SYSTEM FOR MONITORING AND MANAGING DATACENTERS

• US 20160359872A1
• Filed: 04/20/2016
• Published: 12/08/2016
• Est. Priority Date: 06/05/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Scheib, Ellen Christine, Madani, Omid, Parandehgheibi, Ali, Jeyakumar, Vimalkumar, Nguyen, Hoang Viet, Gupta, Sunil Kumar, Rao, Supreeth Hosur Nagesh, Spadaro, Roberto Fernando, Viswanathan, Bharathwaj Sankara, Rachita Agasthy, Fnu, Barlow, Duane Thomas, Sloane, Andrew, Yadav, Navindra, Singh, Abhishek Ranjan, Gandham, Shashidhar, Pang, Jackson Ngoc Ki, Watts, Michael Standish, Deen, Khawar, Prasad, Rohit Chandra, Gupta, Anubhav, Kulshreshtha, Ashutosh, Vu, Hai Trong, Malhotra, Varun Sagar, Chang, Shih-Chun
• Granted Patent: US 10,142,353 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Claims

1. A system comprising:

two or more sensors configured to;

capture a packet;

describe the packet in a packet log;

send the packet log to the collector;

a collector configured to;

receive the packet logs from the two or more sensors;

determine that the logs describe a flow;

describe the flow in a flow log; and

an analytics module.

2. The system of claim 1, wherein the two or more sensors, the collector, and the analytics module are installed in a datacenter.

3. The system of claim 2, wherein one of the two or more sensors is installed on a hypervisor.

4. The system of claim 2, wherein one of the two or more sensors is installed on a switch.

5. The system of claim 3, wherein one of the two or more sensors is installed on a virtual machine.

6. The system of claim 2, wherein access to the datacenter is limited by a firewall.

7. The system of claim 2, wherein the analytics module is further configured to:

determine the status of the datacenter, using the flow log.

8. The system of claim 7, wherein the analytics module is further configured to:

detect an attack within the datacenter.

9. The system of claim 2, wherein the analytics module is further configured to:

present a report describing flows in the datacenter.

10. A method comprising:

receiving, a first packet log from a first sensor and a second packet log from a second sensor, the first packet log and the second packet log describing packets that are captured by the respective sensors;

determining that the first packet log and the second packet log describes a flow in the network;

describing the first packet log and the second packet log in a flow log; and

sending the flow log to an analytics module.

11. The method of claim 10, wherein the method is performed by a collector;

wherein the first sensor, the second sensor, the collector, and the analytics module are all within a single datacenter.

12. The method of claim 11, wherein the first sensor is installed on a hypervisor.

13. The method of claim 11, wherein the first sensor is installed on a switch.

14. The method of claim 11, wherein the first sensor is installed on a virtual machine.

15. The method of claim 12, wherein access to the datacenter is limited by a firewall.

16. A non-transitory computer-readable medium having computer readable instructions stored thereon that, when executed by a processor of a computer, cause the computer to:

receive, from a collector, a flow log describing a flow on a network; and

determine the status of a datacenter, using the flow log.

17. The non-transitory computer-readable medium of claim 16, wherein the instructions further cause the computer to:

detect an attack within the datacenter.

18. The non-transitory computer-readable medium of claim 16, wherein the instructions further cause the computer to:

present a report describing flows in the datacenter.

19. The non-transitory computer-readable medium of claim 16, wherein the instructions further cause the computer to:

modify a security policy based on the status of the datacenter.

20. The non-transitory computer-readable medium of claim 16, wherein the instructions further cause the computer to:

configure a sensor to send a packet log to the collector.