Probe election in failover configuration

• US 9,049,118 B2
• Filed: 11/11/2013
• Issued: 06/02/2015
• Est. Priority Date: 09/03/2009
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Narasimhan, Srinivasan
• Primary Examiner(s): SHINGLES, KRISTIE D
• Application Number:
  US14/077,169
• Publication Number:
  US 20140075022A1
• Time in Patent Office: 568 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity

Abstract

A first sensor transmits one or more probes to a host device identified on a network, each probe used to obtain information regarding the host and the plurality of probes are prioritized according to probe type. A set of replies to the plurality of probes are received and it is determined that a first of the plurality of probes is the highest priority probe for which a reply from the host device was received. A second probe transmitted by a second sensor is identified as the highest priority probe for which a reply from the host device was received by the second sensor, where the first sensor is designated as a primary sensor and the second sensor is designated as a secondary sensor. Respective priorities of the probe types of the first and second probes are compared to determine whether to perform a probe handover to the second sensor.

Claims

1. At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

transmit, using a first network traffic sensor, a plurality of information probes to a host device identified on a network, wherein each information probe in the plurality of information probes is used to obtain information regarding the host and the plurality of information probes are prioritized according to probe type;

receive a set of replies to the plurality of information probes;

determine that a first information probe in the plurality of information probes is the highest priority information probe for which a reply from the host device was received by the first network traffic sensor in the set of replies, wherein the first information probe is of a first probe type;

identify that a second information probe transmitted by a second network traffic sensor is the highest priority information probe for which a reply from the host device was received by the second network traffic sensor, wherein the second information probe is of a second probe type, the first network traffic sensor is designated as a primary sensor, and the second network traffic sensor is designated as a secondary sensor; and

compare relative priority of the first probe type to priority of the second probe type to determine whether to perform a probe handover to the second network traffic sensor.

2. The storage medium of claim 1, wherein further probing of the host device by the primary sensor is precluded after the probe handover.

3. The storage medium of claim 1, wherein the host device is to be monitored by the primary sensor if the first probe type has a higher priority than the second probe type.

4. The storage medium of claim 1, wherein the probe handover is to be performed if the first probe type has a lower priority than the second probe type.

5. The storage medium of claim 1, wherein the second network traffic sensor is to monitor the host device following the probe handover.

6. The storage medium of claim 1, wherein the host device is to be monitored by the primary sensor if the first probe type has equal priority as the second probe type.

7. The storage medium of claim 6, wherein the instructions when executed on a machine, further cause the machine to:

determine, from monitoring of the host device by the first network traffic sensor, that the host device is offline; and

perform the probe handover based at least in part on the determination that the host device is offline and that the first probe type has equal priority as the second probe type.

8. The storage medium of claim 1, wherein the instructions when executed on a machine, further cause the machine to maintain a host table for the primary sensor.

9. The storage medium of claim 8, wherein a record for the host device is to be deleted from the host table of the primary sensor in response to detecting that the host device is offline.

10. The storage medium of claim 9, wherein the first network traffic sensor detects that the host device is offline and the instructions when executed on a machine, further cause the machine to communicate to the second network traffic sensor that the host device is offline, wherein the second network traffic sensor is to delete a record for the host device from a second host table maintained for the second network traffic sensor.

11. The storage medium of claim 1, wherein the instructions when executed on a machine, further cause the machine to identify from data received from the second network traffic sensor that the second information probe transmitted by the second network traffic sensor is the highest priority information probe for which a reply from the host device was received by the second network traffic sensor.

12. The storage medium of claim 1, wherein performing the probe handover causes designation as primary sensor to pass from the first network traffic sensor to the second network traffic sensor.

13. The storage medium of claim 1, wherein the instructions when executed on a machine, further cause the machine to transmit data from the first network traffic sensor to the second network traffic sensor indicating the first probe type to the second network traffic sensor.

14. The storage medium of claim 1, wherein a set comprising the plurality of information probes and the second information probe include an agent probe, an NBTSTAT query, and an IMCP ping.

15. The storage medium of claim 14, wherein the probe type of the agent probe is the highest priority probe type and the probe type of the IMCP ping is lower in priority than the probe type of the NBTSTAT query.

16. A method comprising:

transmitting, using a first network traffic sensor, a plurality of information probes to a host device identified on a network, wherein each information probe in the plurality of information probes is used to obtain information regarding the host and the plurality of information probes are prioritized according to probe type;

receiving a set of replies to the plurality of information probes;

determining that a first information probe in the plurality of information probes is the highest priority information probe for which a reply from the host device was received by the first network traffic sensor in the set of replies, wherein the first information probe is of a first probe type;

identifying that a second information probe transmitted by the second network traffic sensor is the highest priority information probe for which a reply from the host device was received by the second network traffic sensor, wherein the second information probe is of a second probe type, the first network traffic sensor is designated as a primary sensor, and the second network traffic sensor is designated as a secondary sensor; and

comparing relative priority of the first probe type to priority of the second probe type to determine whether to perform a probe handover to the second network traffic sensor.

17. The method of claim 16, further comprising precluding further probing of the host device by the primary sensor after a probe handover.

18. The method of claim 16, wherein identifying that a second information probe transmitted by the second network traffic sensor is the highest priority information probe for which a reply from the host device was received by the second network traffic sensor comprises receiving data from a second network traffic sensor indicating that the second information probe transmitted by the second network traffic sensor is the highest priority information probe for which a reply from the host device was received by the second network traffic sensor.

19. A system comprising:

a first network traffic sensor designated as a primary sensor, the first network traffic sensor to transmit a first set of information probes to a host device identified on a network;

a second network traffic sensor designated as a secondary sensor, the second network traffic sensor to transmit a second set of information probes to the host device;

wherein each information probe is used to obtain information regarding the host and is prioritized according to probe type, and the first network traffic sensor includes logic to;

determine that a first information probe in the first set of information probes is the highest priority information probe for which a reply from the host device was received by the first network traffic sensor, wherein the first information probe is of a first probe type;

receive data from the second network traffic sensor indicating that a second information probe transmitted by the second network traffic sensor is the highest priority information probe for which a reply from the host device was received by the second network traffic sensor, wherein the second information probe is of a second probe type; and

compare relative priority of the first probe type to priority of the second probe type to determine whether to perform a probe handover to the second network traffic sensor.

20. The system of claim 19, wherein the logic is further to perform the probe handover by transmitting, to the second network traffic sensor, data indicating a probe handover to the second network traffic sensor.

21. The system of claim 19, wherein the network traffic sensor designated as the primary sensor is to perform monitoring of the host device and a probe handover causes designation of the primary sensor to be passed from the first network traffic sensor to the second network traffic sensor.

22. The system of claim 19, wherein each of the first and second network traffic sensors each include respective logic to monitor the host device.