Generic discovery for computer networks

• US 8,683,032 B2
• Filed: 12/06/2005
• Issued: 03/25/2014
• Est. Priority Date: 12/06/2004
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Spinelli, Lionel, Chabrier, Jean-Claude, Germain, Pierre
• Primary Examiner(s): Follansbee, John
• Assistant Examiner(s): Chou, Alan S
• Application Number:
  US11/295,363
• Publication Number:
  US 20060123104A1
• Time in Patent Office: 3,031 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A generic discovery methodology collects data pertaining to components of a computer network using various discovery technologies. From the collected data, the methodology identifies, filters and analyzes information related to inter-component communications. Using the communication and application information, the methodology determines reliable relationships for those components having sufficient information available. To qualify more components, the methodology implements a decision service to generate hypothetical relationships between components that are known and components that are unqualified or unknown. The hypothetical relationships are presented to a user for selection, and each hypothetical relationship is preferably associated with an indication of its reliability.

Claims

1. A generic discovery method comprising:

collecting at least partial data pertaining to components of a computer network;

determining communication information and application information from the collected data, at least some of the communication information being taken from intercepted network communications occurring between the components, the application information pertaining to at least some applications executing on the components;

identifying a first application installed on a first component of the computer network based on the communication information and the application information;

determining, based on the communication information, ports used on the first component that are characteristic of a type of communication protocol associated with the first application;

determining a subset of the determined ports that are used in communications intercepted between the first component and a second component of the computer network;

generating at least a first hypothesis of a relationship between one or more second applications of the second component and the first application by determining that the second applications are capable of communicating with the first application via the communication protocol;

generating at least a second hypothesis of an application executing on a third component based on determining a collection of ports used in the intercepted network communications on the third component and what one or more fourth components or applications were communicating with the collection of ports;

generating a schematic of components based at least on the first hypothesis and the second hypothesis;

matching a template of known components to at least a portion of the schematic; and

using characteristics associated with the template to determine that components represented in the portion of the schematic constitute the known components.

2. The method of claim 1, wherein the act of collecting comprises obtaining at least some of the collected data from a database.

3. The method of claim 1, wherein the act of collecting at least partial data pertaining to components of a computer network-comprises exploring the computer network with one or more discovery technologies selected from the group consisting of Secure Shell (SSH), Windows Management Instrumentation (WMI), remote connectivity protocols, Simple Network Management Protocol (SNMP), Transmission Control Protocol (TCP) portscan, Sequential Query Language (SQL), Remote Procedure Call (RPC), and Distributed Computer Environment (DCE).

4. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises filtering the intercepted network communications occurring between components to isolate communications that used one or more predefined ports.

5. The method of claim 1, wherein the act of determining communication information and application information from collected data comprises filtering the intercepted network communications occurring between components to remove communications that used one or more predefined ports.

6. The method of claim 1, further comprising generating at least one other hypothesis about a fifth component based on detecting which ports of the fifth component were used to establish simultaneous connections with a plurality of other components of the computer network.

7. The method of claim 1, further comprising generating at least one other hypothesis about a relationship between a fifth component and a sixth component based on:

detecting which communications of the fifth component are established between applications executing on the fifth component;

identifying, from the intercepted network communications, a communication of the applications on the fifth component with at least one application of the sixth component; and

identifying a relationship between the fifth component and the sixth component based on the identified communication.

8. The method of claim 1, further comprising generating at least one other hypothesis about a fifth component based on:

detecting a quantity of communications established by the fifth component; and

determining whether the quantity of communications qualifies the fifth component as a predefined type of component.

9. The method of claim 1, further comprising generating at least one other hypothesis about a fifth component based on

detecting one or more applications installed on the fifth component;

and

determining whether the installed application qualifies the fifth component as predefined type of component.

10. The method of claim 1, further comprising generating at least one other hypothesis of a relationship between applications of at least two components by determining a type of relationship between components based on:

one or more communications of a process on one of the components with another of the components;

one or more communications between processes on one of the components; and

one or more ports used in the one or more communications of the process on the one of the components with the another component.

11. The method of claim 1, further comprising generating an indication of reliability for at least the first or the second hypothesis.

12. The method of claim 1, further comprising enabling user intervention to select a relationship from at least two generated hypotheses of relationships.

13. The method of claim 1 wherein generating the first hypothesis is performed without accessing the second component.

14. A program storage device, readable by a programmable control device, comprising instructions stored on the program storage device for causing the programmable control device to:

collect at least partial data pertaining to components of a computer network;

determine communication information and application information from the collected data, at least some of the communication information being extracted from intercepted network communications occurring between the components, the application information pertaining to at least some applications executing on the components;

identifying a first application installed on a first component of the computer network based on the communication information and the application information;

determining, based on the communication information, ports used on the first component that are characteristic of a type of communication protocol associated with the first application;

determining a subset of the determined ports that are used in communications intercepted between the first component and a second component of the computer network;

generate at least a first hypothesis of a relationship between one or more second applications of the second component and the first application by determining that the second applications are capable of communicating with the first application via the communication protocol;

generate at least a second hypothesis of an application executing on a third component based on determining a collection of ports used in the intercepted network communications on the third component and what one or more fourth components or applications were communicating with the collection of ports;

generate a schematic of components based at least on the first hypothesis and the second hypothesis;

match a template of known components to at least a portion of the schematic; and

use characteristics associated with the template to determine that components represented in the portion of the schematic constitute the known components.

15. The program storage device of claim 14, wherein the instructions to collect comprise instructions to obtain the collected data from a database.

16. Network discovery system, comprising:

a communication network;

a plurality of components operatively coupled to the communication network;

a programmable control device operatively coupled to the communication network; and

a storage device operatively coupled to programmable control device, the storage device having stored therein program instructions for causing the programmable control device to;

collect at least partial data pertaining to components of a computer network,

determine communication information and application information from the collected data, at least some of the communication information being taken from intercepted communications occurring between the network components, the application information pertaining to at least some applications executing on the components,

identify a first application installed on a first component of the computer network based on the communication information and the application information;

determine, based on the communication information, ports used on the first component that are characteristic of a type of communication protocol associated with the first application;

determine a subset of the determined ports that are used in communications intercepted between the first component and a second component of the computer network;

generate at least a first hypothesis of a relationship between one or more second applications of the second component and the first application by determining that the second applications are capable of communicating with the first application via the communication protocol;

generate at least a second hypothesis of an application executing on a third component based on determining a collection of ports used in the intercepted network communications on the third component and what one or more fourth components or applications were communicating with the collection of ports;

generate a schematic of components based at least on the first hypothesis and the second hypothesis;

match a template of known components to at least a portion of the schematic; and

use characteristics associated with the template to determine that components represented in the portion of the schematic constitute the known components.

17. The network discovery system of claim 16, wherein the instructions to collect comprise instructions to obtain the collected data from a database.

18. A computer-implemented network discovery method, comprising:

collecting data from a computer network, including from intercepted network communications occurring between components;

identifying determinable information pertaining to at least some components, ports, communications, and applications that can be determined from the collected data;

determining which one or more ports on a first component were associated in the intercepted communications with which of one or more applications executing on the first component by associating a port characteristic with a type of communication protocol or application and determining that the first application is of the type;

determining which one or more of the associated ports were used to communicate with one or more ports of a second component; and

assessing which one or more second applications are capable of communicating with or are compatible with the first application on the first component based on the ports of the first component and the ports of the second component used in the intercepted communications; and

generating at least a first hypothetical relationship between the first component and the second component based on the assessing;

generating at least a second hypothesis of an application executing on a third component based on determining a collection of ports used in the intercepted network communications on the third component and what one or more fourth components or applications were communicating with the collection of ports; and

generating at least a third hypothetical relationship by;

generating a schematic of components of the computer network using the determinable information and the collected data,

matching a template of known components in a known relationship to at least a portion of the schematic, and

using characteristics associated with the template to generate the at least one hypothetical relationship between components of the schematic matching the template.

19. The method of claim 18, wherein the act of collecting comprises exploring the computer network with one or more discovery technologies.

20. The method of claim 18, wherein the act of identifying determinable information comprises determining one or more of:

listening ports of components, ports of components for several clients, opened port ranges of components, port ranges of components communicating with port ranges of other components, and port ranges of components communicating with individual ports of other components.

21. The method of claim 18, wherein the act of identifying determinable information comprises filtering the intercepted network communications occurring between components to isolate communications that use one or more predefined ports.

22. The method of claim 18, wherein the act of identifying determinable information comprises filtering the intercepted network communications occurring between components to remove communications that use one or more predefined ports.

23. The method of claim 18, wherein the act of identifying determinable information comprises qualifying a component as an identified type based on a type of communication established by the component in the intercepted network communications, a quantity of communications established by the component in the intercepted network communications, one or more identified applications installed on the component, or one or more ports used on the component in the intercepted network communications.

24. The method of claim 18, further comprising establishing at least one reliable relationship between at least two of the components by:

determining ports used by one or more applications on the at least two components;

determining which ports are used to communicate between the at least two components; and

establishing a reliable relationship between the at least two components based on the applications associated with the ports used to communicate between the at least two components.

25. The method of claim 18, further comprising generating an indication of reliability for the at least one hypothetical relationship.

26. The method of claim 18, further comprising enabling user intervention to select a relationship from at least two hypothetical relationships.

27. A network discovery system, comprising:

a storage system for storing program instructions; and

a programmable control device operatively coupled to the storage system,

wherein the program instructions stored on the storage system cause the programmable control device to;

collect data from a computer network, including from intercepted network communications occurring between components,

determine that one or more ports of a first component were associated in the intercepted communications with a first application executing on the first component by associating a port characteristic with a type of communication protocol or application and determining that the first application is of the type,

determine that one or more of the ports of the first component were used to communicate with one or more ports on a second component,

assess which one or more second applications are capable of communicating with or are compatible with the first application on the first component based on the ports of the first component and the ports of the second component used in the intercepted communications,

generate at least a first hypothetical relationship between the first component and the second component based on the assessing;

generating at least a second hypothesis of an application executing on a third component based on determining a collection of ports used in the intercepted network communications on the third component and what one or more fourth components or applications were communicating with the collection of ports; and

generating at least one other hypothetical relationship by;

generating a schematic of components of the computer network using the determinable information and the collected data,

matching a template of known components in a known relationship to at least a portion of the schematic, and

using characteristics associated with the template to generate the at least one hypothetical relationship between components of the schematic matching the template.

28. A program storage device, readable by a programmable control device, comprising instructions stored on the program storage device for causing the programmable control device to:

collect data from a computer network, including from intercepted network communications occurring between components;

determine that one or more ports of a first component were associated in the intercepted communications with a first application executing on the first component by associating a port characteristic with a type of communication protocol or application and determining that the first application is of the type;

determine that one or more of the ports of the first component were used to communicate with one or more ports on a second component;

assess which one or more second applications are capable of communicating with or are compatible with the first application on the first component based on the ports of the first component and the ports of the second component used in the intercepted communications;

generate at least a first hypothetical relationship between the first component and the second component based on the assessing;

generating at least a second hypothesis of an application executing on a third component based on determining a collection of ports used in the intercepted network communications on the third component and what one or more fourth components or applications were communicating with the collection of ports; and

generating at least one other hypothetical relationship by;

generating a schematic of components of the computer network using the determinable information and the collected data,

matching a template of known components in a known relationship to at least a portion of the schematic, and

using characteristics associated with the template to generate the at least one hypothetical relationship between components of the schematic matching the template.

29. The program storage device of claim 28, further comprising instructions stored on the program storage device for causing the programmable control device to establish at least one reliable relationship between at least two of the components by:

determining ports used by one or more applications on the at least two components;

determining which ports are used to communicate between the at least two components; and

establishing a reliable relationship between the at least two components based on the applications associated with the ports used to communicate between the at least two components.

30. The program storage device of claim 28, further comprising instructions stored on the program storage device for causing the programmable control device to:

detect a quantity of communications from the intercepted network communications established by a fifth component; and

generate at least another hypothesis that the fifth component is a predefined type of component when the quantity of communications qualifies the component as the predefined type of component.