Determining data flows in a network

• US 8,898,265 B2
• Filed: 06/22/2006
• Issued: 11/25/2014
• Est. Priority Date: 06/24/2005
• Status: Expired due to Fees

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Cooper, Mark
• Primary Examiner(s): KHAJURIA, SHRIPAL K
• Application Number:
  US11/474,117
• Publication Number:
  US 20070016670A1
• Time in Patent Office: 3,078 Days
• Field of Search: 709/223, 709/224
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/12 Network monitoring probes

Abstract

Information about processes executing on a server together with network traffic and network state information such as ARP and routing tables is collected on each server in a network using a small piece of remote software running on the server. This information is sent to or gathered by a central collating and decoding program, which also obtains information from intervening network devices, such as routing tables, access control lists, load balancer maps and so on. This information is decoded to predict how the network traffic would look at all points in the network.

Claims

1. A system for determining data flows within a network configuration, the network configuration comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, each of the nodes having a plurality of processes executing thereon, the system comprising:

a plurality of remote agents configured to gather information about corresponding ones of the plurality of nodes, wherein the gathered information at each of the plurality of nodes includes a list of the processes at the corresponding node and network traffic samples of network traffic captured at the corresponding node; and

a mapping engine configured to receive the gathered information from each of the remote agents, wherein the mapping engine is configured to determine the data flows based on the gathered information from the remote agents and configuration information relating to the network devices, wherein the configuration information comprises information defining how a network device processes data arriving at the network device,

wherein each of the remote agents is located at a corresponding one of the nodes and is configured to obtain information about the processes executing on the corresponding node.

2. A system according to claim 1, wherein the mapping engine is configured to receive from the remote agents, the configuration information.

3. A system according to claim 1, wherein the mapping engine is configured to receive the configuration information from sources other than from the remote agents.

4. A system according to claim 3, wherein the mapping engine is configured to receive the configuration information by one or more of periodic uploading of configuration files into the mapping engine, polling a storage area for the configuration files, querying the network devices, monitoring of network updates of the network devices, and reception of update messages from the network devices.

5. A system according to claim 1, wherein the nodes comprise endnodes, said endnodes comprising respective servers on which a plurality of applications are executable, each of said applications giving rise to one or more processes.

6. A system according to claim 1, wherein the list of the processes in the gathered information comprises at least one of a list of processes currently executing in the respective node and a list of processes in the respective node communicating over the network configuration.

7. A system according to claim 6, wherein the gathered information from each of the remote agents further comprises network interface details for each network interface supported by the respective node.

8. A system according to claim 1, wherein the gathered information from each of the remote agents further comprises routing information defining how data packets are routed from the respective node to a destination.

9. The system of claim 1, wherein the configuration information includes routing tables of the corresponding network devices through which data between the nodes is routed.

10. The system of claim 9, wherein the configuration information includes network address translation tables of the corresponding network devices.

11. The system of claim 10, wherein the configuration information includes access control lists of the corresponding network devices.

12. The system of claim 1, wherein the gathered information from each of the nodes includes translation information to translate between an Internet Protocol (IP) address and a Media Access Control (MAC) address.

13. The system of claim 1, wherein the mapping engine is configured to provide output to cause graphical representation of the data flows, wherein the graphical representation of each of the data flows shows an end-to-end network path including one or more of the network devices between corresponding nodes.

14. A system for determining data flows within a network configuration, the network configuration comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, each of the nodes having a plurality of processes executing thereon, the system comprising:

a plurality of remote agents configured to gather information about corresponding ones of the plurality of nodes, wherein the gathered information at each of the plurality of nodes includes a list of the processes at the corresponding node and network traffic samples of network traffic captured at the corresponding node; and

a mapping engine configured to receive the gathered information from each of the remote agents, wherein the mapping engine is configured to determine the data flows based on the gathered information from the remote agents and configuration information relating to the network devices,

wherein each of the remote agents is located at a corresponding one of the nodes and is configured to obtain information about the processes executing on the corresponding node, wherein the system is configured to link the determined data flows to one or more of the processes executing on one of the nodes.

15. A system according to claim 14, configured to link the determined data flows to an application executing on the one node based on processes started by the application.

16. A method for determining data flows within a network configuration, the network configuration comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, the method comprising:

gathering information about each of the plurality of nodes using a remote agent at each of the plurality of nodes, the gathered information comprising information about a plurality of processes executing on each of the plurality of nodes and routing information for routing data packets at each of the plurality of nodes;

receiving the gathered information from each of the remote agents at a mapping engine on a further node, the mapping engine determining the data flows based on the gathered information from the remote agents and configuration information relating to the network devices; and

linking, using the information about the plurality of processes, the data flows to one or more processes executing on one or more of the plurality of nodes.

17. A method according to claim 16, further comprising displaying the data flows in real-time.

18. A method according to claim 16, wherein the gathered information about each of the plurality of nodes further comprises network traffic samples of network traffic captured at the corresponding nodes.

19. A method according to claim 16, wherein the gathered information about each of the plurality of nodes includes translation information to translate between an Internet Protocol (IP) address and a Media Access Control (MAC) address.

20. A method according to claim 16, wherein the configuration information includes routing tables of the corresponding network devices through which data between the nodes is routed.

21. A method according to claim 20, wherein the configuration information includes network address translation tables of the corresponding network devices.

22. A method according to claim 21, wherein the configuration information includes access control lists of the corresponding network devices.

23. A method according to claim 16, further comprising the mapping engine providing output to cause graphical representation of the data flows, wherein the graphical representation of each of the data flows shows an end-to-end network path including one or more of the network devices between corresponding nodes.

24. A system for determining data flows within a network configuration, the network configuration comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, each of the nodes having a plurality of processes executing thereon, the system comprising:

a plurality of remote agents configured to gather information about corresponding ones of the plurality of nodes, wherein the gathered information at each of the plurality of nodes includes a list of the processes at the corresponding node and network traffic samples of network traffic captured at the corresponding node; and

a mapping engine configured to receive the gathered information from each of the remote agents, wherein the mapping engine is configured to determine the data flows based on the gathered information from the remote agents and configuration information relating to the network devices,

wherein each of the remote agents is located at a corresponding one of the nodes and is configured to obtain information about the processes executing on the corresponding node,

wherein the mapping engine is configured to link the data flows to corresponding ones of the processes based on the lists of processes gathered by the remote agents.

25. A system for determining data flows within a network configuration, the network configuration comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, each of the nodes having a plurality of processes executing thereon, the system comprising:

a plurality of remote agents configured to gather information about corresponding ones of the plurality of nodes, wherein the gathered information at each of the plurality of nodes includes a list of the processes at the corresponding node and network traffic samples of network traffic captured at the corresponding node; and

a mapping engine configured to receive the gathered information from each of the remote agents, wherein the mapping engine is configured to determine the data flows based on the gathered information from the remote agents and configuration information relating to the network devices,

wherein each of the remote agents is located at a corresponding one of the nodes and is configured to obtain information about the processes executing on the corresponding node,

wherein the mapping engine is configured to predict a form of a data packet in a link between one of the nodes and one of the network devices based on the configuration information, wherein the predicted form of the data packet includes a predicted address contained in the data packet.

26. A method for determining data flows within a network configuration, the network configuration comprising a plurality of nodes and a plurality of network devices through which data is routed between the nodes, the method comprising:

gathering information about each of the plurality of nodes using a remote agent at each of the plurality of nodes, the gathered information comprising information about a plurality of processes executing on each of the plurality of nodes and routing information for routing data packets at each of the plurality of nodes;

receiving the gathered information from each of the remote agents at a mapping engine on a further node, the mapping engine determining the data flows based on the gathered information from the remote agents and configuration information relating to the network devices; and

the mapping engine predicting a form of a data packet on a link between one of the nodes and one of the network devices based on the configuration information, wherein the predicted form of the data packet includes a predicted address contained in the data packet.