Explicit logging of network user node/target node coupling

• US 8,903,970 B2
• Filed: 04/02/2008
• Issued: 12/02/2014
• Est. Priority Date: 04/02/2008
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Krelle, Brian E.
• Primary Examiner(s): DOAN, DUYEN MY
• Application Number:
  US12/061,222
• Publication Number:
  US 20090252056A1
• Time in Patent Office: 2,435 Days
• Field of Search: 709/223, 709/227
• US Class Current: 709/223
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

An Edge switch. The edge switch includes a first module configured to receive multiple coupling signals from at least one user node. a second module, and a log. For each coupling signal, the coupling signal indicates coupling one of the at least one user nodes to one of at least one target nodes via one of at least one proxy servers, the first module is configured to determine an identity of the one of the at least one user nodes and an identity of the one of the at least one target nodes from the coupling signal, and the second module is configured to record the identity of the one of the at least one user nodes, the identity of the one of the at least one target nodes, and date and time at which the coupling signal was processed by the edge switch in an entry in the log.

Claims

1. An edge switch in a network, comprising:

a first module including logic configured to receive multiple coupling signals from at least one user node;

a second module including logic, wherein for multiple coupling signals the coupling signals indicates indicating coupling of one of the at least one user nodes to multiple, different target nodes on different network devices via one of at least one proxy servers separate from the edge switch;

wherein, the first module is configured to;

determine an identity of the one of the at least one user nodes and an identity of the multiple, different target nodes from the multiple coupling signals,

recognize that the multiple, different target nodes are a final intent of coupling for the one of the at least one user nodes, and not the one of the at least one proxy servers separate from the edge switch, by extracting information from differing locations within the multiple coupling signals, and

communicate the identity directly to a log in the edge switch;

wherein, the second module includes logic configured to record the identity of the one of the at least one user nodes, the identity of the multiple, different target nodes on different network devices, and a date and a time at which the multiple coupling signals were processed by the edge switch in an entry in the log; and

wherein the log is maintained in a memory on the edge switch.

2. The edge switch as recited in claim 1, wherein the second module is further configured to record in the entry an identity of a user assigned to the one of the at least one user nodes.

3. The edge switch as recited in claim 2, wherein if one of the entries in the log comprises information regarding the coupling of the user assigned to the one of the at least one user nodes to one of the multiple, different target nodes and an additional coupling signal is received indicating coupling of the user assigned to the one of the at least one user nodes to the one of the multiple, different target nodes, the second module is further configured to combine information from the additional coupling signal with the entry that comprises the information regarding the coupling of the user assigned to the one of the at least one user nodes to the one of the multiple, different target nodes.

4. The edge switch as recited in claim 1, wherein if one of the entries in the log comprises information regarding the coupling of one of the at least one user nodes to one of the multiple, different target nodes and an additional coupling signal is received indicating coupling of the one of the at least one user nodes to the one of the multiple, different target nodes, the second module is further configured to combine information from the additional coupling signal with the entry that comprises the information regarding the coupling of the one of the at least one user nodes to the one of the multiple, different target nodes.

5. The edge switch as recited in claim 1, further comprising:

a third module including logic configured to transmit at least one selected entry from the log to a separate log server.

6. The edge switch as recited in claim 1, further comprising:

a fifth module including logic configured to remove one or more selected entries from the log.

7. The edge switch as recited in claim 1, wherein the first module is further configured to receive multiple decoupling signals, wherein for each decoupling signal the decoupling signal indicates decoupling any one of the at least one user nodes from any one of the multiple, different target nodes via any one of the at least one proxy servers, the first module is further configured to determine an identity of the any one of the at least one user nodes and an identity of the any one of the multiple, different target nodes from the decoupling signal, and the second module is further configured to record the identity of the any one of the at least one user nodes, the identity of the any one of the multiple, different target nodes, and the date and the time at which the decoupling signal was processed by the edge switch in one of the entries in the log, and an indicator in the log, and wherein the indicator indicates that the entry is associated with a decoupling of the any one of the multiple, different target nodes from the any one of the at least one user nodes.

8. The edge switch as recited in claim 7, wherein the second module is further configured to record in the entry an identity of a user assigned to the any one of the at least one user nodes.

9. The edge switch as recited in claim 7, wherein if one of the entries in the log comprises information regarding the coupling or decoupling of a given one of the at least one user nodes to or from a given one of the multiple, different target nodes and an additional coupling signal, the decoupling signal, or an additional decoupling signal is received indicating coupling or decoupling of the given one of the at least one user nodes to or from the given one of the multiple, different target nodes, the second module is further configured to combine information from the additional coupling signal, the decoupling signal, or the additional decoupling signal with the entry that comprises the information regarding the coupling or decoupling of the given one of the at least one user nodes to or from the given one of the multiple, different target nodes.

10. The edge switch as recited in claim 1, further comprising:

a forwarding module including logic configured to transfer each coupling signal and/or each decoupling signal to the first module.

11. The edge switch as recited in claim 1, wherein coupling the one of at least one user nodes to the one of the multiple, different target nodes via the one of the at least one proxy servers enables simultaneously coupling the one of the at least one user nodes to other target nodes on different network devices via the one of the at least one proxy servers.

12. A method for use in a network, comprising:

coupling one of at least one user nodes to an edge switch;

coupling the edge switch to one of at least one proxy servers;

receiving multiple coupling signals, wherein the multiple coupling signals indicates a coupling of the one of the at least one user nodes to multiple, different target nodes on different network devices via the one of the at least one proxy servers;

determining the identity of the one of the at least one user nodes and the identity of the multiple, different target nodes from the multiple coupling signals;

receiving a date/time stamp, wherein the date/time stamp comprises date and time that the multiple coupling signals are processed by the edge switch; and

recording an entry in a log, wherein the entry comprises the identity of the one of the at least one user nodes, the identity of the multiple, different target nodes, and the date/time stamp, wherein the log is maintained in a location on the edge switch.

13. The method as recited in claim 12, further comprising:

recording in the entry an identity of a user assigned to the one of the at least one user nodes.

14. The method as recited in claim 13, further comprising:

if one of the entries in the log comprises information regarding the coupling of the user assigned to the one of the at least one user nodes to one of the multiple, different target nodes and an additional coupling signal is received indicating coupling of the user assigned to the one of the at least one user nodes to the one of the multiple, different target nodes, combining information from the additional coupling signal with the entry that comprises the information regarding the coupling of the user assigned to the one of the at least one user nodes to the one of the multiple, different target nodes.

15. The method as recited in claim 12, further comprising:

if one of the entries in the log comprises information regarding the coupling of one of the at least one user nodes to one of the multiple, different target nodes and an additional coupling signal is received indicating coupling of the one of the at least one user nodes to the one of the multiple, different target nodes, combining information from the additional coupling signal with the entry that comprises the information regarding the coupling of the one of the at least one user nodes to the one of the multiple, different target nodes.

16. The method as recited in claim 12, further comprising:

transmitting at least one selected entry from the log to a separate log server.

17. The method as recited in claim 12, further comprising:

removing one or more selected entries from the log.

18. The method as recited in claim 12, further comprising:

receiving a decoupling signal, wherein the decoupling signal indicates decoupling any one of the at least one user nodes from any one of the multiple, different target nodes via any one of the at least one proxy servers;

determining an identity of the any one of the at least one user nodes and an identity of the any one of the multiple, different target nodes from the decoupling signal; and

recording the identity of the any one of the at least one user nodes, the identity of the any one of the multiple, different target nodes, and the date and the time at which the decoupling signal was processed by the edge switch in one of the entries in the log, and an indicator in the log, wherein the indicator indicates that the entry is associated with the decoupling of the any one of the multiple, different target nodes from the any one of the at least one user nodes.

19. The method as recited in claim 18, further comprising:

recording in the entry an identity of a user assigned to the one of the at least one user nodes.

20. The method as recited in claim 18, further comprising:

if one of the entries in the log comprises information regarding the coupling or decoupling of a given one of the at least one user nodes to or from a given one of the multiple, different target nodes and an additional coupling signal, the decoupling signal, or an additional decoupling signal is received indicating coupling or decoupling of the given one of the at least one user nodes to or from the given one of the multiple, different target nodes, combining information from the additional coupling signal, the decoupling signal, or the additional decoupling signal with the entry that comprises the information regarding the coupling or decoupling of the given one of the at least one user nodes to or from the given one of the multiple, different target nodes.

21. The method as recited in claim 12, further comprising:

simultaneously with coupling the one of at least one user nodes to the one of the multiple, different target nodes via the one of the at least one proxy servers, coupling the one of the at least one user nodes to other target nodes on different network devices via the one of the at least one proxy servers.

22. A network device in a network, comprising:

logic to couple one of at least one user nodes to the network device;

logic to couple the network device to one of at least one proxy servers;

logic to receive multiple coupling signals, wherein the multiple coupling signals indicates a coupling of the one of the at least one user nodes to multiple, different target nodes on different network devices via the one of the at least one proxy servers;

logic to determine the identity of the one of the at least one user nodes and the identity of the multiple, different target nodes from the multiple coupling signals;

logic to receive a date/time stamp, wherein the date/time stamp comprises date and time that the multiple coupling signals are processed by the network device; and

logic to record an entry in a single log on the network device, wherein the entry comprises the identity of the one of the at least one user nodes, the identity of the multiple, different target nodes on different network devices coupled via the one of the at least one proxy servers, and the date/time stamp, wherein the log is maintained in a location on the network device.