Methods and systems for estimating and analyzing flow activity and path performance data in cloud or distributed systems

• US 9,762,471 B2
• Filed: 09/13/2013
• Issued: 09/12/2017
• Est. Priority Date: 01/26/2013
• Status: Active Grant

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Vicat-Blanc, Pascale, Guillier, Romaric, Soudan, Sebastien
• Primary Examiner(s): Donaghue, Larry
• Application Number:
  US14/027,142
• Publication Number:
  US 20140215058A1
• Time in Patent Office: 1,460 Days
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408

Abstract

Virtual resources associated with an execution of a user'"'"'s applications in a cloud or distributed resource configuration including virtual or physical machines, network services and storage are identified. A source and destination virtual machine, utilized by the user'"'"'s applications, are determined, and at least one source or destination virtual machine belongs to the identified virtual resources. Measurement software for a virtual machine is downloaded. The measurement software acquires data for connections established in a transport layer for communicating between the source and destination virtual machine. Data acquired from the measurement software is received at a first time, and the data includes measurements of variables for the data communications via the connections. Based upon the measurements, metrics that characterize the data communications at a first time are generated. Measurements made at an additional number of times are also received. Based upon the measurements, metrics are generated as a function of time.

Claims

1. A method for analyzing network flow activity implemented by a network traffic management system comprising one or more network traffic management apparatuses, client devices or server devices, the method comprising:

identifying one or more virtual resources associated with one or more servers;

acquiring flow data associated with one or more paths for one or more packets communicating between the one or more virtual resources in a first time period;

determining any recommended network flow actions by;

generating one or more flow mappings by extracting IP addresses from the flow data associated with the one or more paths in the first time period;

analyzing the acquired flow data associated with the one or more paths in the first time period using the generated flow mappings; and

automatically executing any recommended network flow action on one or more flows.

2. The method of claim 1, wherein the flow data comprises TCP (Transport Control Protocol) variables, or UDP (User Datagram Protocol) variables.

3. The method of claim 1, wherein the generating one or more flow mappings includes a network threshold event to manage the one or more virtual resources, wherein the network threshold event comprise CPU usage associated with a node, a disk capacity associated with a node, a latency associated with one of the one or more flows, displaying the flow activity and corresponding health associated with each flow, or displaying the flow activity and corresponding health associated with each node.

4. The method of claim 1, wherein the one or more virtual resources further comprise a virtual load balancer, a virtual router, a virtual switch, or a virtual link.

12. The method of claim 1, further comprising:

determining a bandwidth capacity metric or a latency metric for the one or more paths;

comparing the bandwidth capacity metric to a bandwidth threshold or the latency metric to a latency threshold; and

providing an indication when the bandwidth capacity metric exceeds the bandwidth threshold or the latency metric exceeds the latency threshold.

16. The method of claim 1, wherein the one or more virtual resources comprise a plurality of virtual machines and providing the one or more flow mappings for display by a graphical user interface of a client.

5. A network traffic management apparatus, comprising a memory with programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

identify one or more virtual resources associated with one or more servers;

acquire flow data associated with one or more paths for one or more packets communicating between the one or more virtual resources in a first time period;

determine any recommended network flow actions by;

generating one or more flow mappings by extracting IP addresses from the flow data associated with the one or more paths in the first time period; and

analyzing the acquired flow data associated with the one or more paths in the first time period using the generated flow mappings; and

automatically execute any recommended network flow action on one or more flows.

6. The apparatus of claim 5, wherein the flow data comprises TCP (Transport Control Protocol) variables, or UDP (User Datagram Protocol) variables.

13. The apparatus of claim 5, wherein to generate one or more flow mappings includes a network threshold event to manage the one or more virtual resources, wherein the network threshold event CPU usage associated with a node, a disk capacity associated with a node, a latency associated with one of the one or more flows, displaying the flow activity and corresponding health associated with each flow, or displaying the flow activity and corresponding health associated with each node.

14. The apparatus of claim 5, wherein the one or more virtual resources further comprise a virtual load balancer, a virtual router, a virtual switch, or a virtual link.

15. The apparatus of claim 13, wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to:

determine a bandwidth capacity metric or a latency metric for the one or more paths;

compare the bandwidth capacity metric to a bandwidth threshold or the latency metric to a latency threshold; and

provide an indication when the bandwidth capacity metric exceeds the bandwidth threshold or the latency metric exceeds the latency threshold.

17. The apparatus of claim 5, wherein the one or more virtual resources comprise a plurality of virtual machines and providing the one or more flow mappings for display by a graphical user interface of a client.

7. A non-transitory computer readable medium having stored thereon instructions for analyzing network flow activity, comprising executable code which when executed by one or more processors, causes the one or more processors to:

identify one or more virtual resources associated with one or more servers;

acquire flow data associated with one or more paths for one or more packets communicating between the one or more virtual resources in a first time period;

determine any recommended network flow actions by;

generating one or more flow mappings by extracting IP addresses from the flow data associated with the one or more paths in the first time period,

analyzing the acquired flow data associated with the one or more paths in the first time period using the generated flow mappings; and

automatically execute any recommended network flow action on one or more flows.

8. The medium of claim 7, wherein the flow data comprises TCP (Transport Control Protocol) variables, or UDP (User Datagram Protocol) variables.

9. The medium of claim 7, wherein to generate one or more flow mappings includes a network threshold event to manage the one or more virtual resources, wherein the network threshold event comprise CPU usage associated with a node, a disk capacity associated with a node, a latency associated with one of the one or more flows, displaying the flow activity and corresponding health associated with each flow, or displaying the flow activity and corresponding health associated with each node.

10. The medium of claim 7, wherein the one or more virtual resources further comprise a virtual load balancer, a virtual router, a virtual switch, or a virtual link.

11. The medium of claim 7, wherein the executable code when executed by the one or more processors further causes the one or more processors to:

determine a bandwidth capacity metric or a latency metric for the one or more paths;

compare the bandwidth capacity metric to a bandwidth threshold or the latency metric to a latency threshold; and

provide an indication when the bandwidth capacity metric exceeds the bandwidth threshold or the latency metric exceeds the latency threshold.

18. The medium of claim 7, wherein the one or more virtual resources comprise a plurality of virtual machines and providing the one or more flow mappings for display by a graphical user interface of a client.

19. A network traffic management system, comprising one or more traffic management apparatuses, client devices, or server devices, the network traffic management system comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

identify one or more virtual resources associated with one or more servers;

acquire flow data associated with one or more paths for one or more packets communicating between the one or more virtual resources in a first time period;

determine any recommended network flow actions by;

generating one or more flow mappings by extracting IP addresses from the flow data associated with the one or more paths in the first time period;

analyzing the flow data associated with the one or more paths in the first time period using the generated flow mappings; and

automatically execute any recommended network flow action on one or more flows.

20. A network traffic management system of claim 19, wherein the flow data comprises TCP (Transport Control Protocol) variables, or UDP (User Datagram Protocol) variables.

21. A network traffic management system of claim 19, wherein the generating one or more flow mappings includes a network threshold event to manage the one or more virtual resources, wherein the network threshold event comprise CPU usage associated with a node, a disk capacity associated with a node, a latency associated with one of the one or more flows, displaying the flow activity and corresponding health associated with each flow, or displaying the flow activity and corresponding health associated with each node.

22. A network traffic management system of claim 19, wherein the one or more virtual resources further comprise a virtual load balancer, a virtual router, a virtual switch, or a virtual link.

23. A network traffic management system of claim 19, wherein the one or more processors are further configured to be capable of executing the stored programmed instructions to:

determine a bandwidth capacity metric or a latency metric for the one or more paths;

compare the bandwidth capacity metric to a bandwidth threshold or the latency metric to a latency threshold; and

provide an indication when the bandwidth capacity metric exceeds the bandwidth threshold or the latency metric exceeds the latency threshold.

24. A network traffic management system of claim 19, wherein the one or more virtual resources comprise a plurality of virtual machines and providing the one or more flow mappings for display by a graphical user interface of a client.