INTERACTIVE HIERARCHICAL NETWORK CHORD DIAGRAM FOR APPLICATION DEPENDENCY MAPPING

• US 20160359700A1
• Filed: 04/22/2016
• Published: 12/08/2016
• Est. Priority Date: 06/05/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Pang, Jackson Ngoc Ki, Watts, Michael Standish, Parandehgheibi, Ali, Yadav, Navindra
• Granted Patent: US 9,967,158 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

The technology visualizes data flows within a datacenter in an interactive hierarchical network chord diagram. Based on analyzed data describing data flows, a portion of the data flows that originate at the same first endpoint and terminate at the same second endpoint can be grouped. Subsequently, the dataflow monitoring system displays an interactive hierarchical network chord diagram to include a chord with a first endpoint and a second endpoint. The chord represents the grouped portion of data flows that originate at the same first endpoint and terminate at the same second endpoint. Upon receiving a selection of the chord or the first endpoint of the chord, the dataflow monitoring system expands the grouped portion of the data flows into a more granular representation of the network.

Claims

1. A system for providing an interactive chord chart illustrating collections of data flows between logical entities, the system comprising:

a dataflow monitoring system, the dataflow monitoring system configured to record data describing data flows between hosts in two or more subnets, the data describing a first data flow includes a sending host, a receiving host, a sending host subnet, a receiving host subnet, and a policy corresponding to the first data flow;

one or more processors;

a memory containing instructions that, when executed by the one or more processors, cause the dataflow monitoring system to generate the interactive chord chart by;

analyzing the data describing the data flows,

determining a grouped portion of the data flows that originate from a first endpoint and terminate at a second endpoint, the first endpoint and the second endpoint each corresponding to a respective subnet, a respective cluster of hosts, and a respective individual host,

displaying the interactive chord chart to include a chord with the first endpoint and the second endpoint, the chord representing the grouped portion of the data flows that originate from the first endpoint and terminate at the second endpoint;

after receiving a selection of the chord or the first endpoint, expanding the grouped portion of the data flows into sub-groupings of data flows and the first endpoint into a set of sub-endpoints; and

updating display of the interactive chord chart to include a set of sub-chords corresponding to at least the set of sub-endpoints, the set of sub-chords representing the sub-groupings of data flows that originate from the set of sub-endpoints.

2. The system of claim 1, wherein the first endpoint represents a first subnet and the second endpoint represents a second subnet.

3. The system of claim 2, wherein the set of sub-endpoints represents a cluster of hosts.

4. The system of claim 1, wherein the first endpoint represents a first cluster of hosts and the second endpoint represents a second cluster of hosts.

5. The system of claim 4, wherein the set of sub-endpoints represents a plurality of individual hosts.

6. The system of claim 1, wherein the chord represents policies that are enforced within the grouped portion of the data flows that originate from the first endpoint and terminate at the second endpoint.

7. The system of claim 1, wherein after receiving the selection of the chord or the first endpoint, the instructions, when executed by the one or more processors, further cause the dataflow monitoring system to generate the interactive chord chart by:

expanding the second endpoint into a second set of sub-endpoints; and

updating display of the interactive chord chart to include the set of sub-chords terminating at the second set of sub-endpoints.

8. A non-transitory computer readable medium containing instructions that, when executed by a dataflow monitoring device, cause the dataflow monitoring device to:

analyze data describing data flows;

determine a grouped portion of the data flows that originate from a first endpoint and terminate at a second endpoint, the first endpoint and the second endpoint each correspond to at least a respective subnet, a respective cluster of hosts, and a respective individual host;

display a network chord chart to include a chord with the first endpoint and the second endpoint, the chord representing the grouped portion of the data flows that originate from the first endpoint and terminate at the second endpoint;

after receiving a selection of the chord or the first endpoint, expand the grouped portion of the data flows into sub-groupings of data flows; and

update display of the network chord chart to include a set of sub-chords.

9. The non-transitory computer readable medium of claim 8, wherein the selection of the chord or the first endpoint, further causes the dataflow monitoring device to:

expand the first endpoint into a set of sub-endpoints; and

update display of the network chord chart to include the set of sub-chords originating from the set of sub-endpoints.

10. The non-transitory computer readable medium of claim 9, wherein the set of sub-endpoints represents clusters of hosts.

11. The non-transitory computer readable medium of claim 9, wherein the set of sub-endpoints represents a plurality of individual hosts.

12. The non-transitory computer readable medium of claim 8, wherein the instructions further cause the dataflow monitoring device to:

record the data describing the data flows between hosts in two or more subnets, the data describing a first data flow includes a sending host, a receiving host, a sending host subnet, a receiving host subnet, and a policy corresponding to the first data flow.

13. The non-transitory computer readable medium of claim 8, wherein the first endpoint represents a first subnet and the second endpoint represents a second subnet.

14. The non-transitory computer readable medium of claim 8, wherein the first endpoint represents a first cluster of hosts and the second endpoint represents a second cluster of hosts.

15. The non-transitory computer readable medium of claim 8, wherein the chord represents one or more policies that are enforced within the grouped portion of the data flows that originate from the first endpoint and terminate at the second endpoint.

16. The non-transitory computer readable medium of claim 9, wherein the set of sub-chords corresponds to policies that are enforced within the sub-groupings of data flows originating from the set of sub-endpoints.

17. The non-transitory computer readable medium of claim 8, wherein receiving a selection of the first endpoint or the chord, further causes the dataflow monitoring device to:

expand the second endpoint into a set of second sub-endpoints; and

update display of the network chord chart to include the set of sub-chords terminating at the second set of sub-endpoints.

18. A computer-implemented method for generating an interactive chord chart comprising:

analyzing data describing data flows;

determining a grouped portion of the data flows that originate from a first endpoint and terminate at a second endpoint, the first endpoint and the second endpoint each corresponding to at least a respective subnet, a respective cluster of hosts, and a respective individual host;

displaying the interactive chord chart to include a chord with the first endpoint and the second endpoint, the chord representing the grouped portion of the data flows that originate from the first endpoint and terminate at the second endpoint;

after receiving a selection of the chord or the first endpoint, expanding the grouped portion of the data flows into sub-groupings of data flows and the first endpoint into a set of sub-endpoints; and

updating display of the interactive chord chart to include a set of sub-chords corresponding to at least the set of sub-endpoints, the set of sub-chords representing the sub-groupings of data flows that originate from the set of sub-endpoints.

19. The computer-implemented method of claim 18, wherein after receiving the selection of the chord or the first endpoint, the method further comprises:

expanding the second endpoint into a second set of sub-endpoints; and

updating display of the interactive chord chart to include the set of sub-chords terminating at the second set of sub-endpoints.

20. The computer-implemented method of claim 18, further comprising:

after receiving a selection of a sub-chord from the set of sub-chords or a sub-endpoint from the set of sub-endpoints, expanding the sub-grouping of the data flows into sub-sub-groupings of data flows and the sub-endpoint into a set of sub-sub-endpoints; and

updating display of the interactive chord chart to include a set of sub-sub-chords corresponding to at least the set of sub-sub-endpoints, the set of sub-sub-chords representing the sub-sub-groupings of data flows originating from the set of sub-sub-endpoints.