Method and system for detecting changes in a network using simple network management protocol polling

• US 9,112,770 B2
• Filed: 08/01/2011
• Issued: 08/18/2015
• Est. Priority Date: 05/23/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sankaran, Ganesh Chennimalai
• Primary Examiner(s): Zong, Ruolei
• Application Number:
  US13/195,226
• Publication Number:
  US 20110289181A1
• Time in Patent Office: 1,478 Days
• Field of Search: 709/213, 709/223, 370/254
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

In an embodiment, methods and systems have been provided for detecting changes in a network using improved Simple Network Management Protocol (SNMP) polling that reduces network traffic. Examples of changes in the network include, but are not limited to, configuration and behavioral changes in a network device, and response of network device to a network change. A Network Management Station (NMS) periodically polls Management Information Base (MIB) groups instead of periodically polling individual MIB object instances. The NMS receives the Aggregate Change Identifiers (ACIs) of MIB groups in response to polling, from a SNMP agent. The changes in the received ACIs represent the changes in the MIB groups. A change in an MIB group represents changes in the MIB object instances of the MIB group. The ACIs can be checksum, timestamp, and a combination of number of MIB object instances in a group and checksum of the MIB group.

Claims

1. A method comprising:

accessing, at a network device in a network, information about update frequency of management information base (MIB) object instances that reflects a frequency at which values of the MIB object instances are updated during operation of the network device;

selecting, based on the information about the update frequency of the MIB object instances, a subset of the MIB object instances;

populating, at the network device, a MIB group with identifiers corresponding to the MIB object instances that are included in the selected subset;

receiving, from a network management system (NMS), a request for information about MIB object instances associated with the MIB group;

responsive to receiving the request, determining that at least one MIB object instance associated with the MIB group has changed;

based on determining the change in the at least one MIB object instance, modifying an existing aggregate change identifier (ACI) for the MIB group to reflect the change in the at least one MIB object instance, wherein an ACI is a checksum computed by aggregating configuration values of the MIB object instances associated with the MIB group, and wherein the existing ACI is computed based on a prior request from the NMS; and

sending the updated ACI to the NMS.

2. The method of claim 1, wherein modifying the ACI for the MIB group further includes marking as invalid the ACI for the MIB group.

3. The method of claim 1, wherein receiving the request for information from the NMS comprises:

responsive to receiving the request, determining that none of the MIB object instances associated with the MIB group has changed since an immediately preceding request from the NMS; and

based on determining that none of the MIB object instances has changed since the immediately preceding request from the NMS, sending the existing ACI to the NMS.

4. The method of claim 1, wherein selecting a subset of the MIB object instances comprises:

selecting MIB object instances for which at least one change indicates a condition selected from the group consisting of a configuration change of the network device, a behavioral change of the network device, and a response from the network device to a change in the network.

5. The method of claim 1, wherein the ACI is based on at least one parameter selected from one of a checksum of the MIB group, a timestamp of the MIB group, or a combination of a number of MIB object instances in the MIB group and checksum of the MIB group.

6. The method of claim 1, wherein the ACI has a size in memory that is one of a 32 byte word or a 64 byte word.

7. A method comprising:

polling a network device in a network, wherein the polling includes sending a request to the network device for information associated with a management information base (MIB) group, the MIB group including identifiers corresponding to MIB object instances included in the network device;

receiving, from the network device, an aggregate change identifier (ACI) that is associated with the MIB group, wherein the ACI is a checksum computed by aggregating configuration values of the MIB object instances associated with the MIB group;

comparing the received ACI with a cached ACI for the MIB group, wherein the cached ACI was received from the network device in response to a previous polling of the MIB group;

based on the comparing, determining that the received ACI is different from the cached ACI, indicating a change in at least one MIB object instance associated with identifiers included in the MIB group;

based on determining that the received ACI is different from the cached ACI, polling the network device to determine which MIB object instances associated with the MIB group have changed since the previous polling; and

replacing the cached ACI with the received ACI.

8. A system comprising:

a first network device including a first processor and a plurality of first instructions stored in a non-transitory machine-readable first medium for execution by the first processor, the plurality of first instructions when executed cause the first processor to perform operations including;

accessing, at the first network device in a network, information about update frequency of management information base (MIB) object instances that reflects a frequency at which values of MIB object instances are updated during operation of the first network device,

selecting, based on the information about the update frequency of the MIB object instances, a subset of the MIB object instances,

populating, at the network device, a MIB group with identifiers corresponding to the MIB object instances that are included in the selected subset,

receiving, from a second network device in the network, a request for information about MIB object instances associated with the first network device,

responsive to receiving the request, determining that at least one MIB object instance associated with the MIB group has changed,

based on determining the change in the at least one MIB object instance, modifying an existing aggregate change identifier (ACI) for the MIB group to reflect the change in the at least one MIB object instance, wherein an ACI is a checksum computed by aggregating configuration values of the MIB object instances associated with the MIB group, and wherein the existing ACI is computed based on a prior request from the NMS, and

sending the updated ACI to the second network device; and

the second network device including a second processor and a plurality of second instructions stored in a non-transitory machine-readable second medium for execution by the second processor, the plurality of second instructions when executed cause the second processor to perform operations including;

polling the first network device, wherein the polling includes sending a request to the network device for information associated with a management information base (MIB) group, the MIB group including identifiers corresponding to MIB object instances included in the network device,

receiving, from the first network device, an ACI that is associated with the MIB group,

comparing the received ACI with a cached ACI for the MIB group, wherein the cached ACI was received from the network device in response to a previous polling of the MIB group,

based on the comparing, determining that the received ACI is different from the cached ACI, indicating a change in at least one MIB object instance associated with identifiers included in the MIB group,

based on determining that the received ACI is different from the cached ACI, polling the first network device to determine which MIB object instances associated with the MIB group have changed since the last polling, and

replacing the cached ACI with the received ACI.

9. A non-transitory machine-readable medium including a plurality of instructions for execution by at least one processor, the plurality of instructions when executed cause the at least one processor to perform operations including:

accessing, at a network device in a network, information about update frequency of management information base (MIB) object instances that reflects a frequency at which values of the MIB object instances are updated during operation of the network device;

selecting, based on the information about the update frequency of the MIB object instances, a subset of the MIB object instances;

populating, at the network device, a MIB group with identifiers corresponding to the MIB object instances that are included in the selected subset;

receiving, from a network management system (NMS), a request for information about MIB object instances associated with the MIB group;

responsive to receiving the request, determining that at least one MIB object instance associated with the MIB group has changed;

based on determining the change in the at least one MIB object instance, modifying an existing aggregate change identifier (ACI) for the MIB group to reflect the change in the at least one MIB object instance, wherein an ACI is a checksum computed by aggregating configuration values of the MIB object instances associated with the MIB group, and wherein the existing ACI is computed based on a prior request from the NMS; and

sending the updated ACI to the NMS.

10. A non-transitory machine-readable medium including a plurality of instructions for execution by at least one processor, the plurality of instructions when executed cause the at least one processor to perform operations including:

polling a network device in a network, wherein the polling includes sending a request to the network device for information associated with a management information base (MIB) group, the MIB group including identifiers corresponding to MIB object instances included in the network device;

receiving, from the network device, an aggregate change identifier (ACI) that is associated with the MIB group, wherein the ACI is a checksum computed by aggregating configuration values of the MIB object instances associated with the MIB group;

comparing the received ACI with a cached ACI for the MIB group, wherein the cached ACI was received from the network device in response to a previous polling of the MIB group;

based on the comparing, determining that the received ACI is different from the cached ACI, indicating a change in at least one MIB object instance associated with identifiers included in the MIB group;

based on determining that the received ACI is different from the cached ACI, polling the network device to determine which MIB object instances associated with the MIB group have changed since the previous polling; and

replacing the cached ACI with the received ACI.