Global flow tracking system

• US 8,854,988 B2
• Filed: 07/26/2011
• Issued: 10/07/2014
• Est. Priority Date: 08/28/2008
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Turk, Doughan
• Primary Examiner(s): Ngo, Ricky
• Assistant Examiner(s): SAMUEL, DEWANDA A
• Application Number:
  US13/190,526
• Publication Number:
  US 20110280150A1
• Time in Patent Office: 1,169 Days
• Field of Search: 370/230, 370/248, 370/249, 370/252
• US Class Current: 370/248
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A device may obtain a flow signature, identify a destination collector to which packets bearing the flow signature are sent, obtain a list of potential source collectors that may have sent the packets bearing the flow signature to the destination collector, and identify a source collector, among the potential source collectors, that sent the packets to the destination collector. In addition, the device may output information related to a path from the source collector the destination collector.

Claims

1. A method comprising:

identifying, by one or more devices, a flow signature;

identifying, by the one or more devices, a destination collector to which packets, including the flow signature, are sent;

identifying, by the one or more devices, a list of potential source collectors that are possible senders of the packets, including the flow signature, to the destination collector;

sending, by the one or more devices, flow match requests to a plurality of devices associated with the list of the potential source collectors;

receiving, by the one or more devices and from the plurality of devices, replies to the flow match requests;

determining, by the one or more devices and based on the replies, a list of verified collectors among the potential source collectors;

determining, by the one or more devices, that the list of verified collectors is not empty;

identifying, by the one or more devices and based on determining that the list of verified collectors is not empty, a source collector that is identified in the list of verified collectors and that sent the packets to the destination collector; and

outputting, by the one or more devices, information related to a path from the source collector to the destination collector.

2. The method of claim 1, where identifying the flow signature includes identifying one or more parameters that include at least one of:

a source address associated with the packets,

a destination address associated with the packets,

a source port number associated with the packets,

a destination port number associated with the packets, or

a protocol associated with the packets.

3. The method of claim 1, where identifying the flow signature further comprises:

identifying the flow signature from an alarm generated by an anomalous flow.

4. The method of claim 1, where identifying the list of the potential source collectors includes:

determining, from a global routing map, that a path exits from the potential source collectors to one or more of the identified verified collectors.

5. The method of claim 4, where identifying the list of the potential source collectors further includes:

identifying the list of the potential source collectors based on determining that the path exists from the one or more potential source collectors to the one or more of the identified verified collectors.

6. The method of claim 1, where the plurality of devices include devices that receive flow records that are exported from collectors.

7. The method of claim 1, where receiving the replies includes:

locating flow records that have been exported by collectors and that include the flow signature.

8. A device comprising:

a processor to;

trace a flow to a destination collector;

identify potential source collectors from which the flow may have been sent to the destination collector;

send flow match requests to a plurality of devices associated with the potential source collectors;

receive, from the plurality of devices, replies to the flow match requests;

determine, based on the replies, a list of verified collectors among the potential source collectors;

determine that the list of the verified collectors is not empty;

identify a particular collector, in the list of the verified collectors, based on determining that the list of verified collectors is not empty; and

output information related to the particular collector.

9. The device of claim 8, where the particular collector includes:

a server;

a gateway;

a switch;

or

a router.

10. The device of claim 8,

where the processor is further to:

receive an alarm triggered by a flow before tracing the flow to the destination collector, and

where the alarm includes;

a flow signature of an anomalous flow.

11. The device of claim 8, where the processor is further to:

determine a path based on a global routing map and the list of the verified collectors; and

output information related to the path.

12. The device of claim 11, where the global routing map includes:

a border gateway protocol (BGP) routing map.

13. The device of claim 8, where the flow includes:

a packet that is part of a denial of service attack;

a fake email message;

or

a spam email message.

14. The device of claim 8, further comprising:

a component to provide a user interface that includes;

a diagram of the particular collector, and

an autonomous system that includes the particular collector.

22. The device of claim 8, where the flow passed through the particular collector before passing through one or more other collectors of the verified collectors.

15. A system comprising:

a processor; and

a memory to store instructions, which when executed by the processor, cause the processor to;

identify a flow signature;

identify a destination collector associated with the flow signature;

identify a list of potential source collectors that possibly sent packets, including the flow signature, to the destination collector;

send flow match requests to a plurality of devices associated with the list of the potential source collectors;

receive, from the plurality of devices, replies;

determine, based on the replies, a list of verified collectors among the potential source collectors;

determine that the list of verified collectors is not empty;

identify, based on determining that the list of verified collectors is not empty, a source collector from the list of verified collectors; and

output information related to the source collector.

16. The system of claim 15, where the flow signature identifies at least one of:

a source address associated with the packets,

a destination address associated with the packets,

a source port number associated with the packets,

a destination port number associated with the packets, or

a protocol associated with the packets.

17. The system of claim 15, where the flow signature is obtained from an alarm generated by an anomalous flow.

18. The system of claim 15, where, when identifying the list of potential source collectors, the processor is to:

identify one or more of the potential source collectors; and

determine, from a global routing map, that a path exits from the one or more of the potential source collectors.

19. The system of claim 18, where, when identifying the source collector, the processor is to:

identify the source collector further based on the path.

20. The system of claim 15, where the plurality of devices include devices that receive flow records that are exported from collectors.

21. The system of claim 15, where, when receiving the replies, the processor is to:

locate flow records that have been exported by collectors and that include the flow signature.