Distributed network management

• US 8,077,718 B2
• Filed: 08/12/2005
• Issued: 12/13/2011
• Est. Priority Date: 08/12/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Barham, Paul, Isaacs, Rebecca, Mortier, Richard M.
• Primary Examiner(s): Wilson, Robert
• Assistant Examiner(s): RANDHAWA, MANDISH K
• Application Number:
  US11/203,011
• Publication Number:
  US 20070058631A1
• Time in Patent Office: 2,314 Days
• Field of Search: 370254-257, 370229-236, 370/389, 709/224, 709/242
• US Class Current: 370/392
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/042 comprising distributed management centres cooperatively managing the network
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/44 Distributed routing

Abstract

Hosts or end-systems residing at the edges of a network gather data about the traffic they transmit into and receive from the network. The network'"'"'s routing protocol (typically a link-state protocol such as OSPF) is monitored and routing data or packets are used to recover the network'"'"'s current status and topology. This data can be collected, fused, and maintained and a platform, preferably distributed, can be provided to query the data, thus enabling a variety of network management applications.

Claims

1. A method of providing information for managing an autonomous IP network comprised of hosts on which applications execute and exchange IP packets and routers that route the IP packets between the hosts, the method comprising:

providing access to flow information about instances of communication between the hosts over the autonomous IP network, the flow information having been captured by the hosts as the communication occurred, and where the hosts are on the edge of the autonomous IP network and are not routers, the flow information comprising a plurality of traffic flows, the traffic flows having been obtained by, for any given host;

monitoring the transmission and receipt of IP packets on the given host to capture packet data as IP packets are sent and received on the host, and synthesizing the captured packet data to form and store the plurality of traffic flows, each traffic flow corresponding to a plurality of the IP packets that were all sent or received by a same application between a same source IP address and a same destination IP address via a same protocol or port, each traffic flow including a packet count or cumulative packet size of the IP packets in the corresponding plurality;

providing access to information describing the topology of the autonomous IP network, where the information about the topology is based on or comprises routing paths derived from routing information collected from the routers of the autonomous IP network, each routing path comprising two endpoint IP addresses of a pair of the hosts in the autonomous IP network and comprising one or more intermediary IP addresses of routers that routed some of the IP packets between the endpoint IP addresses; and

answering queries about the autonomous IP network and the host by using both the collected routes and the collected flows, wherein a query is answered by correlating one or more traffic flows with one or more routing paths describing routes that carried the IP packets corresponding to the one or more traffic flows.

2. A method according to claim 1, wherein answers to some queries comprise information about flow along routing paths within the autonomous IP network.

3. A method according to claim 1, further comprising distributing the flow information to different hosts on the autonomous IP network and answering queries in a distributed manner using those different hosts.

4. A method according to claim 1, further comprising automatically reconfiguring one or more routers of the autonomous IP network based on information included in an answer to a query.

5. A method of providing information about a network, the method comprising:

receiving a query;

searching flow data self-captured by hosts in the network as the hosts communicate with each other over the network, the hosts not configured to perform general purpose transit type IP routing, the flow data comprising individual packet statistics of sets of packets transmitted and received by the hosts in the network, each set of packets consisting of only packets sent or received by a particular application on a particular host to or from another particular host on the network;

accessing stored topology information that describes the topology of the network according to routing information captured from routers in the network or information derived therefrom;

finding in the topology information routes in the network by which the packets corresponding to the one or more packet statistics were routed; and

generating an answer to the query using at least some of the packet statistics and the found routes and transmitting the answer to the query via the network.

6. A method according to claim 5, wherein the topology information is used to select an IP address in the network that the query is transmitted to.

7. A method according to claim 5, wherein each packet statistic is stored in association with the IP addresses of its particular hosts and with the particular application, wherein the query requests information for a particular application or particular IP address, and the searching comprises searching for a plurality of packet statistics that match the particular IP address or application.

8. A method according to claim 5, further comprising passing the query to a distributed database distributed among various hosts on the network and storing the flow data and routing information, the hosts mutually performing the query in distributed fashion.

9. A method according to claim 8, wherein the routing information comprises information derived from link state routing packets received by a router in the network configured to collect the routing information and provide it to the distributed database.

10. A method according to claim 5, wherein a host produces flow data by receiving packets from the network and recording information about the packets as they are received.

11. A method according to claim 10, wherein the sending or receiving of a packet updates the flow data at the host.

12. A method according to claim 5, wherein the query comprises a request for information about traffic on a link in the network, and the query is answered by searching for flow data determined to have flowed along routes in the topology information determined to include the link.

13. A method of answering queries about an IP network comprised of hosts and routers with IP addresses in the IP network, the method comprising:

receiving and storing in a database a plurality of traffic flows from hosts in the IP network, the traffic flows having been obtained by the hosts by, for any given host;

monitoring the transmission and receipt of packets on the given host to capture packet data as the packets are sent and received on the host, and synthesizing the captured packet data to form and store a plurality of traffic flows, each traffic flow corresponding to a plurality of the packets that were all sent or received by a same application between a same source IP address and a same destination IP address via a same protocol or port, each traffic flow including a packet count or cumulative packet size of the packets in the corresponding plurality;

receiving and storing in the database, in association with the traffic flows, a plurality of routing paths, each routing path comprising two endpoint IP addresses of a pair of the hosts in the IP network and comprising one or more intermediary IP addresses of routers that routed some of the packets between the endpoint IP addresses, the plurality of routes having been derived from routing updates transmitted by the routers of the IP network;

receiving a query to the database, and providing an answer to the query by searching for a traffic flow that matches the query and by searching for a routing path that matches the traffic flow.

14. A method according to claim 13, further comprising:

providing the answer to the query to one of the applications which responds to the answer.

15. A method according to claim 13, where a host is configured to generate flow information about a particular behavior of an application and queries can be posed about the performance of the behavior.

16. A method according to claim 15, wherein a hypothetical scenario is modeled in real time using repeated queries about the particular behavior.

17. A method according to claim 13, wherein the routing information is obtained from a monitor running on a router on the network.