Method and apparatus for generating a network topology representation based on inspection of application messages at a network device

• US 7,996,556 B2
• Filed: 03/24/2005
• Issued: 08/09/2011
• Est. Priority Date: 12/06/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Van Oleson, Parley, Cho, Stephen, De Datta, Raj, Raghavan, Kollivakkam, Potti, Sunil, Anthias, Tefcros
• Primary Examiner(s): Lin; Kenny S
• Assistant Examiner(s): Taha; Shaq
• Application Number:
  US11/090,920
• Publication Number:
  US 20060123477A1
• Time in Patent Office: 2,329 Days
• Field of Search: 709/237
• US Class Current: 709/237
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion

Abstract

A method is disclosed for generating a network topology representation based on inspection of application messages at a network device. According to one aspect, a network device receives a request packet, routes the packet to the destination, and extracts and stores correlation information from a copy of the request packet. When the network device receives a response packet, it examines the contents of a copy of the response packet using context-based correlation rules and matches the response packet with the appropriate stored request packet correlation information. It analyzes recorded correlation information to determine application-to-application mapping and calculate application response times. Another embodiment inserts custom headers that contain information used to match a response packet with a request packet into request packets.

Claims

1. A method of generating a network topology representation based on inspection of application messages at a network device, the method comprising the computer-implemented steps of:

receiving a request packet at the network device from a request application;

associating request packet correlation information with a request application message in the request packet at the network device;

storing the request packet correlation information;

routing the request packet to a request packet destination;

receiving a response packet at the network device from a response application responding to the request application message;

associating response packet correlation information with a response application message in the response packet at the network device;

correlating the response packet correlation information for the response application message with the stored request packet correlation information for the request application message;

storing the response packet correlation information;

routing the response packet to a response packet destination;

analyzing the stored request packet correlation information and the stored response packet correlation information;

wherein the request application message and the response application message are messages exchanged in an application layer of the Open System Interconnection (OSI) Layer Model;

wherein the stored request packet correlation information identifies the request application at the application layer of the OSI Layer Model;

wherein the stored response packet correlation information identifies the response application at the application layer of the OSI Layer Model;

wherein the request packet and the response packet are Transport Control Protocol (TCP) packets;

wherein the analyzing step determines an application-to-application mapping at the application layer of the OSI Layer Model between the request application and the response application;

wherein the analyzing step calculates application response times and a response relevant metric;

wherein the application-to-application mapping, the application response times and the response relevant metric are published to outside applications;

wherein the method is performed by one or more processors.

2. A method as recited in claim 1, further comprising:

reporting an alarm if a given metric violates a predetermined threshold level.

3. A method as recited in claim 1, wherein the correlating step uses content-based correlation rules to correlate application interactions.

4. A method as recited in claim 1, wherein the stored request packet correlation information and the stored response packet correlation information that falls outside of a sliding window is discarded.

5. A method as recited in claim 1, further comprising:

reporting an alarm if the response packet is not received for the request packet and/or violates a predetermined metric.

6. A non-transitory computer-readable volatile or non-volatile storage medium storing one or more sequences of instructions for generating a network topology representation based on inspection of application messages at a network device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving a request packet at the network device from a request application;

associating request packet correlation information with a request application message in the request packet at the network device;

storing the request packet correlation information;

routing the request packet to a request packet destination;

receiving a response packet at the network device from a response application responding to the request application message;

associating a response packet correlation information with a response application message in the response packet at the network device;

correlating the response packet correlation information for the response application message with the stored request packet correlation information for the request application message;

storing the response packet correlation information;

routing the response packet to a response packet destination;

analyzing stored request packet correlation information and the stored response packet correlation information;

wherein the request application message and the response application message are messages exchanged in an application layer format of the Open System Interconnect (OSI) Layer Model;

wherein the stored request packet correlation information identifies the request application at the application layer of the OSI Layer Model;

wherein the stored response packet correlation information identifies the response application at the application layer of the OSI Layer Model;

wherein the analyzing step determines an application-to-application mapping at the application layer of the OSI Layer Model between the request application and the response application;

wherein the analyzing step calculates application response times and/or any other relevant metric;

wherein the application-to-application mapping, the application response times and the response relevant metric are published to outside applications.

7. A non-transitory computer-readable storage medium as recited in claim 6, further storing instructions, which when executed by the one or more processors, cause the one or more processors to perform:

reporting an alarm if a given metric violates a predetermined threshold level.

8. A non-transitory computer-readable storage medium as recited in claim 6, wherein the instructions for correlating the response packet correlation information use content-based correlation rules to correlate application interactions.

9. A non-transitory computer-readable storage medium as recited in claim 6, wherein the stored request correlation information and the stored response correlation information that fails outside a sliding window is discarded.

10. A non-transitory computer-readable storage medium as recited in claim 6, further storing instructions, which when executed by the one or more processors, cause the one or more processors to perform:

reporting an alarm if the response packet is not received for the request packet and/or violates a predetermined metric.

11. An apparatus for generating a network topology representation based on inspection of application messages at a network device, comprising:

one or more processors;

means for receiving a request packet at the network device from a request application;

means for associating request packet correlation information with a request application message in the request packet at the network device;

means for storing the request packet correlation information;

means for routing the request packet to a request packet destination;

means for receiving a response packet at the network device from a response application responding to the request application message;

means for associating response packet correlation information with a response application message in the response packet at the network device;

means for correlating the response packet correlation information for the response application message with the stored request packet correlation information for the request application message;

means for storing the response packet correlation information; and

means for routing the response packet to a response packet destination;

wherein the request packet and the response packet are Transport Control Protocol (TCP) packets;

means for analyzing the stored request packet correlation information and the stored response packet correlation information;

wherein the request application message and the response application message are messages exchanged in an application layer format of the Open System Interconnect (OSI) Layer Model;

wherein the stored request packet correlation information identifies the request application at the application layer of the OSI Layer Model;

wherein the stored response packet correlation information identifies the response application at the application layer of the OSI Layer Model;

wherein the analyzing means determines application-to-application mapping at the application layer of the OSI Layer Model;

wherein the analyzing means calculates application response times and a response relevant metric;

wherein the application-to-application mapping, the application response times and the response relevant metric are published to outside applications.

12. An apparatus as recited in claim 11, further comprising:

means for reporting an alarm if a given metric violates a predetermined threshold level.

13. An apparatus as recited in claim 11, wherein the correlating means uses content-based correlation rules to correlate application interactions.

14. An apparatus as recited in claim 11, wherein the stored request packet correlation information and the stored response packet correlation information that fails outside of a sliding window is discarded.

15. An apparatus as recited in claim 11, further comprising:

means for reporting an alarm if a response packet is not received for a request packet and/or violates a predetermined metric.