METHOD AND SYSTEM FOR ANNOTATING NETWORK FLOW INFORMATION

• US 20130290521A1
• Filed: 03/01/2013
• Published: 10/31/2013
• Est. Priority Date: 12/29/2007
• Status: Active Grant

• Current Assignee: Craig H. Labovitz, Joseph Eggleston, Scott Iekel-Johnson
• Original Assignee: Craig H. Labovitz, Joseph Eggleston, Scott Iekel-Johnson
• Inventors: Labovitz, Craig H., Eggleston, Joseph, Iekel-Johnson, Scott
• Granted Patent: US 8,879,415 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A scalable flow monitoring solution takes in standard flow records exported from network devices such as routers, switches, firewalls, hubs, etc., and annotates the flow with additional information. This information is derived from a number of sources, including Border Gateway Protocol (BGP), Simple Network Management Protocol (SNMP), user configuration, and other, intelligent flow analysis. These annotations add information to the flow data, and can be used to perform value-added flow analysis. The annotated flow is then resent to a configurable set of destinations using standard flow formatting, e.g., Cisco System Inc.'"'"'s NetFlow, in one implementation. This allows the annotated flow to be processed and the enhanced information to be used by other flow analysis tools and existing flow analysis infrastructure.

Claims

1-27. -27. (canceled)

28. A method, comprising:

receiving data packet flow information from a first network device in a first network monitoring device;

analyzing the received data packet flow information in the first network monitoring device to determine information to be annotated in the received data packet flow information;

encoding in the received data packet flow the determined information to be annotated in the first network monitoring device; and

distributing the received data packet flow having the annotated information from the first network monitoring device to a second network monitoring device according to a distribution list provided in the first network device.

29. The method as recited in claim 28 further comprising:

receiving in a second network monitoring device the data packet flow information having the annotated information distributed from the first network monitoring device;

analyzing the received data packet flow information having the annotated information in the second network monitoring device to determine additional information to be annotated in the received data packet flow information having the annotated information; and

encoding in the received data packet flow having the annotated information the determined additional information to be annotated in the second network monitoring device.

30. The method as recited in claim 29 further comprising distributing the data packet flow having the additional encoded annotated information from the second network monitoring device to a third network monitoring device according to a distribution list provided in the second network device.

31. The method as recited in claim 28 wherein the encoding step includes encoding Border Gateway Protocol (BGP) attributes in the received data packet.

32. The method as recited in claim 28 wherein the encoding step includes encoding Simple Network Management Protocol (SNMP) attributes in the received data packet.

33. The method as recited in claim 28 wherein the encoding step includes encoding attributes relating to layer 4-7 payload attributes or virtual local area network (VLAN) attributes in the received data packet.

34. The method as recited in claim 28 wherein the encoding step includes encoding attributes relating to data flow traffic based upon user configuration information.

35. The method as recited in claim 28 wherein the encoding step includes encoding attributes relating to network topology or signature detection attributes in the received data packet.

36. The method of claim 28 wherein the first network device is any of:

a router, a switch, a firewall and a packet scanner/analyzer.

37. A method, comprising:

receiving data packet flow information from a first network device in a first network monitoring device;

analyzing the received data packet flow information in the first network monitoring device to determine information to be annotated in the received data packet flow information;

encoding in the received data packet flow the determined information to be annotated in the first network monitoring device, the annotated information selected from the group consisting of;

Border Gateway Protocol (BGP) attributes, Simple Network Management Protocol (SNMP) attributes, payload attributes, Virtual Local Area Network (VLAN) attributes, attributes relating to data flow traffic based upon user configuration information, attributes relating to network topology, signature detection attributes, network topology attributes and signature detection attributes;

distributing the received data packet flow having the annotated information from the first network monitoring device to a second network monitoring device according to a distribution list provided in the first network device;

receiving in a second network monitoring device the data packet flow information having the annotated information distributed from the first network monitoring device;

analyzing the received data packet flow information having the annotated information in the second network monitoring device to determine additional information to be annotated in the received data packet flow information having the annotated information; and

encoding in the received data packet flow having the annotated information the determined additional information to be annotated in the second network monitoring device.

38. The method as recited in claim 37 further comprising distributing the data packet flow having the additional encoded annotated information from the second network monitoring device to a third network monitoring device according to a distribution list provided in the second network device.

39. The method of claim 37 wherein the first network device is any of:

a router, a switch, a firewall and a packet scanner/analyzer.

40. A communication system, comprising:

a first network monitor device including;

a flow analysis engine adapted and configured to;

receive data packet flow information from a first network device;

analyze the received data packet flow information to determine information to be annotated in the received data packet flow information;

an encoding and distribution engine adapted and configured to;

encode in the received data packet flow the determined information to be annotated; and

distribute the received data packet flow having the annotated information to a second network monitoring device in a communications network according to a distribution list provided in the encoding and distribution engine.

41. The communication system recited in claim 40 further including:

a second network monitor device including;

a flow analysis engine adapted and configured to;

receive data packet flow information from the first network monitor device;

analyze the received data packet flow having the annotated information to determine information to be additionally annotated in the received data packet flow having the annotated information;

an encoding and distribution engine adapted and configured to;

encode in the received data packet flow the determined additional information selected from the group consisting of;

Border Gateway Protocol (BGP) attributes, Simple Network Management Protocol (SNMP) attributes, payload attributes, Virtual Local Area Network (VLAN) attributes, attributes relating to data flow traffic based upon user configuration information, attributes relating to network topology, signature detection attributes, network topology attributes and signature detection attributes; and

distribute the received data packet flow having the additional annotated information from the second network monitoring device to another device in a network.

42. The communication system as recited in claim 40 wherein Border Gateway Protocol (BGP) attributes are encoded in the received data packet.

43. The communication system as recited in claim 40 wherein Simple Network Management Protocol (SNMP) attributes are encoded in the received data packet.

44. The communication system as recited in claim 40 wherein attributes relating to layer 4-7 payload attributes or virtual local area network (VLAN) attributes are encoded in the received data packet.

45. The communication system as recited in claim 40 wherein attributes relating to data flow traffic based upon user configuration information are encoded in the received data packet.

46. The communication system as recited in claim 40 wherein attributes relating to network topology or signature detection attributes are encoded in the received data packet.

47. The method of claim 40 wherein the first network device is any of:

a router, a switch, a firewall and a packet scanner/analyzer.