Method and system for monitoring conditions in a dynamic network environment

• US 9,755,942 B2
• Filed: 10/25/2013
• Issued: 09/05/2017
• Est. Priority Date: 10/25/2013
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Leogrande, Marco, Monclus, Pere, Nemat, Awais, Singh, Sushil
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): McBeth, William C
• Application Number:
  US14/063,914
• Publication Number:
  US 20150120905A1
• Time in Patent Office: 1,411 Days
• Field of Search: 709220, 709223, 709224, 709226, 709231
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method for monitoring network conditions by receiving a first condition definition describing a first network condition to be monitored in a network and an activation definition, determining a network topology of the network, and compiling the first condition definition to generate a first data plane component, a first control plane component, and an activation component. The method also includes deploying the first data plane component into a data plane of the network, where the data plane component captures and synthesizes a first stream of network events to generate a first modified stream of network events. The method also includes deploying the control plane component into a network operating system for the network. The control plane component receives and correlates the first modified stream of network events. The method also includes deploying an activation component that, upon receiving the correlated stream of events, initiates the activation definition.

Claims

1. A method for monitoring network conditions, the method comprising:

compiling, by a software development module, a first condition definition to generate a first data plane component, a first control plane component, and an activation component, the first condition definition describing a first network condition to be monitored in a network and an activation definition;

deploying, by the software development module, the first data plane component in real time into a data plane of the network, wherein the first data plane component captures a first stream of network events as described in the first condition definition without interruption of network activity and without resulting in packet loss, and the first data plane component synthesizes the first stream of network events to generate a first modified stream of network events;

deploying, by the software development module, the first control plane component into a control plane of the network, wherein the first control plane component receives the first modified stream of network events and correlates the first modified stream of network events into a correlated stream of events; and

deploying, by the software development module, the activation component, wherein the activation component, upon receiving the correlated stream of events, initiates the activation definition.

2. The method of claim 1, wherein the initiation of the activation definition includes a visualization that presents the correlated stream of events in a visualization type defined by a visualization definition.

3. The method of claim 2, wherein the activation component modifies the visualization dynamically during operation of the network to reflect real-time changes in the network.

4. The method of claim 1, wherein the first network condition is monitored in the network at a location identified in a network topology definition, and further including, during operation of the network:

determining that the network topology has been modified to a modified network topology; and

in response to determining that the network topology has been modified;

recompiling, by the software development module, the first condition definition to generate a first modified data plane component, a first modified control plane component, and a first modified activation component;

replacing, by the software development module, the first data plane component with the first modified data plane component;

replacing, by the software development module, the first control plane component with the first modified control plane component; and

replacing, by the software development module, the activation component with the first modified activation component.

5. The method of claim 1,

wherein the first condition definition further includes a trigger description that describes a user-defined executable instruction, and

wherein the activation component is further to:

determine that the first network condition is met, and

in response to determining that the first network condition is met, execute the user-defined executable instruction.

6. The method of claim 2, further including:

in response to a modified activation definition;

generating, by the software development module, a modified activation component to reflect the modified activation definition, and

deploying, by the software development module, the modified activation component to replace the activation component, wherein the modified activation component generates a modified visualization in real time during operation of the network.

7. The method of claim 1, wherein the first control plane component is a monitoring control plane component including a second control plane component, a third control plane component and a fourth control plane component, the second control plane component determines a second modified stream of network events from the first modified stream of network events received from the first data plane component, the third control plane component determines a fourth modified stream of network events from a third modified stream of network events received from a second data plane component at a different network topology location in the network than the first data plane component, and the fourth control plane component correlates the second modified stream of network events and the fourth modified stream of network events to determine the correlated stream of events.

8. A system for monitoring network conditions, the system comprising:

a processor; and

a computer readable storage device, the computer readable storage device including computer code which, when executed by the processor, causes the processor to implement a software development module to at least;

compile a first condition definition to generate a first data plane component, a first control plane component, and an activation component, the first condition definition describing a first network condition to be monitored in a network and an activation definition;

deploy the first data plane component into a data plane of the network, wherein the first data plane component captures a first stream of network events as described in the first condition definition, and the first data plane component synthesizes the first stream of network events to generate a first modified stream of network events;

deploy the first control plane component into a control plane of the network, wherein the first control plane component receives the first modified stream of network events and correlates the first modified stream of network events into a correlated stream of events; and

deploy the activation component, wherein the activation component, upon receiving the correlated stream of events, initiates the activation definition.

9. The system of claim 8, wherein initiation of the activation definition includes a visualization that presents the correlated stream of events in a visualization type defined by a visualization definition.

10. The system of claim 9, wherein the activation component modifies the visualization dynamically during operation of the network to reflect real-time changes in the network.

11. The system of claim 8, wherein the first network condition is monitored in the network at a location identified in a network topology definition, and the computer readable storage device further includes computer code which, when executed by the processor during operation of the network, causes the processor to:

in response to determining that the network topology has been modified;

recompile the first condition definition to generate a first modified data plane component, a first modified control plane component, and a first modified activation component;

replace the first data plane component with the first modified data plane component;

replace the first control plane component with the first modified control plane component; and

replace the activation component with the first modified activation component.

12. The system of claim 8,

wherein the first condition definition further includes a trigger description that describes a user-defined executable instruction, and

wherein the activation component is further to:

determine that the first network condition is met, and

in response to determining that the first network condition is met, execute the user-defined executable instruction.

13. The system of claim 8, the computer readable storage device further including computer code which, when executed by the processor during operation of the network, causes the processor to:

in response to a modified activation definition;

generate a modified activation component to reflect the modified activation definition, and

deploy the modified activation component to replace the activation component, wherein the modified activation component generates a modified visualization in real time during operation of the network.

14. The system of claim 8, wherein the first control plane component is a monitoring control plane component including a second control plane component, a third control plane component and a fourth control plane component, the second control plane component determines a second modified stream of network events from the first modified stream of network events received from the first data plane component, the third control plane component determines a fourth modified stream of network events from a third modified stream of network events received from a second data plane component at a different network topology location in the network than the first data plane component, and the fourth control plane component correlates the second modified stream of network events and the fourth modified stream of network events to determine the correlated stream of events.

15. A computer program product for monitoring network conditions, the computer program product comprising a computer readable storage device comprising computer code which, when executed by a processor, causes the processor to implement a software development module to at least:

compile a first condition definition to generate a first data plane component, a first control plane component, and an activation component, the first condition definition describing a first network condition to be monitored in a network and an activation definition;

deploy the first data plane component into a data plane of the network, wherein the first data plane component captures a first stream of network events as described in the first condition definition, and the first data plane component synthesizes the first stream of network events to generate a first modified stream of network events;

deploy the first control plane component into a control plane of the network, wherein the first control plane component receives the first modified stream of network events and correlates the first modified stream of network events into a correlated stream of events; and

deploy the activation component, wherein the activation component, upon receiving the correlated stream of events, initiates the activation definition.

16. The computer program product of claim 15, wherein initiation of the activation definition includes a visualization that presents the correlated stream of events in a visualization type defined by a visualization definition.

17. The computer program product of claim 16, wherein the activation component modifies the visualization dynamically during operation of the network to reflect real-time changes in the network.

18. The computer program product of claim 15, wherein the first network condition is monitored in the network at a location identified in a network topology definition, and the computer readable storage device further includes computer code which, when executed by the processor during operation of the network, causes the processor to:

determine that a network topology of the network has been modified to a modified network topology; and

in response to determining that the network topology has been modified;

recompile the first condition definition to generate a first modified data plane component, a first modified control plane component, and a first modified activation component;

replace the first data plane component with the first modified data plane component;

replace the first control plane component with the first modified control plane component; and

replace the activation component with the first modified activation component.

19. The computer program product of claim 15, the computer readable storage device further including computer code which, when executed by the processor during operation of the network, causes the processor to:

in response to a modified activation definition;

generate a modified activation component to reflect the modified activation definition, and

deploy the modified activation component to replace the activation component, wherein the modified activation component generates a modified visualization in real time during operation of the network.

20. The computer program product of claim 15, wherein the first control plane component is a monitoring control plane component including a second control plane component, a third control plane component and a fourth control plane component, the second control plane component determines a second modified stream of network events from the first modified stream of network events received from the first data plane component, the third control plane component determines a fourth modified stream of network events from a third modified stream of network events received from a second data plane component at a different network topology location in the network than the first data plane component, and the fourth control plane component correlates the second modified stream of network events and the fourth modified stream of network events to determine the correlated stream of events.