Probe election in failover configuration

• US 8,583,792 B2
• Filed: 02/13/2012
• Issued: 11/12/2013
• Est. Priority Date: 09/03/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Narasimhan, Srinivasan
• Primary Examiner(s): SHINGLES, KRISTIE D
• Application Number:
  US13/371,956
• Publication Number:
  US 20120144030A1
• Time in Patent Office: 638 Days
• Field of Search: 709/224, 709/223
• US Class Current: 709/224
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for allocating probing responsibilities between a primary sensor and a secondary sensor. In one aspect, a method includes determining a first probe type, the first probe type being the probe type of the highest priority information probe for which a reply from the host device was received at the primary sensor, determining a second probe type, the second probe type being the probe type of the highest priority information probe for which a reply from the host device was received at the secondary sensor, determining whether the second probe type is prioritized higher than the first probe type, and allocating probing responsibilities between the primary sensor and the second sensor based on the prioritization of the first probe type and the second probe type.

Claims

1. A system, comprising:

a first sensor designated as a primary sensor and a second sensor designated as a secondary sensor, wherein each of the primary and secondary sensors comprise a memory subsystem and a processor in data communication with the memory subsystem, wherein the processors of the primary sensor and secondary sensor are respectively programmed to cause the primary sensor and the secondary sensor to perform operations comprising;

transmitting, from each the primary and secondary sensors, information probes to a host device, each of the information probes being prioritized according to their probe types;

determining, at the primary sensor, whether a second probe type is prioritized higher than a first probe type, the second probe type being a probe type of a highest priority information probe for which a reply from the host device was received at the secondary sensor and the first probe type being a probe type of a highest priority information probe for which a reply from the host device was received at the primary sensor;

in response to determining the second probe type is not prioritized higher than the first probe type, monitoring the host device by the primary sensor; and

determining, at the primary sensor during the monitoring, that the host device is offline in response to a failure to receive a reply from the host device to an information probe transmitted from the primary sensor, and in response to the determination that the host device is offline;

determining whether the second probe type is prioritized equally to the first probe type, and in response to determining that the second probe type is prioritized equally to the first probe type;

transmitting, from the primary sensor, data indicating a probe handover to the secondary sensor; and

monitoring the host device by the secondary sensor.

2. The system of claim 1, wherein the processor of the primary sensor is further programmed to cause the primary sensor to further perform operations comprising:

precluding further probing of the host device from the primary sensor after the probe handover.

3. The system of claim 1 wherein the processor of the primary sensor is further programmed to cause the primary sensor to further perform operations comprising:

in response to determining that the second probe type is not prioritized equally to the first probe type;

deleting a record for the host device from a host table in the memory of the primary sensor; and

transmitting data indicating the host device is offline to the secondary sensor.

4. The system of claim 3, the processor of the secondary sensor is further programmed to cause the secondary sensor to further perform operations comprising:

in response to receiving the data indicating the host device is offline, deleting a record for the host device from a host table in the memory of the secondary sensor.

5. The system of claim 1, wherein the processor of the secondary sensor is programmed to cause the secondary sensor to perform operations comprising:

in response to the receipt of the data, at the secondary sensor, indicating the probe handover to the secondary sensor, re-designating the secondary sensor as the primary sensor.

6. The system of claim 1, wherein the processor of the primary sensor is programmed to cause the primary sensor to perform operations comprising:

transmitting, from the primary sensor, data indicating the first probe type to the secondary sensor.

7. The system of claim 1, wherein the information probes include:

an agent probe that queries an agent installed on the host device for a unique agent identifier, and each of the information probes request one or more other host attributes, and the probe type of the agent probe is the highest priority probe type.

8. The system of claim 7, wherein the information probes include an NBTSTAT query, and the probe type of the NBTSTAT query is lower in priority than the probe type of the agent probe.

9. The system of claim 8, wherein the information probes include an IMCP ping, and the probe type of the IMCP ping is lower in priority than the probe type of the agent probe.

10. The system of claim 9, wherein the probe type of the IMCP ping is lower in priority than the probe type of the NBTSTAT query.

11. The system of claim 1, wherein transmitting information probes comprises:

transmitting the information probes to the host device in response to the host device attempting to access a network.

12. A system, comprising:

a first sensor designated as a primary sensor and a second sensor designated as a secondary sensor, wherein each of the primary and secondary sensors comprise a memory subsystem and a processor in data communication with the memory subsystem, wherein the processors of the primary sensor and secondary sensor are respectively programmed to cause the primary sensor and the secondary sensor to perform operations comprising;

transmitting, from each the primary and secondary sensors, information probes to a host device, each of the information probes being prioritized according to their probe types;

determining, at the primary sensor, whether a second probe type is prioritized higher than a first probe type, the second probe type being the probe type of a highest priority information probe for which a reply from the host device was received at the secondary sensor and the first probe type being a probe type of a highest priority information probe for which a reply from the host device was received at the primary sensor;

in response to determining the second probe type is prioritized higher than the first probe type, transmitting, from the primary sensor, data indicating a probe handover to the secondary sensor; and

precluding further probing of the host device from the primary sensor.

13. A method performed by a first network traffic sensor, the network traffic sensor being designated a primary sensor, the method comprising:

receiving data specifying a second network traffic sensor designated as a secondary sensor;

transmitting a plurality of information probes to a host device, each of the information probes being prioritized according to their probe types by the primary sensor in a descending priority order;

determining whether a second probe type is prioritized higher than a first probe type, the second probe type being the probe type of a highest priority information probe for which a reply from the host device was received at the secondary sensor and the first probe type being a probe type of a highest priority information probe for which a reply from the host device was received at the primary sensor;

in response to determining the second probe type is not prioritized higher than the first probe type, monitoring the host device by the primary sensor; and

determining, during the monitoring, that the host device is offline in response to a failure to receive a reply from the host device to an information probe transmitted from the primary sensor, and in response to a determination that the host device is offline;

determining whether the second probe type is prioritized equally to the first probe type, and in response to determining that the second probe type is prioritized equally to the first probe type;

transmitting, the secondary sensor, data indicating a probe handover to the secondary sensor.

14. The method of claim 13, further comprising:

precluding further probing of the host device from the primary sensor after the probe handover to the secondary sensor.

15. The method of claim 13, further comprising:

in response to determining that the second probe type is not prioritized equally to the first probe type;

deleting a record for the host device from a host table in memory of the primary sensor; and

transmitting data indicating the host device is offline to the secondary sensor.

16. The method of claim 13, further comprising:

transmitting data indicating the first probe type to the secondary sensor.

17. The method of claim 13, wherein the information probes include:

an agent probe that queries an agent installed on the host device for a unique agent identifier, and each of the information probes request one or more other host attributes, and the probe type of the agent probe is the highest priority probe type.

18. A method performed by a network traffic sensor, the network sensor being designated a secondary sensor, the method comprising:

receiving data specifying a network traffic sensor designated as a primary sensor;

transmitting information probes to a host device, each of the information probes being prioritized according to their probe types by the primary sensor in a descending priority order;

determining a second probe type, the second probe type being the probe type of a highest priority information probe for which a reply from the host device was received at the secondary sensor;

transmitting, from the secondary sensor, data indicating the second probe type to the primary sensor; and

receiving, from the primary sensor, data indicating a probe handover to the secondary sensor, wherein the secondary sensor is precluded from further probing of the host device until the data indicating the probe handover is received.

19. The method of claim 18, further comprising:

in response to the receipt of the data indicating the probe handover, re-designating the secondary sensor as the primary sensor.

20. The method of claim 18, wherein the information probes include:

an agent probe that queries an agent installed on the host device for a unique agent identifier, and each of the information probes request one or more other host attributes, and the probe type of the agent probe is the highest priority probe type.

21. At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

receive data specifying a second network traffic sensor designated as a secondary sensor;

transmit a plurality of information probes to a host device, each of the information probes being prioritized according to their probe types by the primary sensor in a descending priority order;

determine whether a second probe type is prioritized higher than a first probe type, the second probe type being the probe type of a highest priority information probe for which a reply from the host device was received at the secondary sensor and the first probe type being a probe type of a highest priority information probe for which a reply from the host device was received at the primary sensor;

in response to a determination that the second probe type is not prioritized higher than the first probe type;

monitor the host device by a primary network sensor; and

determine, during the monitoring, that the host device is offline in response to a failure to receive a reply from the host device to an information probe transmitted from the primary sensor, and in response to a determination that the host device is offline;

determine whether the second probe type is prioritized equally to the first probe type, and in response to a determination that the second probe type is prioritized equally to the first probe type;

transmit, the secondary sensor, data indicating a probe handover to the secondary sensor.

22. At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

receive data specifying a network traffic sensor designated as a primary sensor;

transmit information probes to a host device, each of the information probes being prioritized according to their probe types by the primary sensor in a descending priority order;

determine a second probe type, the second probe type being the probe type of a highest priority information probe for which a reply from the host device was received at a secondary sensor;

transmit, from the secondary sensor, data indicating the second probe type to the primary sensor; and

receive, from the primary sensor, data indicating a probe handover to the secondary sensor, wherein the secondary sensor is precluded from further probing of the host device until the data indicating the probe handover is received.