controller interfaces with at least one of the agents by determining whether a signal has been received from the at least one agent, where, in response to the signal, the at least one agent is sent commands including a first interval setting and configuration data such that the at least one agent transmits the network traffic information in a manner that is based on the configuration data and at a first time interval based on the first interval setting, each host controller being adapted for filtering unicast network traffic, thereby picking up flooded traffic on a domain to ensure that utilization calculations are correct;

wherein each host controller interfaces with the at least one zone controller by determining whether instructions are received from the at least one zone controller, the instructions including a second interval setting indicating a second time interval based on which the network traffic information is sent to the at least one zone controller and dictating the manner in which the at least one agent operates per the commands sent from each host controller to the agents, wherein the second interval setting is monitored and each host controller polls for the receipt of a demand over the network, the network traffic information being transmitted to the at least one zone controller in response to at least one of the demand and the cessation of the second time interval.

8. The computer program product as recited in claim 7, wherein the report is capable of being displayed on the computer utilizing a network browser.

9. The computer program product as recited in claim 7, wherein the network includes the Internet.

10. The computer program product as recited in claim 7, and further comprising receiving a request at one of the host controllers for a report on the network traffic information corresponding to the zone associated with the host controller.

11. The computer program product as recited in claim 10, wherein the report is transmitted in response to the request.

12. The computer program product as recited in claim 7, wherein the report includes a network analyzer report.

13. A system for reporting on network analysis, comprising:

(a) logic for collecting network traffic information utilizing a plurality of agents installed in computers distributed among a plurality of zones;

(b) logic for receiving the network traffic information collected from the agents associated with each zone at a separate host controller; and

(c) logic for transmitting a report on the network traffic information from the host controller to a computer coupled thereto via a network;

wherein a plurality of consoles are coupled to the host controller for collecting the network traffic information from the host controller and displaying the network traffic information from the host controller, wherein a user interface is adapted for analyzing an output;

wherein a map of the network is generated based on the network traffic information;

wherein the report includes a plurality of objects in a tree representation, where the objects are displayed in the tree representation;

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information relates to wireless network traffic;

wherein at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct an enterprise picture of latency;

wherein each host controller interfaces with at least one of the agents by determining whether a signal has been received from the at least one agent, where, in response to the signal the at least one agent is sent commands including a first interval setting and configuration data such that the at least one agent transmits the network traffic information in a manner that is based on the configuration data and at a first time interval based on the first interval setting, each host controller being adapted for filtering unicast network traffic, thereby picking up flooded traffic on a domain to ensure that utilization calculations are correct;

wherein each host controller interfaces with the at least one zone controller by determining whether instructions are received from the at least one zone controller, the instructions including a second interval setting indicating a second time interval based on which the network traffic information is sent to the at least one zone controller and dictating the manner in which the at least one agent operates per the commands sent from each host controller to the agents, wherein the second interval setting is monitored and each host controller polls for the receipt of a demand over the network, the network traffic information being transmitted to the at least one zone controller in response to at least one of the demand and the cessation of the second time interval.

14. The system as recited in claim 13, wherein the report is capable of being displayed on the computer utilizing a network browser.

15. The system as recited in claim 13, wherein the network includes the Internet.

16. The system as recited in claim 13, and further comprising receiving a request at one of the host controllers for a report on the network traffic information corresponding to the zone associated with the host controller.

17. The system as recited in claim 16, wherein the report is transmitted in response to the request.

18. The system as recited in claim 13, wherein the report includes a network analyzer report.

19. A method for reporting on network analysis, comprising:

(a) collecting network traffic information utilizing a plurality of agents installed in computers distributed among a plurality of zones;

(b) receiving the network traffic information collected from the agents associated with each zone at a separate host controller;

(c) receiving a request at one of the host controllers for a report on the network traffic information corresponding to the zone associated with the host controller; and

(d) transmitting the report from the host controller to a computer coupled thereto via a network;

(e) wherein the report is capable of being displayed on the computer utilizing a network browser,

wherein a plurality of consoles are coupled to the host controller for collecting the network traffic information from the host controller and displaying the network traffic information from the host controller, wherein a user interface is adapted for analyzing an output;

wherein a map of the network is generated based on the network traffic information;

wherein the report includes a plurality of objects in a tree representation where the objects are displayed in the tree representation;

wherein intrusion detection services are provided based on the network traffic information;

wherein the network traffic information relates to wireless network traffic;

wherein at least one zone controller chooses a port number associated with an application and pushes a configuration request to a plurality of the host controllers in an associated zone, and the host controllers push the configuration requests to the agents so that the agents begin to monitor a port associated with the port number, such that monitor data is sent from the agents to the host controllers and buffered, whereafter the host controllers update the at least one zone controller with consolidated monitor data, where differences in delay times are calculated to construct an enterprise picture of latency;

wherein each host controller interfaces with at least one of the agents by determining whether a signal has been received from the at least one agent, where, in response to the signal, the at least one agent is sent commands including a first interval setting and configuration data such that the at least one agent transmits the network traffic information in a manner that is based on the configuration data and at a first time interval based on the first interval setting, each host controller being adapted for filtering unicast network traffic, thereby picking up flooded traffic on a domain to ensure that utilization calculations are correct;

wherein each host controller interfaces with the at least one zone controller by determining whether instructions are received from the at least one zone controller, the instructions including a second interval setting indicating a second time interval based on which the network traffic information is sent to the at least one zone controller and dictating the manner in which the at least one agent operates per the commands sent from each host controller to the agents, wherein the second interval setting is monitored and each host controller polls for the receipt of a demand over the network, the network traffic information being transmitted to the at least one zone controller in response to at least one of the demand and the cessation of the second time interval.