Bottom layer-coverage related

Abstract

Embodiments of the present disclosure relate to underlay-overlay correlation. The present disclosure describes techniques that include collecting underlay flow data along with overlay flow data within a network and correlating the data to enable insight into network operation and performance. In one example, the present disclosure describes a method that includes the steps of collecting flow data for a network having a plurality of network devices and a plurality of virtual networks established within the network; storing the flow data in a data repository; receiving an information request about a data flow, wherein the information request specifies a source virtual network for the data flow and also specifies a destination virtual network for the data flow; and querying the data repository with the specified source virtual network and the specified destination virtual network to identify one or more network devices that have processed at least one packet in the data flow based on the stored flow data.

Description

Technical Field

[0001] The present disclosure relates to analysis of computer networks, including analysis of the paths taken by data through the network. Background Art

[0002] Virtualized data centers are becoming a core foundation of modern information technology (IT) infrastructure. In particular, modern data centers have extensively utilized virtualized environments in which virtual hosts such as virtual machines or containers are deployed and executed on underlying computing platforms of physical computing devices.

[0003] Virtualization within large data centers can provide a variety of benefits, including efficient use of computing resources and simplified network configuration. Therefore, enterprise IT staff often prefer virtualized computing clusters in data centers due to the management advantages of these clusters, in addition to the efficiency and improved return on investment (ROI) provided by virtualization. However, virtualization can bring some challenges when analyzing, evaluating and / or troubleshooting network operations. Summary of the invention

[0004] The present disclosure describes techniques that include collecting information about physical network infrastructure (e.g., underlying flow data) and information about network virtualization (e.g., overlay flow data), and associated data to enable insight into network operation and performance. In some examples, samples of both underlying flow data and overlay flow data are collected and stored in a manner that supports not only high availability and high volume flow data collection but also analysis of such data in response to analytical queries. Prior to or in response to such queries, the underlying flow data may be enriched, augmented, and / or supplemented with overlay flow data to enable insight into, identification of, and / or analysis of underlying network infrastructure that may correspond to overlay data flows. Diagrams and other information illustrating which components of the underlying network infrastructure correspond to various overlay data flows may be presented in a user interface.

[0005] The techniques described herein may provide one or more technical advantages. For example, by providing information about how the underlying network infrastructure relates to various overlay data flows, it is possible to create useful tools for discovery and investigation. In some examples, such tools may be used for efficient and streamlined troubleshooting and analysis of virtualized networks. As an example, the techniques described herein may allow for more efficient troubleshooting of connectivity, at least because these techniques enable the identification of a significantly reduced number of underlying network devices that may be associated with the connectivity problem.

[0006] In some examples, the present disclosure describes operations performed by a network analysis system or other network system according to one or more aspects of the present disclosure. In one specific example, the present disclosure describes a method comprising the following steps: collecting flow data for a network having multiple network devices and multiple virtual networks established within the network, wherein the flow data includes underlying flow data and overlay flow data, the underlying flow data includes multiple underlying data flows, the overlay flow data includes multiple overlay data flows, wherein the underlying flow data identifies, for each underlying data flow included in the underlying flow data, a network device that has processed a network packet associated with the underlying data flow, and wherein the overlay flow data identifies, for each overlay data flow included in the overlay flow data, one or more virtual networks in the virtual network associated with the overlay data flow; storing the flow data in a data repository; receiving an information request about the data flow, wherein the information request specifies a source virtual network for the data flow, and also specifies a destination virtual network for the data flow; and querying the data repository with the specified source virtual network and the specified destination virtual network to identify, based on the stored flow data, one or more network devices that have processed at least one packet in the data flow.

[0007] In another example, the present disclosure describes a system including a processing circuit configured to perform the operations described herein. In another example, the present disclosure describes a non-transitory computer-readable storage medium including instructions that, when executed, configure the processing circuit of a computing system to perform the operations described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1A is a conceptual diagram illustrating an example network including a system for analyzing traffic flows across a network and / or within a data center in accordance with one or more aspects of the present disclosure.

[0009] Figure 1B is a conceptual diagram illustrating example components of a system for analyzing traffic flows across a network and / or within a data center in accordance with one or more aspects of the present disclosure.

[0010] Figure 2 is a block diagram illustrating an example network for analyzing traffic flows across a network and / or within a data center according to one or more aspects of the present disclosure.

[0011] Figure 3 is a conceptual diagram illustrating example queries performed on stored underlay flow data and overlay flow data according to one or more aspects of the present disclosure.

[0012] Figure 4is a conceptual diagram illustrating an example user interface presented by a user interface device according to one or more aspects of the present disclosure.

[0013] Figure 5 is a flow diagram illustrating operations performed by an example network analysis system in accordance with one or more aspects of the present disclosure. DETAILED DESCRIPTION

[0014] Data centers using virtualized environments provide efficiency, cost, and organizational advantages in which virtual hosts such as virtual machines or virtual containers are deployed and executed on the underlying computing platform of physical computing devices. However, obtaining meaningful insights into application workloads is essential for managing any data center structure. Collecting traffic samples from networked devices can help provide such insights. In the various examples described herein, traffic samples are collected and then processed by analysis algorithms so that information about overlay traffic can be related to the underlying infrastructure. In some examples, a user interface can be generated to support visualization of the collected data and how the underlying infrastructure is related to various overlay networks. The presentation of such data in a user interface can provide insights into the network and provide tools for network discovery, investigation, and troubleshooting to users, administrators, and / or other personnel.

[0015] Figure 1A is a conceptual diagram illustrating an example network including a system for analyzing traffic flows across a network and / or within a data center in accordance with one or more aspects of the present disclosure. Figure 1A An example implementation of a network system 100 and a data center 101 is illustrated, the data center 101 hosting one or more computing networks, computing domains or projects, and / or cloud-based computing networks, which are generally referred to herein as cloud computing clusters. Cloud-based computing clusters can be co-located in a common overall computing environment (such as a single data center) or distributed across environments (such as across different data centers). Cloud-based computing clusters can be, for example, different cloud environments, such as an OpenStack cloud environment, a Kubernetes cloud environment, or various combinations of other computing clusters, domains, networks, etc. In other instances, other implementations of the network system 100 and data center 101 may be appropriate. Such implementations may include Figure 1A A subset of the components included in the examples and / or may include components not included in Figure 1A Additional components shown in .

[0016] exist Figure 1A In the example of FIG. 1 , data center 101 provides an operating environment for applications and services to customers 104 coupled to data center 101 via service provider network 106. Figure 1AThe functions and operations described in the network system 100 may be illustrated as in Figure 1A distributed across multiple devices, but in other examples attributed to Figure 1A The features and techniques of one or more devices in the present invention may be performed internally by local components of one or more such devices. Similarly, one or more such devices may include specific components and perform various techniques that may otherwise be attributed to one or more other devices in the description herein. Further, specific operations, techniques, features, and / or functions may be combined with Figure 1A In some embodiments, the present invention may be described as being performed by a particular component, device, and / or module. In other examples, such operations, techniques, features, and / or functions may be performed by other components, devices, or modules. Therefore, some operations, techniques, features, and / or functions attributed to one or more components, devices, or modules may be attributed to other components, devices, and / or modules, even if not specifically described in this manner herein.

[0017] Data center 101 hosts infrastructure equipment, such as networking and storage systems, redundant power supplies, and environmental controls.Service provider network 106 may be coupled to one or more networks managed by other providers, and thus may form part of a large-scale public network infrastructure such as the Internet.

[0018] In some examples, data center 101 may represent one of many geographically distributed network data centers. Figure 1A As shown in the example of FIG. 1 , data center 101 is a facility that provides network services to customers 104. Customers 104 may be collective entities such as businesses and governments or individuals. For example, a network data center may host network services for multiple businesses and end users. Other exemplary services may include data storage, virtual private networks, traffic engineering, file services, data mining, scientific or supercomputing, etc. In some examples, data center 101 is a separate network server, network peer, or other.

[0019] exist Figure 1AIn the example of , data center 101 includes a group of storage systems, application servers, computing nodes, or other devices, including network devices 110A to network devices 110N (collectively referred to as "network devices 110", representing any number of network devices). Devices 110 can be interconnected via a high-speed switching structure 121 provided by one or more layers of physical network switches and routers. In some examples, devices 110 can be included in structure 121, but are shown separately for ease of illustration. Network devices 110 can be any of many different types of network devices (core switches, backbone network devices, leaf network devices, edge network devices, or other network devices), but in some examples, one or more devices 110 can act as physical computing nodes in a data center. For example, one or more of devices 110 can provide an operating environment for executing one or more customer-specific virtual machines or other virtualized instances (such as containers). In such an example, one or more of devices 110 can alternatively be referred to as host computing devices or more simply hosts. Network devices 110 can thereby execute one or more virtualized instances, such as virtual machines, containers, or other virtual execution environments for running one or more services such as virtualized network functions (VNFs).

[0020] In general, each network device 110 can be any type of device that can operate on a network and can generate data (e.g., flow data or sFlow data) that is accessible via telemetry or other means, which can include any type of computing device, sensor, camera, node, monitoring device, or other device. Further, some or all of the network devices 110 can represent a component of another device, where such a component can generate data that can be collected via telemetry or other means. For example, some or all of the network devices 110 can represent physical or virtual network devices, such as switches, routers, hubs, gateways, security devices (e.g., firewalls), intrusion detection and / or intrusion prevention devices.

[0021] Although not specifically shown, the switch fabric 121 may include a top-of-rack (TOR) switch coupled to a distribution layer of chassis switches, and the data center 101 may include one or more non-edge switches, routers, hubs, gateways, security devices (such as firewalls), intrusion detection and / or intrusion prevention devices, servers, computer terminals, laptops, printers, databases, wireless mobile devices (such as cellular phones or personal digital assistants), wireless access points, bridges, cable modems, application accelerators, or other network devices. The switch fabric 121 may perform layer 3 routing to route network traffic between the data center 101 and the customer 104 through the service provider network 106. The gateway 108 is used to forward and receive packets between the switch fabric 121 and the service provider network 106.

[0022] According to one or more examples of the present disclosure, a software defined network (“SDN”) controller 132 provides a logically and, in some cases, physically centralized controller for facilitating operation of one or more virtual networks within a data center 101. In some examples, the SDN controller 132 responds to configuration input operations received via a northbound API 131 from an orchestration engine 130, which in turn may respond to configuration input operations received from an administrator 128 interacting with and / or operating a user interface device 129.

[0023] The user interface device 129 can be implemented as any suitable device for presenting output and / or accepting user input. For example, the user interface device 129 can include a display. The user interface device 129 can be a computing system, such as a mobile or non-mobile computing device operated by a user and / or administrator 128. According to one or more aspects of the present disclosure, the user interface device 129 can, for example, represent a workstation, a laptop or notebook computer, a desktop computer, a tablet computer, or any other computing device that can be operated and / or present a user interface by a user. In some examples, the user interface device 129 can be physically separated from the controller 201 and / or be in a different position from the controller 201. In this example, the user interface device 129 can communicate with the controller 201 through a network or other communication means. In other examples, the user interface device 129 can be a local peripheral device of the controller 201, or can be integrated into the controller 201.

[0024] In some examples, orchestration engine 130 manages functions of data center 101, such as computing, storage, networking, and application resources. For example, orchestration engine 130 can create virtual networks for tenants within data center 101 or across data centers. Orchestration engine 130 can attach virtual machines (VMs) to a tenant's virtual network. Orchestration engine 130 can connect a tenant's virtual network to an external network, such as the Internet or a VPN. Orchestration engine 130 can implement security policies across a group of VMs or to the boundaries of a tenant network. Orchestration engine 130 can deploy network services (e.g., load balancers) in a tenant's virtual network.

[0025] In some examples, the SDN controller 132 manages network and networking services such as load balancing, security, and can allocate resources from the device 110 acting as a host device to various applications via the southbound API 133. That is, the southbound API 133 represents a set of communication protocols that the SDN controller 132 utilizes to make the actual state of the network equal to the desired state as specified by the orchestration engine 130. For example, the SDN controller 132 can implement high-level requests from the orchestration engine 130 by configuring the following: physical switches, such as TOR switches, chassis switches, and switch fabrics 121; physical routers; physical service nodes, such as firewalls and load balancers; and virtual services such as virtual firewalls in VMs. The SDN controller 132 maintains routing, network, and configuration information in a state database.

[0026] Network analysis system 140 interacts with one or more of devices 110 (and / or other devices) to collect flow data across data center 101 and / or network system 100. Such flow data may include underlying flow data and overlay flow data. In some examples, the underlying flow data may be collected with the aid of samples of flow data collected at layer 2 of the OSI model. Overlay flow data may be data (e.g., data samples) derived from overlay traffic across one or more virtual networks established within network system 100. Overlay flow data may, for example, include information identifying a source virtual network and a destination virtual network.

[0027] According to one or more aspects of the present disclosure, Figure 1A The network analysis system 140 can configure each device 110 to collect flow data. Figure 1A In the depicted example, network analysis system 140 outputs a signal to each device 110. Each device 110 receives the signal and interprets the signal as a command to collect flow data, which includes underlying flow data and / or overlay flow data. Thereafter, as data packets are processed by each device 110, each device 110 transmits the underlying flow data and / or overlay flow data to network analysis system 140. Network analysis system 140 receives the flow data, prepares it for use in response to analysis queries, and stores the flow data. Figure 1A In the example of FIG. 1 , other network devices including network devices (not specifically shown) within switch fabric 121 may also be configured to collect underlay and / or overlay flow data.

[0028] The network analysis system 140 can process the query. For example, in the described example, the user interface device 129 detects the input and outputs information about the input to the network analysis system 140. The network analysis system 140 determines that the information corresponds to a request for information about the network system 100 from the user of the user interface device 129. The network analysis system 140 processes the request by querying the stored flow data. The network analysis system 140 generates a response to the query based on the stored flow data and outputs information about the response to the user interface device 129.

[0029] In some examples, the request received from user interface device 129 may include a source and / or destination virtual network. In such examples, network analysis system 140 may, in response to such a request, identify one or more possible data paths on underlying network devices that packets traveling from the source virtual network to the destination virtual network may have taken. To identify the possible data paths, network analysis system 140 may correlate the collected overlay flow data with the collected underlying flow data so that the underlying network devices used by the overlay data flow may be identified.

[0030] Figure 1B is a conceptual diagram illustrating example components of a system for analyzing traffic flows across a network and / or within a data center in accordance with one or more aspects of the present disclosure. Figure 1B Including combination Figure 1A Many of the same elements described. Figure 1B The elements shown may correspond to Figure 1A The same reference numerals as in Figure 1A Generally speaking, such same numbered elements can be combined with Figure 1A The descriptions of corresponding elements are provided to be implemented in a consistent manner, but in some examples, such elements may relate to alternative implementations having more, fewer and / or different capabilities and attributes.

[0031] However, with Figure 1A different, Figure 1BComponents of a network analysis system 140 are illustrated. The network analysis system 140 is shown to include a load balancer 141, a flow collector 142, a queue and event repository 143, a topology and metric source 144, a data repository 145, and a flow API 146. In general, the network analysis system 140 and the components of the network analysis system 140 are designed and / or configured to ensure high availability and the ability to handle large volumes of flow data. In some examples, multiple instances of components of the network analysis system 140 can be orchestrated (e.g., by the orchestration engine 130) to execute on different physical servers to ensure that there is no single point of failure for any component of the network analysis system 140. In some examples, the network analysis system 140 or its components can be independently and horizontally scaled to enable efficient and / or effective processing of expected volumes of traffic (e.g., flow data).

[0032] and Figure 1A Same as in Figure 1B The network analysis system 140 may configure each device 110 to collect flow data. For example, the network analysis system 140 may output a signal to each device 110 to configure each device 110 to collect flow data, the flow data including underlying flow data and overlay flow data. Thereafter, one or more of the devices 110 may collect the underlying flow data and overlay flow data, and report such flow data to the network analysis system 140.

[0033] exist Figure 1B In the example, the load balancer 141 of the network analysis system 140 receives the flow data from each device 110. Figure 1B In the example, load balancer 141 may receive flow data from each device 110. Load balancer 141 may distribute traffic across multiple flow collectors to ensure an active / active failover strategy for flow collectors. In some examples, multiple load balancers 141 may be required to ensure high availability and scalability.

[0034] The flow collector 142 collects data from the load balancer 141. For example, the flow collector 142 of the network analysis system 140 receives and processes flow packets from each device 110 (after being processed by the load balancer 141). The flow collector 142 sends the flow packets upstream to the queue and event repository 143. In some examples, the flow collector 142 can address, process and / or accommodate unified data from sFlow, NetFlow v9, IPFIX, jFlow, Contrail Flow, and other formats. The flow collector 142 may be able to parse the internal headers from sFlow packets and other data flow packets. The flow collector 142 may be able to handle message overflow, enriched flow records with topology information (e.g., AppFormix topology information), etc. The flow collector 142 may also be able to convert the data into a binary format before writing or sending the data to the queue and event repository 143. The underlying flow data of the "sFlow" type (referred to as "sampled flow") is a standard for packet output at layer 2 of the OSI model. It provides a means for outputting truncated packets, as well as interface counters for network monitoring purposes.

[0035] The queue and event repository 143 processes the collected data. For example, the queue and event repository 143 can receive data from one or more flow collectors 142, store the data, and make the data available for ingestion in the data repository 145. In some examples, this enables the separation of the task of receiving and storing large volumes of data from the task of indexing the data and preparing it for analytical queries. In some examples, the queue and event repository 143 can also enable independent users to directly consume the stream of flow records. In some examples, the queue and event repository 143 can be used to discover anomalies and generate alarms in real time. In some examples, flow data can be parsed by reading encapsulated packets, which include VXLAN, MPLS on UDP, and MPLS on GRE. The queue and event repository 143 parses the source IP, destination IP, source port, destination port, and protocol from the internal (bottom layer) packet. Some types of flow data (including sFlow data) only include fragments of sampled network traffic (e.g., the first 128 bytes), so in some cases, the flow data may not include all internal fields. In this example, this data can be marked as missing.

[0036] The topology and metric sources 144 may enrich or augment the data with topology information and / or metric information. For example, the topology and metric sources 144 may provide network topology metadata, which may include identified nodes or network devices, configuration information, configurations, established links, and other information about such nodes and / or network devices. In some examples, the topology and metric sources 144 may use AppFormix topology data, or may be an executing AppFormix module. The information received from the topology and metric sources 144 may be used to enrich the flow data collected by the flow collector 142 and to support the flow API 146 in processing queries of the data repository 145.

[0037] Data repository 145 can be configured to store data received from queue and event repository 143 and topology and metric source 144 in an indexed format, thereby supporting fast aggregate queries and fast random access data retrieval. In some examples, data repository 145 can achieve fault tolerance and high availability by sharding and replicating data.

[0038] The flow API 146 can process query requests sent by one or more user interface devices 129. For example, in some examples, the flow API 146 can receive the query request from the user interface device 129 via an HTTP POST request. In such an example, the flow API 146 converts the information included in the request into a query to the data repository 145. In order to create the query, the flow API 146 can use the topology information from the topology and metric source 144. The flow API 146 can use one or more of such queries to perform analysis on behalf of the user interface device 129. Such analysis may include traffic deduplication, overlay-underlay correlation, traffic path identification, and / or heatmap traffic calculation. In particular, such analysis may involve correlating the underlying flow data with the overlay flow data, thereby supporting identification of which underlying network devices are associated with traffic flowing on the virtual network and / or between two virtual machines.

[0039] With the techniques according to one or more aspects of the present disclosure, network analysis system 140 may be able to determine, for a given data flow, to which tenant the data flow belongs in a multi-tenant data center, such as by correlating underlying flow data with overlay flow data. Further, network analysis system 140 may also be able to determine which virtual computing instances (e.g., virtual machines or containers) are the source and / or destination virtual computing instances for such a flow. Still further, correlating underlying flow data with overlay flow data, such as by enriching the underlying flow data with overlay flow data, may facilitate troubleshooting of performance or other issues that may arise in network system 100.

[0040] For example, in some cases, during a specific time frame when limited information is available but information about the source and destination virtual networks is known, connectivity problems may occur. Solving this problem may be challenging because it may be difficult to pinpoint the physical path taken by the data flow through the network given the source virtual network and the destination virtual network. Because the actual physical path through the underlying infrastructure may not be easily known in addition, there may be many network devices or physical links that are potential causes of connectivity problems. However, by collecting underlying flow data and overlay flow data and enriching the underlying flow data with overlay flow data collected during the same time period, it is possible to identify which underlying network devices have processed the data flow and the physical links traversed by the data flow, so that it is possible to determine the data path - or the most likely or a group of possible data paths - the data flow taken through the network, or at least determine a smaller amount of possible data paths for the data flow. Therefore, solving this connectivity problem can be significantly more efficient, at least because the number of underlying network devices related to the connectivity problem can be greatly reduced.

[0041] Figure 2 is a block diagram illustrating an example network for analyzing traffic flows across a network and / or within a data center according to one or more aspects of the present disclosure. Figure 2 The network system 200 can be described as Figure 1A or Figure 1B An example or alternative implementation of a network system 100 of FIG. 1 may be described herein in the context of FIG. Figure 2 one or more aspects of .

[0042] Although data centers such as Figure 1A , Figure 1B as well as Figure 2 The data centers shown can be operated by any entity, but some data centers are operated by service providers, where the business model of such service providers is to provide computing power to their clients. For this reason, data centers usually contain a large number of computing nodes or host devices. In order to operate efficiently, these hosts must be connected to each other and the outside world, and this capability is provided by means of physical network devices, which can be interconnected in a leaf-spine topology. The collection of these physical devices (such as network devices and hosts) forms the underlying network.

[0043] Each host device in such a data center typically has multiple virtual machines running on it, which are called workloads. Clients in the data center typically have access to these workloads and can use such workloads to install applications and perform other operations. Workloads running on different host devices but accessible by a specific client are organized into virtual networks. Each client typically has at least one virtual network. These virtual networks are also called overlay networks. In some cases, clients in the data center may experience connectivity issues between two applications running on different workloads. Due to the deployment of workloads in large multi-tenant data centers, solving this problem is often complicated.

[0044] exist Figure 2 In the example of FIG. 2 , network 205 connects network analysis system 240, host device 210A, host device 210B, and host device 210N. Network analysis system 240 may correspond to Figure 1A and Figure 1B An example or alternative implementation of the network analysis system 140 is shown. Host devices 210A, 210B, through 210N may be collectively referred to as “host devices 210 ,” representing any number of host devices 210 .

[0045] Each host device 210 may be Figure 1A and Figure 1B An example of device 110, but in Figure 2 In the example of FIG. 1 , each host device 210 is implemented as a server or host device operating as a computing node of a virtualized data center, as opposed to a network device. Figure 2 In the example of , each host device 210 executes multiple virtual computing instances, such as virtual machines 228.

[0046] and Figure 1A and Figure 1B Likewise, user interface device 129, which may be operated by administrator 128, is also connected to network 205. In some examples, user interface device 129 may present one or more user interfaces at a display device associated with user interface device 129, some of which may have a form similar to user interface 400.

[0047] Figure 2 Also illustrated are underlying flow data 204 and overlay flow data 206 flowing within network system 200. In particular, underlying flow data 204 is shown leaving backbone device 202A and flowing toward network analysis system 240. Similarly, overlay flow data 206 is shown leaving host device 210A and flowing across 205. In some examples, overlay flow data 206 is transmitted to network analysis system 240 via network 205, as described herein. For simplicity, Figure 2 A single instance of underlying flow data 204 and a single instance of overlay flow data 206 are illustrated. However, it should be understood that each of the spine devices 202 and leaf devices 203 can generate underlying flow data 204 and transmit it to the network analysis system 240, and in some examples, each host device 210 (and / or other devices) can generate underlying flow data 204 and transmit such data across the network 205 to the network analysis system 240. Further, it should be understood that each host device 210 (and / or other devices) can generate overlay flow data 206 and transmit such data to the network analysis system 240 via the network 205.

[0048] Network 205 may correspond to Figure 1A and Figure 1B The network 205 may include any one of the switch fabric 121 and / or the service provider network 106, or alternatively, may correspond to a combination of the switch fabric 121, the service provider network 106, and / or another network. Figure 1A and Figure 1B Some components of include gateway 108, SDN controller 132 and orchestration engine 130.

[0049] Illustrated within network 205 are spine devices 202A and 202B (collectively referred to as "spine devices 202," and any number of spine devices 202 is represented), and leaf devices 203A, 203B, and 203C (collectively referred to as "leaf devices 203," and any number of leaf devices 203 is represented). Although network 205 is illustrated as having spine devices 202 and leaf devices 203, other types of network devices may be included in network 205, including core switches, edge network devices, top-of-rack devices, and other network devices.

[0050] In general, network 205 may be the Internet, or may include or represent any public or private communications network or other network. For example, network 205 may be a cellular network, ZigBee, Bluetooth, near field communication (NFC), satellite, enterprise, service provider, and / or other types of networks that support the transfer of transmission data between computing systems, servers, and computing devices. One or more of the client devices, server devices, or other devices may transmit and receive data, commands, control signals, and / or other information across the network 205 using any suitable communication technology. The network 205 may include one or more network hubs, network switches, network routers, satellite dishes, or any other network devices. Such devices or components may be operably coupled to each other to provide information exchange between computers, devices, or other components (e.g., between one or more client devices or systems and one or more server devices or systems). Figure 2 Each device or system shown may be operatively coupled to the network 205 using one or more network links. The links coupling such devices or systems to the network 205 may be Ethernet, Asynchronous Transfer Mode (ATM), or other types of network connections, and such connections may be wireless and / or wired connections. Figure 2 One or more devices or systems shown or otherwise on network 205 may be in a remote location relative to one or more other shown devices or systems.

[0051] The network analysis system 240 may be implemented as any suitable computing system, such as one or more server computers, workstations, mainframes, appliances, cloud computing systems, and / or other computing systems that may be capable of performing operations and / or functions described according to one or more aspects of the present disclosure. In some examples, the network analysis system 240 represents a cloud computing system, a server farm, and / or a server cluster (or a portion thereof) that provides services to client devices and other devices or systems. In other examples, the network analysis system 240 may represent or be implemented with the aid of one or more virtualized computing instances (e.g., virtual machines, containers) of a data center, cloud computing system, server farm, and / or server cluster.

[0052] exist Figure 2 In the example of , the network analysis system 240 may include a power supply 241, one or more processors 243, one or more communication units 245, one or more input devices 246, and one or more output devices 247. The storage device 250 may include one or more collector modules 252, a user interface module 254, a stream API 256, and a data repository 259.

[0053] One or more of the devices, modules, storage areas, or other components of network analysis system 240 may be interconnected to enable inter-component communication (physically, communicatively, and / or operationally.) In some examples, such connectivity may be provided via a communication channel (e.g., communication channel 242), a system bus, a network connection, an inter-process communication data structure, or any other method for transferring data.

[0054] Power supply 241 can provide power to one or more components of network analysis system 240. Power supply 241 can receive power from a main alternating current (AC) power source in a data center, building, home, or other location. In other examples, power supply 241 can be a battery or a device that supplies direct current (DC). In yet other examples, network analysis system 240 and / or power supply 241 can receive power from another source. One or more devices or components illustrated within network analysis system 240 can be connected to power supply 241, and / or can receive power from power supply 241. Power supply 241 can have intelligent power management or consumption capabilities, and such features can be controlled, accessed, or adjusted by one or more modules of network analysis system 240 and / or by one or more processors 243 to intelligently consume, distribute, supply, or otherwise manage power.

[0055] The one or more processors 243 of the network analysis system 240 can implement functionality and / or execute instructions associated with the network analysis system 240 or associated with one or more modules illustrated and / or described herein. The one or more processors 243 can be a processing circuit that performs operations according to one or more aspects of the present disclosure, can be a part of it, and / or can include the processing circuit. Examples of processors 243 include microprocessors, application processors, display controllers, auxiliary processors, one or more sensor hubs, and any other hardware configured to function as a processor, processing unit, or processing device. The central monitoring system can use one or more processors 243 to perform operations according to one or more aspects of the present disclosure using software, hardware, firmware, or a mixture of hardware, software, and firmware resident in and / or executed at the network analysis system 240.

[0056] One or more communication units 245 of network analysis system 240 can communicate with devices external to network analysis system 240 by transmitting and / or receiving data, and in some aspects can operate as both an input device and an output device. In some examples, communication unit 245 can communicate with other devices over a network. In other examples, communication unit 245 can send and / or receive radio signals over a radio network, such as a cellular radio network. Examples of communication unit 245 include a network interface card (e.g., such as an Ethernet card), an optical transceiver, a radio frequency transceiver, a GPS receiver, or any other type of device that can send and / or receive information. Other examples of communication unit 245 can include a device that can transmit and / or receive information over a network. Devices that communicate with GPS, NFC, ZigBee, and cellular networks (e.g., 3G, 4G, 5G), as well as those found in mobile devices and Universal Serial Bus (USB) controllers, etc. Radio transceiver. Such communications may embrace, implement or comply with appropriate protocols, including Transmission Control Protocol / Internet Protocol (TCP / IP), Ethernet, Bluetooth, NFC or other technologies or protocols.

[0057] The one or more input devices 246 may represent any input device of the network analysis system 240 not otherwise separately described herein. The one or more input devices 246 may generate, receive, and / or process input from any type of device capable of detecting input from a person or a machine. For example, the one or more input devices 246 may generate, receive, and / or process input in the form of electrical, physical, audio, image, and / or visual input (e.g., peripherals, keyboards, microphones, cameras).

[0058] The one or more output devices 247 may represent any output device of the network analysis system 240 not otherwise separately described herein. The one or more output devices 247 may generate, receive, and / or process input from any type of device capable of detecting input from a person or a machine. For example, the one or more output devices 247 may generate, receive, and / or process output in the form of electrical and / or physical output (e.g., peripheral devices, actuators).

[0059] One or more storage devices 250 within the network analysis system 240 may store information for processing during operation of the network analysis system 240. The storage device 250 may store program instructions and / or data associated with one or more modules described according to one or more aspects of the present disclosure. One or more processors 243 and one or more storage devices 250 may provide an operating environment or platform for such modules, which may be implemented as software, but in some examples may include any combination of hardware, firmware, and software. One or more processors 243 may execute instructions, and one or more storage devices 250 may store instructions and / or data for one or more modules. The combination of the processor 243 and the storage device 250 may retrieve, store, and / or execute instructions and / or data for one or more applications, modules, or software. The processor 243 and / or the storage device 250 may also be operably coupled to one or more other software and / or hardware components, including but not limited to one or more components of the network analysis system 240 and / or one or more devices or systems illustrated as being connected to the network analysis system 240.

[0060] In some examples, one or more storage devices 250 are implemented with temporary storage, which may mean that the primary purpose of one or more storage devices is not long-term storage. The storage device 250 of the network analysis system 240 may be configured to perform short-term information storage as a volatile memory, so that the stored content is not retained when deactivated. Examples of volatile memory include random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), and other forms of volatile memory known in the art. In some examples, the storage device 250 also includes one or more computer-readable storage media. The storage device 250 may be configured to store a larger amount of information than a volatile memory. The storage device 250 may also be configured to perform long-term information storage as a non-volatile storage space and retain information after an activation / deactivation cycle. Examples of non-volatile memory include magnetic hard disks, optical disks, flash memory, or electrically programmable memory (EPROM) or electrically erasable programmable (EEPROM) memory.

[0061] Collector module 252 can perform functions related to receiving both underlying flow data 204 and overlay flow data 206 and performing load balancing as needed to ensure high availability, throughput, and scalability for collecting such flow data. Collector module 252 can process the data and prepare the data for storage in data repository 259. In some examples, collector module 252 can store the data in data repository 259.

[0062] User interface module 254 may perform functions related to generating a user interface for presenting the results of an analytical query executed by stream API 256. In some examples, user interface module 254 may generate information sufficient to generate a set of user interfaces and cause communication unit 215 to output such information over network 205 for use by user interface device 129 to present one or more user interfaces at a display device associated with user interface device 129.

[0063] Stream API 256 may perform analytical queries involving data stored in data store 259 derived from a collection of underlying stream data 204 and overlay stream data 206. In some examples, stream API 256 may receive a request in the form of information derived from an HTTP POST request, and in response, may convert the request into a query to be performed on data store 259. Further, in some examples, stream API 256 may obtain topology information related to device 110 and perform analysis including data deduplication, overlay-underlay correlation, traffic path identification, and heat map traffic calculation.

[0064] The data repository 259 may represent any suitable data structure or storage medium for storing information related to data stream information, including storage of data derived from the underlying stream data 204 and the overlay stream data 206. The data repository 259 may be responsible for storing data in an indexed format, which enables fast retrieval of data and execution of queries. The information stored in the data repository 259 may be searchable and / or categorized, so that one or more modules within the network analysis system 240 may provide an input requesting information from the data repository 259, and in response to the input, receive information stored in the data repository 259. The data repository 259 may be maintained primarily by the collector module 252. The data repository 259 may be implemented with the aid of multiple hardware devices, and may achieve fault tolerance and high availability by sharding and replicating data. In some examples, the data repository 259 may be implemented using the open source ClickHouse column-oriented database management system.

[0065] Each host device 210 represents a physical computing device or computing node that provides an execution environment for a virtual host, virtual machine, container, and / or other virtualized computing resource. In some examples, each host device 210 can be a component of a cloud computing system, a server farm, and / or a server cluster (or a portion thereof) that provides services to client devices and other devices or systems.

[0066] Certain aspects of host device 210 are described herein with respect to host device 210A. Other host devices 210 (e.g., host devices 210B to 210N) may be similarly described and may also include the same, similar, or corresponding components, devices, modules, functionalities, and / or other features. Therefore, the description herein with respect to host device 210A may be correspondingly applied to one or more other host devices 210 (e.g., host devices 210B to 210N).

[0067] exist Figure 2In the example of , host device 210A includes basic physical computing hardware, which includes power supply 211, one or more processors 213, one or more communication units 215, one or more input devices 216, one or more output devices 217, and one or more storage devices 220. Storage device 220 may include hypervisor 221, which includes kernel module 222, virtual router module 224, and agent module 226. Virtual machines 228A to 228N (collectively referred to as "virtual machines 228", representing any number of virtual machines 228) are executed on hypervisor 221 or controlled by hypervisor 221. Similarly, virtual router agent 229 can be executed on hypervisor 221 or under the control of hypervisor 221. One or more of the devices, modules, storage areas, or other components of host device 210 can be interconnected to enable inter-component communication (physically, communicatively, and / or operationally). In some examples, such connectivity can be provided by a communication channel (e.g., communication channel 212), a system bus, a network connection, an inter-process communication data structure, or any other method for transmitting data.

[0068] The power supply 211 may provide power to one or more components of the host device 210. The processor 213 may implement functionality and / or execute instructions associated with the host device 210. The communication unit 215 may communicate with other devices or systems on behalf of the host device 210. One or more input devices 216 and output devices 217 may represent any other input and / or output devices associated with the host device 210. The storage device 220 may store information for processing during operation of the host device 210A. Each of such components may be implemented in a manner similar to that described herein in conjunction with the network analysis system 240 or otherwise.

[0069] The hypervisor 221 can act as a module or system that instantiates, creates, and / or executes one or more virtual machines 228 on an underlying host hardware device. In some contexts, the hypervisor 221 can be referred to as a virtual machine manager (VMM). The hypervisor 221 can execute within an execution environment provided by the storage device 220 and the processor 213 or on an operating system kernel (e.g., kernel module 222). In some examples, the hypervisor 221 is an operating system-level component that executes on a hardware platform (e.g., host 210) to provide a virtualized operating environment and orchestration controller for virtual machines 228 and / or other types of virtual computing instances. In other examples, the hypervisor 221 can be a software and / or firmware layer that provides a lightweight kernel and operates to provide a virtualized operating environment and orchestration controller for virtual machines 228 and / or other types of virtual computing instances. The hypervisor 221 can incorporate the functionality of the kernel module 222 (e.g., as a "type 1 hypervisor"), such as Figure 2 In other examples, hypervisor 221 can execute on a core (eg, as a "type 2 hypervisor").

[0070] The virtual router module 224 can execute multiple routing instances for corresponding virtual networks within the data center 101, and can transmit packet routing to appropriate virtual machines executed within the operating environment provided by the device 110. The virtual router module 224 can also be responsible for collecting overlay flow data, such as Contrail Flow data when used in an infrastructure that adopts Contrail SDN. Therefore, each host device 210 can include a virtual router. The packet received by the virtual router module 224 of the host device 210A, for example, from the underlying physical network structure may include an outer header to allow the physical network structure to tunnel the payload or "inner packet" to the physical network address of the network interface for the host device 210A. The outer header may include not only the physical network address of the server network interface, but also a virtual network identifier, such as a VxLAN label or a multi-protocol label switching (MPLS) label that identifies one of the virtual networks and the corresponding routing instance executed by the virtual router. The inner packet includes an inner header having a destination network address that conforms to the virtual network addressing space for the virtual network identified by the virtual network identifier.

[0071] Agent module 226 may be executed as part of hypervisor 221, or may be executed in kernel space or as part of kernel module 222. Agent module 226 may monitor some or all performance metrics associated with host device 210A, and may implement and / or execute actions that may be taken from policy controller ( Figure 2The proxy module 226 may configure the virtual router module 224 to transmit the overlay flow data to the network analysis system 240.

[0072] Virtual machines 228A through 228N (collectively referred to as "virtual machines 228" and representing any number of virtual machines 228) may represent example instances of virtual machines 228. Host device 210A may divide the virtual and / or physical address space provided by storage device 220 into a user space for running user processes. Host device 210A may also divide the virtual and / or physical address space provided by storage device 220 into a kernel space, which is protected and may not be accessible to user processes.

[0073] In general, each virtual machine 228 may be any type of software application, and each virtual machine may be assigned a virtual address for use within a corresponding virtual network, where each virtual network may be a different virtual subnet provided by virtual router module 224. For example, each virtual machine 228 may be assigned its own virtual layer three (L3) IP address for sending and receiving communications, but each virtual machine is unaware of the IP address of the physical server on which the virtual machine is executed. In this manner, a "virtual address" is an address for an application that is different from the address for the underlying physical computer system (e.g., Figure 2 The logical address of the host device 210A in the example.

[0074] Each virtual machine 228 may represent a tenant virtual machine that runs a client application (such as a web server, a database server, an enterprise application) or hosts a virtualized service for creating a service chain. In some cases, any one or more of the host device 210 or another computing device directly (i.e., not as a virtual machine) hosts the client application. Although one or more aspects of the present disclosure are described in terms of a virtual machine or a virtual host, the techniques described herein for such a virtual machine or a virtual host according to one or more aspects of the present disclosure may also be applied to containers, applications, processes, or other execution units (virtualized or non-virtualized) executed on the host device 210.

[0075] Virtual Router Agent 229 Figure 2In the example of , the virtual router agent 229 is included within the host device 210A and can communicate with the SDN controller 132 and the virtual router module 224 to control the overlay of the virtual network and coordinate the routing of data packets within the host device 210A. In general, the virtual router agent 229 communicates with the SDN controller 132, which generates commands to control the routing of packets through the data center 101. The virtual router agent 229 can be executed in user space and operate as a proxy for control plane messages between the virtual machine 228 and the SDN controller 132. For example, the virtual machine 228A can request to send a message using its virtual address via the virtual router agent 229, and the virtual router agent 229 can in turn send a message and request to receive a response to the message for the virtual address of the virtual machine 228A, which initiates the first message. In some cases, the virtual machine 228A can call a procedure or function call presented by the application programming interface of the virtual router agent 229, and in this example, the virtual router agent 229 also handles the encapsulation of the message, including addressing.

[0076] The network analysis system 240 can configure each of the backbone devices 202 and the leaf devices 203 to collect the underlying flow data 204. For example, in the example of Figure 2 In the described example, the collector module 252 of the network analysis system 240 causes the communication unit 215 to output one or more signals over the network 205. Each of the backbone devices 202 and the leaf devices 203 detects the signal and interprets the signal as a command to support the collection of the underlying flow data 204. For example, upon detecting a signal from the network analysis system 240, the backbone device 202A configures itself to collect sFlow data and transmits the sFlow data (as the underlying flow data 204) to the network analysis system 240 over the network 205. As another example, upon detecting a signal from the network analysis system 240, the leaf device 203A detects the signal and configures itself to collect sFlow data and transmits the sFlow data to the network analysis system 240 over the network 205. Further, in some examples, each host device 210 can detect a signal from the network analysis system 240 and interpret the signal as a command to support the collection of sFlow data. Therefore, in some examples, the sFlow data can be collected by the collector module executed on the host device 210.

[0077] Thus, in the described example, the backbone devices 202, the leaf devices 203 (and possibly one or more of the host devices 210) collect sFlow data. However, in other examples, one or more of such devices may collect other types of underlying flow data 204, such as IPFIX and / or NetFlow data. Collecting any such underlying flow data may involve collecting five-tuple data including source and destination IP addresses, source and destination port numbers, and the network protocol used.

[0078] The network analysis system 240 can configure each host device 210 to collect overlay flow data 206. For example, referring to Figure 2 In the depicted example, the collector module 252 causes the communication unit 215 to output one or more signals through the network 205. Each host device 210 detects the signal, which is interpreted as a command to collect the overlay flow data 206 and transmit the overlay flow data 206 to the network analysis system 240. For example, referring to the host device 210A, the communication unit 215 of the host device 210A detects the signal through the network 205 and outputs information about the signal to the hypervisor 221. The hypervisor 221 outputs the information to the agent module 226. The agent module 226 interprets the information from the hypervisor 221 as a command to collect the overlay flow data 206. The agent module 226 configures the virtual router module 224 to collect the overlay flow data 206 and transmit the overlay flow data 206 to the network analysis system 240.

[0079] In at least some examples, overlay flow data 206 includes five-tuple information about source and destination addresses, ports, and protocols. Additionally, overlay flow data 206 can include information about virtual networks associated with the flow, including a source virtual network and a destination virtual network. In some examples, particularly for networks configured using Contrail SDN available from Juniper Networks, Inc. of Sunnyvale, California, overlay flow data 206 can correspond to Contrail Flow data.

[0080] In the depicted example, agent module 226 configures virtual router module 224 to collect overlay flow data 206. However, in other examples, hypervisor 221 may configure virtual router module 224 to collect overlay flow data 206. Further, in other examples, overlay flow data 206 may be collected by another module (alternatively or additionally), such as agent module 226, or even by hypervisor 221 or kernel module 222. Thus, in some examples, host device 210 may collect both underlying flow data (sFlow data) and overlay flow data (e.g., Contrail Flow data).

[0081] The network analysis system 240 can receive both the underlying flow data 204 and the overlay flow data 206. For example, continuing with the example and referring to Figure 2 , backbone device 202A samples, detects, senses and / or collects underlying flow data 204. Backbone device 202A outputs a signal through network 205. Communication unit 215 of network analysis system 240 detects the signal from backbone device 202A and outputs information about the signal to collector module 252. Collector module 252 determines that the signal includes information about underlying flow data 204.

[0082] Similarly, the virtual router module 224 of the host device 210A samples, detects, senses, and / or collects the overlay flow data 206 at the host device 210A. The virtual router module 224 causes the communication unit 215 of the host device 210A to output a signal through the network 205. The communication unit 215 of the network analysis system 240 detects the signal from the host device 210A and outputs information about the signal to the collector module 252. The collector module 252 determines that the signal includes information about the overlay flow data 206.

[0083] The network analysis system 240 can process both the underlying flow data 204 and the overlay flow data 206 received from various devices within the network system 100. For example, still continuing with the same example, the collector module 252 processes signals received from the spine device 202A, the host device 210A, and other devices by distributing the signals across multiple collector modules 252. In some examples, each collector module 252 can be executed on a different physical server and can be independently and horizontally scaled to handle the expected capacity or peak capacity of traffic from the spine devices 202, the leaf devices 203, and the host devices 210. Each collector module 252 stores each instance of the underlying flow data 204 and the overlay flow data 206, and makes the stored data available for ingestion in the data repository 259. The collector modules 252 index the data and prepare the data for use by analytical queries.

[0084] Network analysis system 240 can store underlying flow data 204 and overlay flow data 206 in data repository 259. For example, Figure 2 , the collector module 252 outputs the information to the data repository 259. The data repository 259 determines that the information corresponds to the underlying stream data 204 and the overlay stream data 206. The data repository 259 stores the data in an indexed format, thereby supporting fast aggregate queries and fast random access data retrieval. In some examples, the data repository 145 can achieve fault tolerance and high availability by sharding and replicating data across multiple storage devices, which can be located between multiple physical hosts.

[0085] The network analysis system 240 can receive the query. For example, still continuing the same example and referring to Figure 2 , the user interface device 129 detects the input and outputs a signal derived from the input over the network 205. The communication unit 215 of the network analysis system 240 detects the signal and outputs information about the signal to the flow API 256. The flow API 256 determines that the signal corresponds to a query by a user of the user interface device 129 for information about the network system 200 within a given time window. For example, a user of the user interface device 129 (e.g., the administrator 128) may have noticed that a particular virtual machine within a particular virtual network appears to be dropping packets at an abnormal rate and may seek to resolve the problem. One way to resolve the problem is to identify which network devices (e.g., which underlying router) are on the data path that appears to be dropping packets. Therefore, the administrator 128 may seek to identify possible paths taken between the source virtual machine and the destination virtual machine by querying the network analysis system 240.

[0086] The network analysis system 240 can process the query. For example, continue again at Figure 2In the example described in the context of , the stream API 256 determines that the signal received from the user interface device 129 includes information about the source virtual network and / or the destination virtual network. The stream API 256 queries the data repository 259 by enriching the underlying stream data stored in the data repository 259 from the time window identified in the query to include virtual network data from the overlay stream data. To perform the query, the stream API 256 narrows the data to the specified time window, and for each relevant underlying stream data 204 record, the stream API 256 adds any source virtual network and / or destination virtual network information from the overlay stream data 206 record that has a value that matches the value of the corresponding underlying stream data 204 record. The stream API 256 identifies one or more network devices identified by the enriched underlying stream data. The stream API 256 determines one or more possible paths taken between the specified source virtual network and the destination virtual network based on the identified network devices. In some examples, global join techniques (e.g., as may be used in the ClickHouse database management system) may be used for augmentation. In this example, the stream API 256 collects the coverage stream data and broadcasts this data to all nodes. The data is then used as a lookup table independently for each node. To minimize the size of the table, the stream API 256 can perform predicate pushdown of the filter criteria to the subquery.

[0087] Network analysis system 240 may cause a user interface to be presented at user interface device 129 that illustrates possible paths between a source virtual network and a destination virtual network. Flow API 256 outputs information about the determined possible paths to user interface module 254. User interface module 254 uses the information from flow API 256 to generate data sufficient to create a user interface that presents information about possible paths between a source virtual network and a destination virtual network. User interface module 254 causes communication unit 215 to output a signal over network 205. User interface device 129 detects the signal over network 205 and determines that the signal includes information sufficient to generate a user interface. User interface device 129 generates a user interface (e.g., user interface 400) and presents it at a display associated with user interface device 129. In some examples, user interface 400 (also shown in FIG. 4 ) may be displayed on a display associated with user interface device 129. Figure 4 ) presents information illustrating one or more possible paths between virtual machines and may include information about how much data is or has been transferred between the virtual machines.

[0088] Figure 2The modules shown (e.g., virtual router module 224, proxy module 226, collector module 252, user interface module 254, flow API 256) and / or the modules illustrated or described elsewhere in this disclosure can perform operations described using software, hardware, firmware, or a mixture of hardware, software, and firmware that resides in and / or executes at one or more computing devices. For example, a computing device can execute one or more such modules with multiple processors or multiple devices. A computing device can execute one or more such modules as a virtual machine executed on basic hardware. One or more such modules can be executed as one or more services of an operating system or computing platform. One or more such modules can be executed as one or more executable programs at the application layer of a computing platform. In other examples, the functionality provided by the modules can be implemented by dedicated hardware devices.

[0089] Although can be illustrated respectively the specific module, data repository, component, program, executable file, data item, functional unit and / or other item that is included in one or more storage devices, one or more of such items can be combined and operated as a single module, component, program, executable file, data item or functional unit.For example, one or more modules or data repository can be combined or partially combined so that they operate as a single module or provide functionality.Further, one or more modules can interact and / or cooperate with each other so that, for example, a module serves as a service or extension of another module.And, each module, data repository, component, program, executable file, data item, functional unit or other item illustrated in the storage device can include multiple components, subcomponents, modules, submodules, data repository and / or other components or modules or data repository that are not illustrated.

[0090] Further, each module, data repository, component, program, executable file, data item, functional unit, or other item illustrated in the storage device may be implemented in various ways. For example, each module, data repository, component, program, executable file, data item, functional unit, or other item illustrated in the storage device may be implemented as a downloadable or pre-installed application or "app". In other examples, each module, data repository, component, program, executable file, data item, functional unit, or other item illustrated in the storage device may be implemented as part of an operating system executed on a computing device.

[0091] Figure 3 is a conceptual diagram illustrating example queries performed on stored underlay flow data and overlay flow data according to one or more aspects of the present disclosure. Figure 3 The diagram shows a data table 301, a query 302, and an output table 303. The data table 301 shows the data that can be stored in Figure 2 Query 302 represents a query that can be generated by stream API 256 in response to a request received by network analysis system 240 from user interface device 129. Output table 303 represents data generated from data table 301 in response to executing query 302.

[0092] exist Figure 3 In the example, and according to one or more aspects of the present disclosure, Figure 2 The network analysis system 240 can populate the data table 301. For example, referring to Figure 2 and Figure 3 In both, the network analysis system 240 collects both the underlying flow data 204 and the overlay flow data 206 from various devices within the network system 200. The collector module 252 of the network analysis system 240 stores the collected data in the data repository 259. Figure 3 In the example of , the data stored in the data repository 259 corresponds to the data table 301 .

[0093] The network analysis system 240 can perform the query after the data corresponding to the data table 301 is stored in the data repository 259. For example, still referring to Figure 2 and Figure 3 In the example of FIG. 3 , the communication unit 215 of the network analysis system 240 detects the signal corresponding to the flow API 256 and determines that the flow API 256 corresponds to the query 302. Figure 3 In the example, query 302 is the following SQL-like query:

[0094] SELECT networkDevice, bytes, srcVn WHERE timestamp in <7; 9>.

[0095] Flow API 256 applies query 302 to data table 301, selecting rows from data table 301 that identify network devices and have a timestamp greater than or equal to 7 and less than or equal to 9. Flow API 256 identifies only two network devices that meet this criteria: network device "a7" (row 3 from data table 301) and network device "a8" (row 5 of data table 301).

[0096] The network analysis system 240 can correlate the overlay data with the underlying data to identify which source virtual networks used the identified network device during the relevant time frame. Figure 3In the example of , the flow API 256 of the network analysis system 240 determines whether any of the coverage flow data rows in the same time frame (timestamps 7-9) have the same five-tuple data (i.e., source and destination addresses and port numbers and protocols) as rows 3 and 5. The flow API 256 determines that the coverage data from row 6 is within the specified time frame and has five-tuple data that matches the five-tuple data in row 3. Therefore, the flow API 256 determines that the source virtual network for device "a7" is source virtual network "e" (see the "srcvn" column of row 1 of the output table 303). Similarly, the flow API 256 determines that the coverage data from row 4 of the data table 301 is within the specified time frame and has five-tuple data that matches the five-tuple data in row 5 of the data table 301. Therefore, the flow API 256 determines that the source virtual network for device "a8" is source virtual network "c" (see row 2 of the output table 303).

[0097] If more than one instance (row) of overlay flow data is available, any or all of this data may be used to identify the source virtual network. This is based on the assumption that virtual network configurations do not change frequently. The enrichment process described herein may be used for queries that request "top N" network attributes. The enrichment process may also be used to identify paths, such as Figure 4 shown.

[0098] Figure 4 is a conceptual diagram illustrating an example user interface presented by a user interface device according to one or more aspects of the present disclosure. Figure 4 User interface 400 is illustrated. Although user interface 400 is shown as a graphical user interface, other types of interfaces may be presented in other examples, including a text-based user interface, a console or command-based user interface, a voice prompt user interface, or any other suitable user interface. Figure 4 The illustrated user interface 400 may correspond to a user interface generated by the user interface module 254 of the network analysis system 240 and displayed in FIG. Figure 2 The user interface 400 is presented at the user interface device 129. One or more aspects related to the generation and / or presentation of the user interface 400 may be presented at Figure 2 The context of is described herein.

[0099] According to one or more aspects of the present disclosure, the network analysis system 240 can perform a query to identify a path. Figure 2 In the depicted example, the user interface device 129 detects the input and outputs the signal via the network 205. The communication unit 215 of the network analysis system 240 detects the signal that the stream API 256 determines corresponds to a query for network information. The stream API 256 executes the query (e.g., in conjunction with Figure 324) and outputs information about the results to the user interface module 254. To find a path between two virtual machines, the flow API 256 can determine the most likely path (and the traffic traveling through the determined path). In addition, the flow API 256 can perform additional queries to evaluate the overlay data flows exclusively to identify traffic registered on the virtual router module 224, thereby enabling the identification and display of traffic between the relevant virtual machines and the host device. The flow API 256 can identify host-virtual machine and virtual machine-host paths in a similar manner.

[0100] Network analysis system 240 may generate a user interface for presentation at a display device, such as user interface 400. For example, still referring to Figure 2 and Figure 4 , the user interface module 254 generates the information underlying the user interface 400 and causes the communication unit 215 to output a signal through the network 205. The user interface device 129 detects the signal and determines that the signal includes information sufficient to present the user interface. Figure 4 The illustrated manner presents user interface 400 at a display device associated with user interface device 129 .

[0101] exist Figure 4 In FIG. 4 , user interface 400 is presented in display window 401. User interface 400 includes sidebar area 404, main display area 406, and options area 408. Sidebar area 404 provides an indication of which user interface mode is being presented in user interface 400, and Figure 4 In the example of , this mode corresponds to "Structure" mode. Other modes may be used for other network analysis scenarios as appropriate. Along the top of the main display area 406 is a navigation interface component 427, which may also be used to select the type or mode of network analysis to be performed. A status notification display element 428 may provide information about alerts or other status information related to one or more networks, users, elements, or resources.

[0102] The main display area 406 presents a network diagram and may provide a topology of the various network devices included within the network being analyzed. Figure 4 In the example shown, the network is illustrated as having network devices, edge network devices, hosts, and instances, as indicated by the “legend” shown along the bottom of the main display area 406. Actual or potential data paths between network devices and other components are illustrated within the main display area 406. Figure 4A limited number of different types of network devices and components are shown in the user interface 400, but in other examples, other types of devices or components or elements may be presented and / or specifically illustrated, including core switch devices, spine devices, leaf devices, physical or virtual routers, virtual machines, containers, and / or other devices, components or elements. Further, some data paths or components (e.g., instances) of the network may be hidden or minimized within the user interface 400 to facilitate the illustration and / or presentation of the components or data paths that are most relevant to a given network analysis.

[0103] An options area 408 provides a plurality of input fields related to the underlay network being analyzed (e.g., an underlay five-tuple input field) and a plurality of input fields related to the overlay network being analyzed (e.g., source and destination virtual network and IP address input fields) along the right-hand side of the user interface 400. The user interface 400 accepts input via user interaction with one or more of the displayed input fields, and based on the data entered into the input fields, the user interface module 254 presents responsive information about the network being analyzed.

[0104] For example, in Figure 4 In the example shown, the user interface 400 accepts input in the options area 408 regarding a particular time frame (e.g., a time range), source and destination virtual networks, and source and destination IP addresses. In the example shown, the underlying information in the user interface 400 has not yet been specified by user input. Using the input that has been provided in the options area 408, the network analysis system 240 determines information about one or more possible data paths (e.g., most likely data paths) that traverse the underlying network devices. The network analysis system 240 determines such possible data paths based on data collected by the network analysis system 240 (e.g., the collector module 252) during the time range specified in the options area 408. The user interface module 254 of the network analysis system 240 generates data that supports the presentation of the user interface 400, wherein one possible data path is highlighted (by drawing each segment of the data path with a thick line), such as Figure 4 In some examples, more than one data path from a source virtual network to a destination virtual network may be highlighted. Further, in some examples, one or more data paths in the main display area 406 may be presented using a heat map color scheme, meaning that the data paths are illustrated with a color (or gray shade) corresponding to the amount of data being communicated through the path or the degree to which the corresponding path is being used. Figure 4The data paths are illustrated using a heat map color (or grayscale shading) scheme, but in other examples, data regarding utilization or traffic on a data path or through a network device may be presented in other appropriate manners (e.g., applying color to other elements of the main display area 406, presenting a pop-up window, or presenting other user interface elements).

[0105] In some examples, options region 408 (or other regions of user interface 400) may include graphics or other indicators that provide information about utilization or traffic on one or more paths. In such examples, these graphics may be related to or may be generated in response to user input entered into an input field within options region 408.

[0106] Figure 5 is a flow chart illustrating operations performed by an example network analysis system according to one or more aspects of the present disclosure. Figure 2 The network analysis system 240 is described in the context of Figure 5 In other examples, Figure 5 The operations described may be performed by one or more other components, modules, systems, or devices. Figure 5 The operations described may be combined, performed in a different order, omitted, or may include additional operations not specifically illustrated or described.

[0107] exist Figure 5 In the process shown, and in accordance with one or more aspects of the present disclosure, the network analysis system 240 can collect underlying flow data (501) and overlay flow data (502). Figure 2 , each spine device 202 and each leaf device 203 outputs a corresponding signal (e.g., sFlow data) over network 205. Communication unit 215 of network analysis system 240 detects a signal that collector module 252 determines includes underlying flow data 204. Similarly, virtual router module 224 within each host device 210 outputs a signal over network 205. Communication unit 215 of network analysis system 240 detects an additional signal that collector module 252 determines includes overlay flow data 206. In some examples, collector module 252 can load balance the reception of signals across multiple collector modules 252 to ensure that a large number of signals can be processed without delay and / or without data loss.

[0108] Network analysis system 240 can store the underlying flow data and the overlay flow data (503). For example, collector module 252 can output information about the collected flow data (e.g., underlying flow data 204 and overlay flow data 206) to data repository 259. Data repository 259 stores the flow data in an indexed format and, in some examples, in a structure that supports fast aggregate queries and / or fast random access data retrieval.

[0109] Network analysis system 240 may receive a request for information about a data flow ("yes" path from 504). For example, user interface device 129 detects an input. In one such example, user interface device 129 outputs a signal over network 205. Communication unit 215 of network analysis system 240 detects a signal that flow API 256 determines corresponds to an information request from a user of user interface device 129. Alternatively, network analysis system 240 may continue to collect and store underlying flow data 204 and overlay flow data 206 until a request for information about a data flow is received ("no" path from 504).

[0110] The network analysis system 240 may perform a query (505) identifying information about a data flow. For example, when the network analysis system 240 receives a request for information, the flow API 256 parses the request and identifies information that can be used to perform the query. In some cases, the information may include source and destination virtual networks and / or associated time frames. In other examples, the information may include other information, such as underlying source or destination IP addresses or source or destination port numbers. The flow API 256 uses the information included in the request to query the data repository 259 for information about one or more related data flows. The data repository 259 processes the query and outputs the identities of one or more network devices used by traffic between the source virtual network and the destination virtual network to the flow API 256. In some examples, the identities of the network devices may enable the flow API 256 to determine one or more possible data paths traversed by traffic between the source virtual network and the destination virtual network.

[0111] To determine the identity of the network device used by traffic between the source virtual network and the destination virtual network, the flow API 256 may query the data repository 259 for underlying flow data for network devices having the same five-tuple data (i.e., source and destination addresses and port numbers and protocols) as the virtual network or virtual IP address specified in the query. Network devices identified in the underlying flow data that match the five-tuple data are identified as possible network devices used by traffic between the source virtual network and the destination virtual network. The network analysis system 240 may output information about the data flow (506). For example, again referring to Figure 2, the flow API 256 may output information about the data path determined by the flow API 256 to the user interface module 254 in response to the query. The user interface module 254 generates information sufficient to present a user interface including information about the data flow. The user interface module 254 causes the communication unit 215 to output a signal over the network 205, the signal including information sufficient to present the user interface. In some examples, the user interface device 129 receives the signal, parses the information, and presents a user interface illustrating the information about the data flow.

[0112] For the processes, devices and other examples or diagrams described herein, including in any flow chart, the specific operations, actions, steps or events included in any technology described herein can be performed in different orders, can be added, merged or completely ignored (for example, not all described actions or events are necessary for practicing these technologies). In addition, in specific examples, operations, actions, steps or events can be performed simultaneously rather than sequentially, for example, by means of multithreading, interrupt processing or multiple processors. Even if not specifically identified as automatically executed, other specific operations, actions, steps or events can also be automatically executed. Moreover, the specific operations, actions, steps or events described as automatically executed can alternatively not be automatically executed, but in some examples, such operations, actions, steps or events can be performed in response to input or another event.

[0113] For ease of explanation, only a limited number of devices (e.g., user interface device 129, backbone device 202, leaf device 203, host device 210, network analysis system 240, and other devices) are shown in the drawings and / or other illustrations referenced herein. However, more such systems, components, devices, modules, and / or other items may be used to perform techniques according to one or more aspects of the present disclosure, and collective references to such systems, components, devices, modules, and / or other items may represent any number of such systems, components, devices, modules, and / or other items.

[0114] The drawings included herein each illustrate at least one example implementation of aspects of the present disclosure. However, the scope of the present disclosure is not limited to such implementations. Therefore, other examples or alternative implementations of the systems, methods, or techniques described herein that exceed the systems, methods, or techniques illustrated in the drawings may be appropriate in other instances. Such implementations may include a subset of the devices and / or components included in the drawings and / or may include additional devices and / or components not shown in the drawings.

[0115] The detailed description set forth above is intended to be a description of various configurations and is not intended to represent the only configuration in which the concepts described herein can be practiced. The detailed description includes specific details for the purpose of providing a full understanding of the various concepts. However, these concepts can be practiced without these specific details. In some instances, in order to avoid blurring such concepts, well-known structures and components are shown in block diagram form in the accompanying drawings.

[0116] Thus, although one or more implementations of various systems, devices, and / or components may be described with reference to specific figures, such systems, devices, and / or components may be implemented in a variety of different ways. For example, in the figures herein (e.g., FIG. 1 and / or Figure 2 ) may alternatively be implemented as a single device; one or more components illustrated as separate components may alternatively be implemented as a single component. Moreover, in some examples, one or more devices illustrated as a single device in the figures herein may alternatively be implemented as multiple devices; one or more components illustrated as a single component may alternatively be implemented as multiple components. Each of such multiple devices and / or components may be directly coupled via wired or wireless communications and / or remotely coupled via one or more networks. Moreover, one or more devices or components that may be illustrated in various figures herein may alternatively be implemented as part of another device or component not shown in such figures. In this and other ways, some functions described herein may be performed via distributed processing of two or more devices or components.

[0117] Further, specific operations, techniques, features and / or functions may be described herein as being performed by specific components, devices and / or modules. In other examples, such operations, techniques, features and / or functions may be performed by different components, devices or modules. Therefore, some operations, techniques, features and / or functions that may be described herein as being attributed to one or more components, devices or modules may be attributed to other components, devices and / or modules in other examples, even if not specifically described in this manner herein.

[0118] Although specific advantages have been identified with respect to the description of some examples, various other examples may include some of the listed advantages, none of the listed advantages, or all of the listed advantages. From this disclosure, other advantages, technical or otherwise, may become apparent to one of ordinary skill in the art. Further, although specific examples have been disclosed herein, various aspects of the disclosure may be implemented using any number of technologies, whether currently known or not, and therefore, the disclosure is not limited to the examples specifically described and / or illustrated in this disclosure.

[0119] In one or more examples, the functions can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions can be stored on a computer-readable medium and / or transmitted via a computer-readable medium and executed by a hardware-based processing unit as one or more instructions or codes. A computer-readable medium may include a computer-readable storage medium corresponding to a tangible medium such as a data storage medium, or a communication medium including any medium that facilitates transferring a computer program from one place to another (e.g., according to a communication protocol). In this way, a computer-readable medium may generally correspond to (1) a non-transient tangible computer-readable storage medium or (2) a communication medium such as a signal or carrier wave. A data storage medium may be any available medium that can be accessed by one or more computers or one or more processors to retrieve instructions, codes, and / or data structures to implement the technology described in the present disclosure. A computer program product may include a computer-readable medium.

[0120] By way of example and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, disk storage devices or other magnetic storage devices, flash memory, or any other medium that can be used to store the desired program code in the form of instructions or data structures and that can be accessed by a computer. Moreover, any connection is appropriately referred to as a computer-readable medium. For example, if the instruction is transmitted from a website, server or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wireless technology (such as infrared, radio and microwave), then the coaxial cable, fiber optic cable, twisted pair, DSL or wireless technology (such as infrared, radio and microwave) is included in the definition of the medium. However, it should be understood that computer-readable storage media and data storage media do not include connections, carrier waves, signals or other transient media, but are dedicated to non-transient tangible storage media. Disks and optical disks such as those used include compact discs (CDs), laser optical disks, optical optical disks, digital versatile optical disks (DVDs), floppy disks and blue-ray discs, wherein disks usually copy data magnetically, and optical disks copy data optically with lasers. The combination of the above should also be included in the scope of computer-readable media.

[0121] Instructions may be executed by one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Therefore, the terms "processor" or "processing circuitry" as used herein may refer to any of the aforementioned structures or any other structure suitable for the implementation of the described techniques, respectively. In addition, in some examples, the functionality may be provided within dedicated hardware and / or software modules. Moreover, these techniques may be fully implemented in one or more circuits or logic elements.

[0122] The techniques of the present disclosure may be implemented in a variety of devices or apparatuses, including wireless handsets, mobile or non-mobile computing devices, wearable or non-wearable computing devices, integrated circuits (ICs), or a set of ICs (e.g., chipsets). Various components, modules, or units are described in the present disclosure to emphasize functional aspects of devices configured to perform the disclosed techniques, but do not necessarily need to be implemented by different hardware units. Instead, as described above, the various units may be combined in a hardware unit or provided by a collection of interoperable hardware units (including one or more processors as described above, in combination with appropriate software and / or firmware).

Claims

1. A method for processing data, comprising: collecting (501, 502) flow data for a network having a plurality of network devices and a plurality of virtual networks established within the network by a network analysis system (140), wherein the flow data comprises underlying flow data and overlay flow data, the underlying flow data comprising a plurality of underlying data flows, the overlay flow data comprising a plurality of overlay data flows, wherein the underlying flow data and the overlay flow data are collected during a same time period, wherein, for each underlying data flow included in the underlying flow data, the underlying flow data identifies the network device that has processed the network packet associated with the underlying data flow, the network device including one or more intermediate network devices between a source and a destination of the underlying data flow, and wherein for each overlay data flow included in the overlay flow data, the overlay flow data identifies one or more virtual networks of the virtual networks associated with the overlay data flow; The network analysis system stores (503) the flow data in a data repository; receiving, by the network analysis system, an information request regarding a data flow (504), wherein the information request specifies a source virtual address for the data flow and also specifies a destination virtual address for the data flow, the source virtual address identifying a source virtual network and the destination virtual address identifying a destination virtual network; as well as The data repository is queried (505) by the network analysis system using the specified source virtual address and the specified destination virtual address to identify one or more network devices among the plurality of network devices that have processed at least one packet in the data flow and one or more possible underlying data paths from the source virtual network to the destination virtual network taken by the at least one packet in the data flow based on a correlation between the underlying flow data and the overlay flow data.

2. The method according to claim 1, further comprising: Data sufficient to create a user interface is generated by the network analysis system, the user interface illustrating the one or more possible underlying data paths from the source virtual network to the destination virtual network.

3. The method of claim 2, wherein generating data sufficient to create a user interface comprises: Visual information indicative of a traffic level associated with each of the one or more possible underlying data paths is generated.

4. The method of claim 3, wherein generating visual information comprises: A heat map is generated that illustrates the traffic levels associated with each of the one or more possible underlying data paths.

5. The method of any one of claims 1 to 4, wherein the information request about a data flow further includes a time frame, and wherein querying the data repository comprises: Also based on the time frame, the one or more network devices that have processed at least one packet in the data flow during the time frame are identified.

6. The method of any one of claims 1 to 4, wherein querying the data repository comprises: evaluating the overlay flow data to identify traffic registered by the virtual router; as well as Traffic between one or more virtual machines and one or more network devices of the plurality of network devices is identified based on the traffic registered by the virtual router.

7. The method of claim 5, wherein the underlying flow data comprises a plurality of underlying flow records, and wherein querying the data repository comprises: correlating overlay flow data with the underlying flow record during the time frame; as well as Overlay flow data associated with each respective underlying flow record is added to at least some of the underlying flow records.

8. The method of claim 7, wherein adding overlay stream data comprises: adding source virtual network data from the overlay flow data collected during the time frame to at least some of the underlying flow records, and Destination virtual network data from the overlay flow data collected during the time frame is added to at least some of the underlying flow records.

9. The method of any one of claims 1 to 4, wherein querying the data repository comprises: An identity of a network device having five-tuple data matching the source virtual address or the destination virtual address is determined.

10. The method of any one of claims 1 to 4, wherein collecting flow data is performed by the network analysis system, wherein the plurality of network devices include a plurality of host devices, each host device executing a plurality of virtual computing instances, and wherein collecting flow data comprises: configuring each of the network devices to transmit the underlying flow data to the network analysis system over the network; as well as Each of the host devices is configured to transmit the overlay flow data to the network analysis system over the network.

11. The method of claim 10, wherein configuring each of the host devices to transmit the overlay stream data comprises: A virtual router executed on each of the host devices is configured to transmit the overlay flow data.

12. The method of claim 10, wherein the network analysis system comprises a plurality of flow collector instances, and wherein collecting the flow data comprises: The collection of the flow data is load balanced by distributing the flow data across the plurality of flow collector instances.

13. A network analysis system (140) comprising a processing circuit, the processing circuit being configured to perform operations comprising: collecting (501, 502) flow data for a network having a plurality of network devices and a plurality of virtual networks established within the network, wherein the flow data comprises underlying flow data and overlay flow data, the underlying flow data comprising a plurality of underlying data flows, the overlay flow data comprising a plurality of overlay data flows, wherein the underlying flow data and the overlay flow data are collected during a same time period, wherein, for each underlying data flow included in the underlying flow data, the underlying flow data identifies the network device that has processed the network packet associated with the underlying data flow, the network device including one or more intermediate network devices between a source and a destination of the underlying data flow, and wherein for each overlay data flow included in the overlay flow data, the overlay flow data identifies one or more virtual networks of the virtual networks associated with the overlay data flow; Storing (503) the stream data in a data repository; receiving an information request (504) regarding a data flow, wherein the information request specifies a source virtual address for the data flow and also specifies a destination virtual address for the data flow, the source virtual address identifying a source virtual network and the destination virtual address identifying a destination virtual network; as well as The data repository is queried (505) using the specified source virtual address and the specified destination virtual address to identify one or more network devices among the plurality of network devices that have processed at least one packet in the data flow and one or more possible underlying data paths from the source virtual network to the destination virtual network taken by the at least one packet in the data flow based on a correlation between the overlay flow data and the underlying flow data.

14. The system of claim 13, wherein the processing circuit is further configured to perform operations comprising: Data sufficient to create a user interface illustrating the one or more possible underlying data paths from the source virtual network to the destination virtual network is generated.

15. The system of claim 14, wherein generating data sufficient to create the user interface comprises: Visual information indicative of a traffic level associated with each of the one or more possible underlying data paths is generated.

16. The system of claim 15, wherein generating visual information comprises: A heat map is generated that illustrates the traffic levels associated with each of the one or more possible underlying data paths.

17. The system of any one of claims 13 to 16, wherein the request for information about a data stream further comprises a time frame, and wherein querying the data repository comprises: Also based on the time frame, the one or more network devices that have processed at least one packet in the data flow during the time frame are identified.

18. A non-transitory computer-readable storage medium comprising instructions that, when executed, configure processing circuitry of a computing system to perform operations comprising: collecting (501, 502) flow data for a network having a plurality of network devices and a plurality of virtual networks established within the network, wherein the flow data comprises underlying flow data and overlay flow data, the underlying flow data comprising a plurality of underlying data flows, the overlay flow data comprising a plurality of overlay data flows, wherein the underlying flow data and the overlay flow data are collected during a same time period, wherein, for each underlying data flow included in the underlying flow data, the underlying flow data identifies the network device that has processed the network packet associated with the underlying data flow, the network device including one or more intermediate network devices between a source and a destination of the underlying data flow, and wherein for each overlay data flow included in the overlay flow data, the overlay flow data identifies one or more virtual networks of the virtual networks associated with the overlay data flow; Storing (503) the stream data in a data repository; receiving an information request (504) regarding a data flow, wherein the information request specifies a source virtual address for the data flow and also specifies a destination virtual address for the data flow, the source virtual address identifying a source virtual network and the destination virtual address identifying a destination virtual network; as well as The data repository is queried (505) using the specified source virtual address and the specified destination virtual address to identify one or more network devices among the plurality of network devices that have processed at least one packet in the data flow and one or more possible underlying data paths from the source virtual network to the destination virtual network taken by the at least one packet in the data flow based on a correlation between the overlay flow data and the underlying flow data.

Images