Flow deduplication across a cluster of network monitoring devices
First Claim
1. A method for monitoring flows of packets over a network, wherein one or more processors in a network computer execute instructions to perform actions, comprising:
- employing a network monitoring computer (NMC) in a plurality of NMCs, that is provided a new network flow, to perform further actions, including;
buffering network traffic information associated with the new network flow in a non-transitory processor readable media;
registering the new network flow with the plurality of NMCs, wherein registration provides an identifier that corresponds to one or more of the plurality of NMCs and provides an indication that the one or more NMCs that correspond to the identifier have registered an interest in one or more network flows that are related to the new network flow;
forwarding network traffic information that is associated with the one or more related network flows to the one or more NMCs that correspond to the identifier;
employing the identifier, which corresponds to the NMC that was provided the new network flow, to process network traffic associated with the new network flow using the NMC that was provided the new network flow; and
employing the identifier, which corresponds to another NMC, to forward the buffered network traffic information to the other NMC.
6 Assignments
0 Petitions
Accused Products
Abstract
Embodiments are directed to monitoring flows of packets over a network. If a network monitoring computer (NMC) in a cluster of NMCs observes a new network flow, the NMC may perform a variety of actions to determine the NMC that is responsible for monitoring the new network flow. Network traffic associated with the new network flow may be buffered in a non-transitory processor readable media. The new network flow may be registered with the plurality of NMCs, providing an identifier that corresponds to one NMC. Registering may include, assigning the NMC a responsibility to monitor the new network flow. If the identifier corresponds to the NMC that observed the new network flow, the network traffic associated with the new network flow is processed using that NMC. If the identifier corresponds to another NMC, the buffered network traffic is forwarded to the other NMC.
-
Citations
24 Claims
-
1. A method for monitoring flows of packets over a network, wherein one or more processors in a network computer execute instructions to perform actions, comprising:
employing a network monitoring computer (NMC) in a plurality of NMCs, that is provided a new network flow, to perform further actions, including; buffering network traffic information associated with the new network flow in a non-transitory processor readable media; registering the new network flow with the plurality of NMCs, wherein registration provides an identifier that corresponds to one or more of the plurality of NMCs and provides an indication that the one or more NMCs that correspond to the identifier have registered an interest in one or more network flows that are related to the new network flow; forwarding network traffic information that is associated with the one or more related network flows to the one or more NMCs that correspond to the identifier; employing the identifier, which corresponds to the NMC that was provided the new network flow, to process network traffic associated with the new network flow using the NMC that was provided the new network flow; and employing the identifier, which corresponds to another NMC, to forward the buffered network traffic information to the other NMC. - View Dependent Claims (2, 3, 4, 5, 6)
-
7. A system for monitoring flows of packets over a network comprising:
-
a network computer, comprising; a transceiver that communicates over the network; a memory that stores at least instructions; and one or more processors that execute instructions that perform actions, including; employing a network monitoring computer (NMC) in a plurality of NMCs, that is provided a new network flow, to perform further actions, including; buffering network traffic information associated with the new network flow in a non-transitory processor readable media; registering the new network flow with the plurality of NMCs, wherein registration provides an identifier that corresponds to one or more of the plurality of NMCs and provides an indication that the one or more NMCs that correspond to the identifier have registered an interest in one or more network flows that are related to the new network flow; forwarding network traffic information that is associated with the one or more related network flows to the one or more NMCs that correspond to the identifier; employing the identifier, which corresponds to the NMC that was provided the new network flow, to process network traffic associated with the new network flow using the NMC that was provided the new network flow; and employing the identifier, which corresponds to another NMC, to forward the buffered network traffic information to the other NMC; and a client computer, comprising; a transceiver that communicates over the network; a memory that stores at least instructions; and one or more processors that execute instructions that perform actions, including; providing the new network flow to the NMC in the plurality of NMCs. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. A processor readable non-transitory storage media that includes instructions for monitoring flows of packets over a network, wherein execution of the instructions by one or more processors performs actions, comprising:
employing a network monitoring computer (NMC) in a plurality of NMCs, that is provided a new network flow, to perform further actions, including; buffering network traffic information associated with the new network flow in a non-transitory processor readable media; registering the new network flow with the plurality of NMCs, wherein registration provides an identifier that corresponds to one or more of the plurality of NMCs and provides an indication that the one or more NMCs that correspond to the identifier have registered an interest in one or more network flows that are related to the new network flow; forwarding network traffic information that is associated with the one or more related network flows to the one or more NMCs that correspond to the identifier; employing the identifier, which corresponds to the NMC that was provided the new network flow, to process network traffic associated with the new network flow using the NMC that was provided the new network flow; and employing the identifier, which corresponds to another NMC, to forward the buffered network traffic information to the other NMC. - View Dependent Claims (14, 15, 16, 17, 18)
-
19. A network computer for monitoring flows of packets over a network, comprising:
-
a transceiver that communicates over the network; a memory that stores at least instructions; and one or more processors that execute instructions that perform actions, including; employing a network monitoring computer (NMC) in a plurality of NMCs, that is provided a new network flow, to perform further actions, including; buffering network traffic information associated with the new network flow in a non-transitory processor readable media; registering the new network flow with the plurality of NMCs, wherein registration provides an identifier that corresponds to one or more of the plurality of NMCs and provides an indication that the one or more NMCs that correspond to the identifier have registered an interest in one or more network flows that are related to the new network flow; forwarding network traffic information that is associated with the one or more related network flows to the one or more NMCs that correspond to the identifier; employing the identifier, which corresponds to the NMC that was provided the new network flow, to process network traffic associated with the new network flow using the NMC that was provided the new network flow; and employing the identifier, which corresponds to another NMC, to forward the buffered network traffic information to the other NMC. - View Dependent Claims (20, 21, 22, 23, 24)
-
Specification