System and method for network topology and flow visualization
First Claim
1. A method for visualizing a network data communication flow over a network topology, comprising:
- obtaining device configuration data from device information tables of a plurality of network devices within a network;
analyzing the obtained device configuration data to identify interfaces of each of the plurality of network devices, the interfaces including physical interfaces and logical interfaces;
generating a topology view of the network on a visual display of a computer system, wherein the topology view includes subnet objects, network device objects, physical interface objects within the network device objects, and logical interface objects within some network device objects;
acquiring a plurality of network data communication flow records from each of the plurality of network devices within the network for a specified time period,wherein each of the plurality of network data communication flow records is associated with a corresponding one of the plurality of network devices, andwherein each of the plurality of network data communication flow records includes information about network traffic flowing through the corresponding one of the plurality of network devices to which the network data communication flow record is associated, andwherein each of the plurality of network data communication flow records is generated and stored by the corresponding one of the plurality of network devices to which the network data communication flow record is associated, andwherein each of the plurality of network data communication flow records is generated and stored separate from the network traffic flowing through the corresponding one of the plurality of network devices to which the network data communication flow record is associated, andwherein each of the plurality of network data communication flow records includes data fields for1) an identifier of an ingress interface through which the network traffic entered the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and2) an identifier of an egress interface through which the network traffic exited the corresponding one of the plurality of network devices to which the network data communication flow record is associated or an identifier of an internal interface at which the network traffic terminated within the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and3) an internet protocol source address for the network traffic, and4) an internet protocol destination address for the network traffic, and5) a source port for the network traffic, and6) a destination port for the network traffic;
correlating separate ones of the plurality of network data communication flow records acquired from different ones of the plurality of network devices in the network based on content of the data fields so as to create a common network data communication flow record as a combination of the correlated separate ones of the plurality of network data communication flow records,wherein each of the separate ones of the plurality of network data communication flow records within the common network data communication flow record has1) identical content in the data field for the internet protocol source address for the network traffic, and2) identical content in the data field for the internet protocol destination address for the network traffic, and3) identical content in the data field for the source port for the network traffic, and4) identical content in the data field for the destination port for the network traffic;
repeating the correlating of separate ones of the plurality of network data communication flow records based on content of the data fields so as to create a plurality of common network data communication flow records;
aggregating some of the plurality of common network data communication flow records based on identical content in one or more data fields of the plurality of common network data communication flow records to create an aggregated network communication flow record-; and
rendering in the topology view of the network on the visual display a graphical representation of the aggregated network communication flow record in lieu of rendering graphical representations of the plurality of common network data communication flow records represented by the aggregated network communication flow record, the graphical representation of the aggregated network communication flow record including one or more arrows to represent a data communication path traversed through some of the plurality of network devices by network flows represented by the aggregated network communication flow record, the graphical representation of the aggregated network communication flow record including at least one arrow extending between two internal interfaces of a given one of the plurality of network devices.
3 Assignments
0 Petitions
Accused Products
Abstract
A topology view of a network is generated on a visual display of a computer system. The topology view includes subnet objects, network device objects, and interface objects within the network device objects. Network flow records are acquired from each device within the network. Separate network flow records acquired from different devices in the network are correlated together into a common network flow record. Each of the separate network flow records shares a common source address and a common destination address. The common network flow record specifies transmission path segments of a communication through the network. The common network flow is rendered in the visual display over the topology view of the network by displaying an arrow for each transmission path segment traversed by the communication through the network.
-
Citations
21 Claims
-
1. A method for visualizing a network data communication flow over a network topology, comprising:
-
obtaining device configuration data from device information tables of a plurality of network devices within a network; analyzing the obtained device configuration data to identify interfaces of each of the plurality of network devices, the interfaces including physical interfaces and logical interfaces; generating a topology view of the network on a visual display of a computer system, wherein the topology view includes subnet objects, network device objects, physical interface objects within the network device objects, and logical interface objects within some network device objects; acquiring a plurality of network data communication flow records from each of the plurality of network devices within the network for a specified time period, wherein each of the plurality of network data communication flow records is associated with a corresponding one of the plurality of network devices, and wherein each of the plurality of network data communication flow records includes information about network traffic flowing through the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and wherein each of the plurality of network data communication flow records is generated and stored by the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and wherein each of the plurality of network data communication flow records is generated and stored separate from the network traffic flowing through the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and wherein each of the plurality of network data communication flow records includes data fields for 1) an identifier of an ingress interface through which the network traffic entered the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and 2) an identifier of an egress interface through which the network traffic exited the corresponding one of the plurality of network devices to which the network data communication flow record is associated or an identifier of an internal interface at which the network traffic terminated within the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and 3) an internet protocol source address for the network traffic, and 4) an internet protocol destination address for the network traffic, and 5) a source port for the network traffic, and 6) a destination port for the network traffic; correlating separate ones of the plurality of network data communication flow records acquired from different ones of the plurality of network devices in the network based on content of the data fields so as to create a common network data communication flow record as a combination of the correlated separate ones of the plurality of network data communication flow records, wherein each of the separate ones of the plurality of network data communication flow records within the common network data communication flow record has 1) identical content in the data field for the internet protocol source address for the network traffic, and 2) identical content in the data field for the internet protocol destination address for the network traffic, and 3) identical content in the data field for the source port for the network traffic, and 4) identical content in the data field for the destination port for the network traffic; repeating the correlating of separate ones of the plurality of network data communication flow records based on content of the data fields so as to create a plurality of common network data communication flow records; aggregating some of the plurality of common network data communication flow records based on identical content in one or more data fields of the plurality of common network data communication flow records to create an aggregated network communication flow record-; and rendering in the topology view of the network on the visual display a graphical representation of the aggregated network communication flow record in lieu of rendering graphical representations of the plurality of common network data communication flow records represented by the aggregated network communication flow record, the graphical representation of the aggregated network communication flow record including one or more arrows to represent a data communication path traversed through some of the plurality of network devices by network flows represented by the aggregated network communication flow record, the graphical representation of the aggregated network communication flow record including at least one arrow extending between two internal interfaces of a given one of the plurality of network devices. - View Dependent Claims (2, 3, 4, 5, 6, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21)
-
-
7. A computer system for visualizing a network data communication flow over a network topology, comprising:
-
a device information management module defined to obtain device configuration data from device information tables of a plurality of network devices within a network; a network visualization module defined to analyze the obtained device configuration data to identify interfaces of each of the plurality of network devices, the interfaces including physical interfaces and logical interfaces, and to identify subnets to which the interfaces connect, and further defined to render in a visual display a topology view of the network including graphical representations of the subnets, the network devices, the physical interfaces within the network devices, the logical interfaces within the network devices; a network flow collection management module defined to acquire a plurality of network data communication flow records from each of the plurality of network devices within the network for a specified time period, wherein each of the plurality of network data communication flow records is associated with a corresponding one of the plurality of network devices, and wherein each of the plurality of network data communication flow records includes information about network traffic flowing through the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and wherein each of the plurality of network data communication flow records is generated and stored by the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and wherein each of the plurality of network data communication flow records is generated and stored separate from the network traffic flowing through the corresponding one of the plurality of network device to which the network data communication flow record is associated, and wherein each of the plurality of network data communication flow records includes data fields for 1) an identifier of an ingress interface through which the network traffic entered the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and 2) an identifier of an egress interface through which the network traffic exited the corresponding one of the plurality of network devices to which the network data communication flow record is associated or an identifier of an internal interface at which the network traffic terminated within the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and 3) an internet protocol source address for the network traffic, and 4) an internet protocol destination address for the network traffic, and 5) a source port for the network traffic, and 6) a destination port for the network traffic; a network flow correlation module defined to correlate separate ones of the plurality of network data communication flow records acquired from different ones of the plurality of network devices in the network based on content of the data fields so as to create a common network data communication flow record as a combination of the correlated separate ones of the plurality of network data communication flow records, wherein each of the separate ones of the plurality of network data communication flow records within the common network data communication flow record has 1) identical content in the data field for the internet protocol source address for the network traffic, and 2) identical content in the data field for the internet protocol destination address for the network traffic, and 3) identical content in the data field for the source port for the network traffic, and 4) identical content in the data field for the destination port for the network traffic, the network flow correlation module defined to repeat the correlating of separate ones of the plurality of network data communication flow records based on content of the data fields so as to create a plurality of common network data communication flow records, the network flow correlation module defined to aggregate some of the plurality of common network data communication flow records based on identical content in one or more data fields of the plurality of common network data communication flow records to create an aggregated network communication flow record, and wherein the network visualization module is defined to render in the topology view of the network on the visual display a graphical representation of the aggregated network communication flow record in lieu of rendering graphical representations of the plurality of common network data communication flow records represented by the aggregated network communication flow record, the graphical representation of the aggregated network communication flow record including one or more arrows to represent a data communication path traversed through some of the plurality of network devices by network flows represented by the aggregated network communication flow record, the graphical representation of the aggregated network communication flow record including at least one arrow extending between two internal interfaces of a given one of the plurality of network devices. - View Dependent Claims (8, 9, 10)
-
Specification