Problem determination method suitable for use when a filter blocks SNMP access to network components

• US 7,055,172 B2
• Filed: 08/08/2002
• Issued: 05/30/2006
• Est. Priority Date: 08/08/2002
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Griswold, Douglas Edmund
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US10/214,542
• Publication Number:
  US 20040030924A1
• Time in Patent Office: 1,391 Days
• Field of Search: 726/3, 713/200, 713/201
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A network management system determines whether end-to-end network paths are working, using network probes. A network component is deemed suspicious if included in every failed path, and deemed working if included in at least one working path. From the set of suspicious network components and the set of working components, a set of failed network components is deduced. The sets may be refined using SNMP to test visible components. In one embodiment, the set of failed network components is deduced by eliminating, from the set of suspicious network components, every network component that is included in the set of working network components. This may be done by finding the intersection of two sets: the set of suspicious network components, and the complement of the set of working network components, where the complement is with respect to the set of all network components.

Claims

1. A problem determination method suitable for a network that has a plurality of paths and a plurality of network components, at least two of which paths include at least one of the network components in common, said method comprising the steps of:

determining whether each path of the plurality of paths is a working path or a failed path;

determining a set of suspicious network components, each of which suspicious network component is included in every failed path;

determining a set of working network components, each of which working network component is included in at least one working path; and

identifying a set of failed network components by analyzing the set of suspicious network components and the set of working network components.

2. The method of claim 1, wherein the step of identifying the set of failed network components includes a step of eliminating, from the set of suspicious network components, every network component included in the set of working network components.

3. The method of claim 1,

wherein the step of determining the set of suspicious network components includes finding an intersection of sets of network components included in the failed paths;

wherein the step of determining the set of working network components includes finding a union of sets of network components included in the working paths; and

wherein the step of identifying the set of failed network components includes finding an intersection of the set of suspicious network components and a set which is the complement, with respect to a set of all the network components, of the set of working network components.

4. The method of claim 1, wherein the steps of determining the set of suspicious network components, determining the set of working network components, and identifying the set of failed network components, are performed using a relational database.

5. The method of claim 1, wherein the step of determining whether each path is a working path or a failed path is performed by a network management system, wherein the network management system has access to at least a first network component using a limited-visibility network management protocol and uses the limited-visibility network management protocol to determine whether the first network component is working or failed, and the network management system is blocked from using the limited-visibility network management protocol to access at least a second network component and uses a network probe to determine whether a path that includes the second network component is a working path or a failed path.

6. The method of claim 5, wherein the limited-visibility network management protocol is SNMP.

7. The method of claim 5, wherein the network management system is blocked from using the limited-visibility network management protocol to access at least the second network component by a firewall.

8. The method of claim 5, wherein the network management system is blocked from using the limited-visibility network management protocol to access at least the second network component by a router.

9. The method of claim 5, wherein the network management system is blocked from using the limited-visibility network management protocol to access at least the second network component by a load balancer.

10. A problem determination method suitable for a network that has a plurality of paths and a plurality of network components, at least two of which paths include at least one of the network components in common, said method comprising the steps of:

determining whether each path of the plurality of paths is a working path or a failed path;

determining a set of suspicious network components, each of which suspicious network component is included in every failed path, by finding an intersection of sets of network components included in the failed paths;

determining a set of working network components, each of which working network component is included in at least one working path, by finding a union of sets of network components included in the working paths; and

identifying a set of failed network components by eliminating, from the set of suspicious network components, every network component included in the set of working network components, by finding an intersection of the set of suspicious network components and a set which is a complement, with respect to a set of all the network components, of the set of working network components;

wherein the step of determining whether each path is a working path or a failed path is performed by a network management system, wherein the network management system has access to at least a first network component using a limited-visibility network management protocol and uses the limited-visibility network management protocol to determine whether the first network component is working or failed, and the network management system is blocked from using the limited-visibility network management protocol to access at least a second network component and uses a network probe to determine whether a path that includes the second network component is a working path or a failed path.

11. The method of claim 10, wherein the limited-visibility network management protocol is SNMP.

12. A problem determination method suitable for a network that has a plurality of paths and a plurality of network components, at least two of which paths include at least one of the network components in common, said method comprising the steps of:

determining whether each path of the plurality of paths is a working path or a failed path;

determining a set of suspicious network components, each of which suspicious network component is included in every failed path, by finding an intersection of sets of network components included in the failed paths;

determining a set of working network components, each of which working network component is included in at least one working path, by finding a union of sets of network components included in the working paths; and

identifying a set of failed network components by eliminating, from the set of suspicious network components, every network component included in the set of working network components, by finding the intersection of the set of suspicious network components and a set which is a complement, with respect to a set of all the network components, of the set of working network components;

wherein the steps of determining the set of suspicious components, determining the set of working network components, and identifying the set of failed network components, are performed using a relational database.

13. A problem determination method suitable for a network that has a plurality of paths and a plurality of network components, at least two of which paths include at least one of the network components in common, said method comprising the steps of:

determining whether each path of the plurality of paths is a working path or a failed path;

determining a set of suspicious network components, each of which suspicious network component is included in every failed path, by finding an intersection of sets of network components included in the failed paths;

determining a set of working network components, each of which working network component is included in at least one working path, by finding a union of sets of network components included in the working paths; and

identifying a set of failed network components by eliminating, from the set of suspicious network components, any network component included in the set of working network components, by finding an intersection of the set of suspicious network components and a set which is a complement, with respect to a set of all the network components, of the set of working network components;

wherein the steps of determining the set of suspicious components, determining the set of working network components, and identifying the set of failed network components, are performed using a relational database; and

further

wherein the step of determining whether each path is a working path or a failed path is performed by a network management system, wherein the network management system has access to at least a first network component using a limited-visibility network management protocol and uses the limited-visibility network management protocol to determine whether the first network component is working or failed, and the network management system is blocked from using the limited-visibility network management protocol to access at least a second network component and uses a network probe to determine whether a path that includes the second network component is a working path or a failed path.

14. The method of claim 13, wherein the limited-visibility network management protocol is SNMP.

15. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for a problem determination method suitable for a network that has a plurality of paths and a plurality of network components, at least two of which paths include at least one of the network components in common, said method steps comprising:

determining whether each path of the plurality of paths is a working path or a failed path;

determining a set of suspicious network components, each of which suspicious network component is included in every failed path;

determining a set of working network components, each of which working network component is included in at least one working path; and

identifying a set of failed network components by analyzing the set of suspicious network components and the set of working network components.

16. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for a problem determination method suitable for a network that has a plurality of paths and a plurality of network components, at least two of which paths include at least one of the network components in common, said method steps comprising:

determining whether each path of the plurality of paths is a working path or a failed path;

determining a set of suspicious network components, each of which suspicious network component is included in every failed path, by finding an intersection of sets of network components included in the failed paths;

determining a set of working network components, each of which working network component is included in at least one working path, by finding a union of sets of network components included in the working paths; and

identifying a set of failed network components by eliminating, from the set of suspicious network components, any network component included in the set of working network components, by finding an intersection of the set of suspicious network components and a set which is a complement, with respect to a set of all the network components, of the set of working network components;

wherein the step of determining whether each path is a working path or a failed path is performed by a network management system, wherein the network management system has access to at least a first network component using a limited-visibility network management protocol and uses the limited-visibility network management protocol to determine whether the first network component is working or failed, and the network management system is blocked from using the limited-visibility network management protocol to access at least a second network component and uses a network probe to determine whether a path that includes the second network component is a working path or a failed path.

17. The program storage device of claim 16, wherein the limited-visibility network management protocol is SNMP.

18. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for a problem determination method suitable for a network that has a plurality of paths and a plurality of network components, at least two of which paths include at least one of the network components in common, said method steps comprising:

determining whether each path of the plurality of paths is a working path or a failed path;

determining a set of suspicious network components, each of which suspicious network component is included in every failed path, by finding an intersection of sets of network components included in the failed paths;

determining a set of working network components, each of which working network component is included in at least one working path, by finding a union of sets of network components included in the working paths; and

identifying a set of failed network components by eliminating, from the set of suspicious network components, any network component included in the set of working network components, by finding the intersection of the set of suspicious network components and a set which is a complement, with respect to a set of all the network components, of the set of working network components;

wherein the steps of determining the set of suspicious components, determining the set of working network components, and identifying the set of failed network components, are performed using a relational database.