System and method for network topology and flow visualization
First Claim
1. A method for visualization of network flow, comprising:
- rendering, on a computer system display, a graphical user interface including a network topology, the network topology including multiple network devices and showing connections between multiple network devices;
acquiring, using a computer, a plurality of network flow records from each of the multiple network devices for a specified period of time,wherein each of the plurality of network flow records is generated by a corresponding one of the multiple network devices and is uniquely associated with the corresponding one of the multiple network devices and is stored by the corresponding one of the multiple network devices,wherein each of the plurality of network flow records includes information about a corresponding network flow through the corresponding one of the multiple network devices, andwherein each of the plurality of network flow records is generated and stored separate from data of the corresponding network flow, andwherein each of the plurality of network flow records includes data fields for1) an identifier of the ingress interface through which the corresponding network flow entered the corresponding one of the multiple network devices, and2) an identifier of an egress interface through which the corresponding network flow exited the corresponding one of the multiple network devices or an identifier of an internal interface at which the corresponding network flow terminated within the corresponding one of the multiple network devices, and3) an internet protocol source address for the corresponding network flow, and4) an internet protocol destination address for the corresponding network flow, and5) a source port for the corresponding network flow, and6) a destination port for the corresponding network flow;
correlating separate ones of the plurality of network flow records based on content of the data fields so as to create a common network data communication flow record as a combination of the correlated separate ones of the plurality of network flow records for the specified period of time;
repeating the correlating of separate ones of the plurality of network flow records based on content of the data fields so as to create a plurality of common network data communication flow records for the specified period of time;
aggregating some of the plurality of common network data communication flow records based on identical content in one or more data fields of the plurality of common network data communication flow records to create an aggregated network communication flow record for the specified period of time;
applying the network flow parameter filter to the plurality of network flow records so as to filter the aggregated network communication flow record for the specified period of time and generate a filtered aggregated network communication flow record for the specified period of time; and
rendering, on the computer system display within the network topology, a graphical representation of the filtered aggregated network communication flow record, wherein rendering the network topology includes rendering interface objects corresponding to each internal interface of the multiple network devices including each ingress interface and each egress interface of the multiple network devices and including each local interface of the multiple network devices, and wherein rendering of the graphical representation of the filtered aggregated network communication flow record includes rendering of arrows directly between interface objects corresponding to some of the ingress and egress interfaces of the multiple network devices and rendering of at least one arrow directed toward at least one local interface.
3 Assignments
0 Petitions
Accused Products
Abstract
A graphical user interface including an object representing a network device is rendered. Interface objects respectively corresponding to each internal interface of the network device are rendered within the object representing the network device. A network flow record for a network flow through the network device is acquired. The network flow record identifies ingress and egress interfaces of the network device for the network flow. Switching information for the network flow within the network device is determined based on the ingress and egress identifications. A transmission path of the network flow within the network device from the ingress interface is rendered within the object representing the network device. The transmission path is defined by the switching information identified by the network flow record.
209 Citations
18 Claims
-
1. A method for visualization of network flow, comprising:
-
rendering, on a computer system display, a graphical user interface including a network topology, the network topology including multiple network devices and showing connections between multiple network devices; acquiring, using a computer, a plurality of network flow records from each of the multiple network devices for a specified period of time, wherein each of the plurality of network flow records is generated by a corresponding one of the multiple network devices and is uniquely associated with the corresponding one of the multiple network devices and is stored by the corresponding one of the multiple network devices, wherein each of the plurality of network flow records includes information about a corresponding network flow through the corresponding one of the multiple network devices, and wherein each of the plurality of network flow records is generated and stored separate from data of the corresponding network flow, and wherein each of the plurality of network flow records includes data fields for 1) an identifier of the ingress interface through which the corresponding network flow entered the corresponding one of the multiple network devices, and 2) an identifier of an egress interface through which the corresponding network flow exited the corresponding one of the multiple network devices or an identifier of an internal interface at which the corresponding network flow terminated within the corresponding one of the multiple network devices, and 3) an internet protocol source address for the corresponding network flow, and 4) an internet protocol destination address for the corresponding network flow, and 5) a source port for the corresponding network flow, and 6) a destination port for the corresponding network flow; correlating separate ones of the plurality of network flow records based on content of the data fields so as to create a common network data communication flow record as a combination of the correlated separate ones of the plurality of network flow records for the specified period of time; repeating the correlating of separate ones of the plurality of network flow records based on content of the data fields so as to create a plurality of common network data communication flow records for the specified period of time; aggregating some of the plurality of common network data communication flow records based on identical content in one or more data fields of the plurality of common network data communication flow records to create an aggregated network communication flow record for the specified period of time; applying the network flow parameter filter to the plurality of network flow records so as to filter the aggregated network communication flow record for the specified period of time and generate a filtered aggregated network communication flow record for the specified period of time; and rendering, on the computer system display within the network topology, a graphical representation of the filtered aggregated network communication flow record, wherein rendering the network topology includes rendering interface objects corresponding to each internal interface of the multiple network devices including each ingress interface and each egress interface of the multiple network devices and including each local interface of the multiple network devices, and wherein rendering of the graphical representation of the filtered aggregated network communication flow record includes rendering of arrows directly between interface objects corresponding to some of the ingress and egress interfaces of the multiple network devices and rendering of at least one arrow directed toward at least one local interface. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. An apparatus, comprising:
-
a memory including instructions for execution by one or more processors; and
one or more processors coupled to the memory, the one or more processors being operable when executing the instructions to;render, on a computer system display, a graphical user interface including a network topology, the network topology including multiple network devices and showing connections between multiple network devices, acquire a plurality of network flow records from each of the multiple network devices for a specified period of time, wherein each of the plurality of network flow records is generated by a corresponding one of the multiple network devices and is uniquely associated with the corresponding one of the multiple network devices and is stored by the corresponding one of the multiple network devices, wherein each of the plurality of network flow records includes information about a corresponding network flow through the corresponding one of the multiple network devices, and wherein each of the plurality of network flow records is generated and stored separate from data of the corresponding network flow, and wherein each of the plurality of network flow records includes data fields for 1) an identifier of the ingress interface through which the corresponding network flow entered the corresponding one of the multiple network devices, and 2) an identifier of an egress interface through which the corresponding network flow exited the corresponding one of the multiple network devices or an identifier of an internal interface at which the corresponding network flow terminated within the corresponding one of the multiple network devices, and 3) an internet protocol source address for the corresponding network flow, and 4) an internet protocol destination address for the corresponding network flow, and 5) a source port for the corresponding network flow, and 6) a destination port for the corresponding network flow, correlate separate ones of the plurality of network flow records based on content of the data fields so as to create a common network data communication flow record as a combination of the correlated separate ones of the plurality of network flow records for the specified period of time, repeat the correlating of separate ones of the plurality of network flow records based on content of the data fields so as to create a plurality of common network data communication flow records for the specified period of time, aggregate some of the plurality of common network data communication flow records based on identical content in one or more data fields of the plurality of common network data communication flow records to create an aggregated network communication flow record for the specified period of time, define a network flow parameter filter, apply the network flow parameter filter to the plurality of network flow records so as to filter the aggregated network communication flow record for the specified period of time and generate a filtered aggregated network communication flow record for the specified period of time, and render, on the computer system display within the network topology, a graphical representation of the filtered aggregated network communication flow record, wherein rendering the network topology includes rendering interface objects corresponding to each internal interface of the multiple network devices including each ingress interface and each egress interface of the multiple network devices and including each local interface of the multiple network devices, and wherein rendering of the graphical representation of the filtered aggregated network communication flow record includes rendering of arrows directly between interface objects corresponding to some of the ingress and egress interfaces of the multiple network devices and includes rendering of at least one arrow directed toward at least one local interface. - View Dependent Claims (14, 15, 16, 17, 18)
-
Specification