Method and system for computer network and storage medium

Abstract

The present disclosure relates to methods and systems for computer networks and storage media. The present disclosure describes techniques including collecting flow data associated with communications between network devices and determining one or more virtual networks through which communications are being conducted based on the flow data. In one example, the present disclosure describes a system configured to perform operations including storing virtual network configuration information associated with a first virtual network and a second virtual network established within a network; collecting underlay flow data associated with communications between a first server and a second server, wherein each of the first server and the second server is implemented as a bare metal server; determining, based on the underlay flow data and the stored virtual network configuration information, that the first server and the second server have communicated over the first virtual network; and generating a user interface.

Description

[0001] This application is a divisional application of application number 202010998048.1 filed on September 21, 2020, entitled "Method and System for Computer Networks and Storage Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This disclosure relates to the analysis of computer networks, including the paths taken by data through network analysis. Background Technology

[0003] Virtualized data centers are becoming a core foundation of modern information technology (IT) infrastructure. Specifically, modern data centers widely utilize virtualization environments, in which virtual hosts (such as virtual machines or containers) are deployed and run on the underlying computing platform of physical computing devices.

[0004] Virtualization within large-scale data centers offers several advantages, including efficient utilization of computing resources and simplified network configuration. Therefore, in addition to the efficiency and higher return on investment (ROI) provided by virtualization, enterprise IT personnel often prefer virtualized computing clusters in data centers due to their management advantages. However, networks containing both virtualized and non-virtualized devices can present challenges for the analysis, evaluation, and / or troubleshooting of network operations. Summary of the Invention

[0005] This disclosure describes techniques including collecting information about physical network infrastructure (e.g., underlying streaming data) and network virtualization (e.g., overlay streaming data), and relating the data to understand network operation and performance. In some examples, samples of underlying streaming data collected from bare metal devices (e.g., bare metal host devices or servers) are analyzed to determine one or more virtual networks through which such bare metal devices are communicating. In some examples, such analysis may involve using configuration information associated with the virtual networks to determine from the underlying streaming data the names of virtual networks associated with or having communicated with one or more bare metal servers.

[0006] The techniques described herein can provide one or more technical advantages. For example, by analyzing streaming data, for a given data stream, it is possible to determine which tenant in a multi-tenant data center the data stream belongs to. Furthermore, for such streams, it is possible to determine which network devices (including bare metal servers) are source and / or destination devices. As described herein, the techniques according to one or more aspects of this disclosure enable the identification of virtual networks through which bare metal devices (e.g., host devices or servers) have communicated. In some examples, such identification can be determined with little or no overlay streaming data. Furthermore, techniques are described to enrich underlying streaming data using information about overlay data or virtual networks, thereby facilitating analysis that may involve bare metal servers included within the network. By providing information about how the underlying network infrastructure relates to various overlay data streams, useful tools for exploration and investigation can be created. In some examples, such tools can be used for efficient and streamlined fault finding and analysis of networks.

[0007] In some examples, this disclosure describes operations performed by a network analysis system or other network system according to one or more aspects of this disclosure. In one particular example, this disclosure describes a method comprising: storing virtual network configuration information associated with a first virtual network and a second virtual network established within the network by a network analysis system operating within the network, wherein the virtual network configuration information includes a name associated with the first virtual network; collecting underlying flow data associated with communication between a first server and a second server by the network analysis system, wherein each of the first server and the second server is implemented as a bare metal server; determining, based on the underlying flow data and the stored virtual network configuration information, that the first server and the second server have communicated through the first virtual network by the network analysis system; and generating a user interface by the network analysis system including information indicating that the first server and the second server are part of the first virtual network, wherein the user interface identifies the first virtual network using a name associated with the first virtual network.

[0008] In another example, this disclosure describes a system including processing circuitry configured to perform the operations described herein. In yet another example, this disclosure describes a non-transitory computer-readable storage medium including instructions that, when executed, configure the processing circuitry of a computing system to perform the operations described herein. Attached Figure Description

[0009] Figure 1A This is a conceptual diagram illustrating an exemplary network including a system for analyzing business flows on a network and / or within a data center, according to one or more aspects of this disclosure.

[0010] Figure 1BThis is a conceptual diagram illustrating exemplary components of a system for analyzing business flows on a network and / or within a data center, according to one or more aspects of this disclosure.

[0011] Figure 2 This is a block diagram illustrating an exemplary network for analyzing service flows on a network and / or within a data center, according to one or more aspects of this disclosure.

[0012] Figure 3A This is a conceptual diagram illustrating an exemplary virtual network data structure associated with a virtual network maintained by a configuration database, according to one or more aspects of this disclosure.

[0013] Figure 3B This is a conceptual diagram illustrating an exemplary instance of sFlow data according to one or more aspects of this disclosure.

[0014] Figure 4 This is a conceptual diagram illustrating an exemplary user interface presented by a user interface device according to one or more aspects of this disclosure.

[0015] Figure 5 This is a flowchart illustrating the operations performed by an exemplary network analysis system according to one or more aspects of this disclosure. Detailed Implementation

[0016] Data centers utilizing virtualized environments offer efficiency, cost, and organizational advantages, where virtual machines, such as virtual machines or containers, are deployed and run on the underlying computing platform of physical computing devices. However, gaining meaningful insights into application workloads remains crucial in managing any data center architecture. Collecting business samples from network devices can help provide such insights. In the various examples described in this paper, business samples are collected and then processed by analytics algorithms, enabling the correlation of information covering business activities with the underlying infrastructure. In some cases, collecting sufficient data from network devices can be challenging, especially when such devices are implemented as bare-metal devices or bare-metal compute nodes or servers. Techniques for achieving adequate data collection in such situations are described in this paper. Furthermore, in some examples, user interfaces can be generated to visualize the collected data and how the underlying infrastructure relates to various overlay networks. Presenting such data in the user interface provides insights into the network and provides users, administrators, and / or other personnel with tools for network exploration, investigation, and troubleshooting.

[0017] Figure 1A This is a conceptual diagram illustrating an exemplary network including a system for analyzing business flows on a network and / or within a data center, according to one or more aspects of this disclosure. Figure 1AAn example implementation of network system 100 and data center 101 is illustrated, which host one or more computing networks, computing domains or projects and / or cloud-based computing networks, generally referred to herein as cloud computing clusters. The cloud-based computing clusters may reside in a common monolithic computing environment (e.g., a single data center) or be distributed across various environments (e.g., different data centers). The cloud-based computing clusters can be, for example, different cloud environments, such as OpenStack cloud environments, Kubernetes cloud environments, or various combinations of other computing clusters, domains, networks, etc. Other implementations of network system 100 and data center 101 may be suitable in other situations. Such implementations may include... Figure 1A The examples include a subset of the components and / or may include Figure 1A Additional components not shown in the example.

[0018] exist Figure 1A In the example, data center 101 provides an operational environment for applications and services to customer 104 coupled to data center 101 via service provider network 106. Although combined Figure 1A The functions and operations described in the network system 100 can be shown as distributed across Figure 1A On multiple devices, but in other examples, it belongs to Figure 1A The features and techniques of one or more devices can be implemented internally by native components of one or more such devices. Similarly, one or more such devices may include certain components and be capable of implementing various techniques, which may otherwise be attributed to one or more other devices in the description herein. Furthermore, they can be combined with... Figure 1A This describes certain operations, techniques, features, and / or functions, or otherwise describes operations, techniques, features, and / or functions performed by a particular component, device, and / or module. In other examples, such operations, techniques, features, and / or functions may be performed by other components, devices, or modules. Thus, some operations, techniques, features, and / or functions belonging to one or more components, devices, or modules may be belonging to other components, devices, and / or modules, even if not specifically described in this way herein.

[0019] Data center 101 hosts infrastructure units such as networking and storage systems, redundant power supplies, and environmental controls. Service provider network 106 can be coupled to one or more networks managed by other providers and can therefore form part of a large-scale public network infrastructure (e.g., the Internet).

[0020] In some examples, data center 101 may represent one of many geographically distributed network data centers. For example... Figure 1AAs shown in the example, data center 101 is a facility that provides network services to client 104. Client 104 can be a collective entity, such as a business, government, or individual. For example, a network data center may host network services for multiple businesses and end users. Other exemplary services may include data storage, virtual private networks, traffic engineering, file services, data mining, scientific or supercomputing, etc. In some examples, data center 101 is a single web server, network peer, etc.

[0021] exist Figure 1A In the example, data center 101 includes a group of storage systems, application servers, compute nodes, or other devices, including network devices 110A to 110N (collectively referred to as "network devices 110," meaning any number of network devices). Devices 110 may be interconnected via a high-speed switching structure 121 provided by one or more physical network switches and routers. In some examples, devices 110 may be included in structure 121, but are shown separately for ease of illustration.

[0022] Network device 110 can be any of a variety of different types of network devices (core switch, backbone network device, leaf network device, edge network device, or other network devices), but in some examples, one or more devices 110 can be used as physical computing nodes in a data center. For example, one or more devices 110 can be bare-metal servers (i.e., non-virtualized servers) that provide an operating environment for executing one or more client-specific applications or services. Alternatively or additionally, one or more devices 110 can provide an operating environment for one or more virtual machines or other virtualization instances (such as containers). In some examples, one or more devices 110 may also be alternatively referred to as host computing devices, or more simply as hosts. Thus, network device 110 can execute one or more virtualization instances, such as virtual machines, containers, or other virtual execution environments for running one or more services (such as virtualized network functions (VNFs)).

[0023] Typically, each network device 110 can be any type of device capable of operating on a network and can generate data accessible by telemetry or other means (e.g., streaming data or sFlow data). Network device 110 may include any type of computing device, sensor, camera, node, monitoring device, or other device. Furthermore, some or all of network devices 110 may represent components of another device that generate data accessible by telemetry or other means. For example, some or all of network devices 110 may represent physical or virtual network devices such as switches, routers, hubs, gateways, and security devices (such as firewalls, intrusion detection and / or intrusion prevention devices).

[0024] Although not specifically shown, switching fabric 121 may include top-of-rack (TOR) switches of the distribution layer coupled to chassis switches, and data center 101 may include one or more non-edge switches, routers, hubs, gateways, security devices (such as firewalls, intrusion detection and / or intrusion prevention devices), servers, computer terminals, laptops, printers, databases, wireless mobile devices (such as cellular phones or personal digital assistants), wireless access points, bridges, cable modems, application accelerators, or other network devices. Switching fabric 121 may perform Layer 3 routing to route network traffic between data center 101 and customer 104 via service provider network 106. Gateway 108 is used to forward and receive packets between switching fabric 121 and service provider network 106.

[0025] According to one or more examples of this disclosure, a software-defined networking (“SDN”) controller 132 provides a logically and, in some cases, physically centralized controller for facilitating the operation of one or more virtual networks within a data center 101. In some examples, the SDN controller 132 operates in response to configuration input received from an orchestration engine 130 via a northbound application programming interface (API) 131, which in turn may operate in response to configuration input received from an administrator 128 who interacts with and / or operates the user interface device 129.

[0026] User interface device 129 can be implemented as any suitable device for presenting output and / or accepting user input. For example, user interface device 129 may include a display. User interface device 129 may be a computing system, such as a mobile or non-mobile computing device operated by a user and / or an administrator 128. According to one or more aspects of this disclosure, user interface device 129 may, for example, represent a workstation, laptop or notebook computer, desktop computer, tablet computer, or any other computing device that can be operated by a user and / or present a user interface. In some examples, user interface device 129 may be physically separate from the controller and / or located in a different location from the controller. In such examples, user interface device 129 may communicate with the controller via a network or other communication means. In other examples, user interface device 129 may be a local peripheral device of the controller or may be integrated into the controller.

[0027] In some examples, orchestration engine 130 manages the functionality of data center 101, such as compute, storage, networking, and application resources. For instance, orchestration engine 130 can create virtual networks for tenants within or on data center 101. Orchestration engine 130 can connect virtual machines (VMs) to tenants' virtual networks. Orchestration engine 130 can connect tenants' virtual networks to external networks, such as the Internet or a VPN. Orchestration engine 130 can implement security policies between a group of VMs or at the boundary of a tenant's network. Orchestration engine 130 can deploy network services (e.g., load balancers) within tenants' virtual networks.

[0028] In some examples, SDN controller 132 manages network and networking services (e.g., load balancing and security) and can allocate resources from device 110, which acts as a host device, to various applications via southbound API 133. That is, southbound API 133 represents a set of communication protocols used by SDN controller 132 to ensure that the actual state of the network equals the desired state specified by orchestration engine 130. For example, SDN controller 132 can fulfill high-level requests from orchestration engine 130 by configuring physical switches (e.g., TOR switches, chassis switches, and switching fabric 121); physical routers; physical service nodes (such as firewalls and load balancers); and virtual services (such as virtual firewalls in VMs). SDN controller 132 maintains routing, networking, and configuration information within a state database.

[0029] Network analysis system 140 interacts with or receives data from one or more devices 110 (and / or other devices) to collect streaming data on data center 101 and / or network system 100. This streaming data may include underlying streaming data and overlay streaming data. In some examples, underlying streaming data may be collected from samples of streaming data collected at Layer 2 of the OSI model. Overlay streaming data may be data (e.g., data samples) derived from overlay traffic on one or more virtual networks established within network system 100. Overlay streaming data may, for example, include information identifying the source virtual network and the destination virtual network.

[0030] According to one or more aspects of this disclosure, Figure 1A The network analysis system 140 can be configured to collect streaming data for each device 110. For example, in a reference... Figure 1AIn the described example, network analysis system 140 outputs a signal to each device 110. Each device 110 receives the signal and interprets it as a command to collect streaming data (including underlying streaming data and / or overlay streaming data). Subsequently, as data packets are processed by each device 110, each device 110 transmits the underlying streaming data and / or overlay streaming data to network analysis system 140. Network analysis system 140 receives the streaming data, prepares it for use in response to analysis queries, and stores the streaming data. Figure 1A In the example, other network devices, including network devices within switching structure 121 (not specifically shown), may also be configured to collect underlying streaming data and / or overlay streaming data.

[0031] In some examples, one or more devices 110 may be or can operate as a bare metal server (e.g., a non-virtualized host compute node). In such examples, the bare metal server device 110 may collect underlying flow data (e.g., "sFlow" data), but may collect little or no overlay flow data. In some examples, the compute node or host acting as a bare metal server may not have one or more software components (e.g., a virtual router) necessary for collecting overlay flow data. In such examples, the bare metal server device may collect underlying flow data but not overlay flow data.

[0032] Network analysis system 140 can process queries. For example, in the described example, user interface device 129 detects input and outputs information about the input to network analysis system 140. Network analysis system 140 determines that the information corresponds to a request from user interface device 129 for information about network system 100. Network analysis system 140 processes the request by querying stored streaming data. Network analysis system 140 generates a response to the query based on the stored streaming data and outputs information about the response to user interface device 129.

[0033] In some examples, a request received from user interface device 129 may include source and / or destination virtual networks. In such an example, network analysis system 140 may respond to such a request to identify one or more possible data paths on underlying network devices that may have been used by packets traveling from the source virtual network to the destination virtual network. To identify possible data paths, network analysis system 140 may correlate collected overlay flow data with collected underlying flow data, thereby identifying the underlying network devices used by the overlay data flow.

[0034] Figure 1B This is a conceptual diagram illustrating exemplary components of a system for analyzing business flows on a network and / or within a data center, according to one or more aspects of this disclosure. Figure 1B Including combination Figure 1A Many of the same elements described. Figure 1B The elements shown can correspond to Figure 1A The components shown are made of Figure 1A Reference marks with the same designation are used to identify elements with the same designation. Typically, these numbered elements are combined with... Figure 1A The provided components are implemented in a consistent manner, but in some examples, such components may involve implementations with more, fewer, and / or different capabilities and properties.

[0035] However, with Figure 1A different, Figure 1B Components of a network analysis system 140 are shown. The network analysis system 140 is shown as including a load balancer 141, a flow collector 142, a queue and event store 143, a topology and metric source 144, a data store 145, and a flow API 146. Typically, the network analysis system 140 and its components are designed and / or configured to ensure high availability and the ability to handle large volumes of streaming data. In some examples, multiple instances of the components of the network analysis system 140 may be orchestrated (e.g., via orchestration engine 130) to run on different physical servers to ensure that no single point of failure exists for any component of the network analysis system 140. In some examples, the network analysis system 140 or its components may be scaled independently and horizontally to achieve efficient and / or effective processing of desired traffic volumes (e.g., streaming data).

[0036] like Figure 1A As shown, Figure 1B The network analysis system 140 can configure each device 110 to collect streaming data. For example, the network analysis system 140 can output a signal to each device 110 to configure each device 110 to collect streaming data including underlying streaming data and overlay streaming data. Then, one or more devices 110 can collect the underlying streaming data and / or overlay streaming data and report such streaming data to the network analysis system 140.

[0037] exist Figure 1B In this process, the load balancer 141 of the network analysis system 140 receives streaming data from each device 110. For example, in Figure 1B In this configuration, load balancer 141 can receive streaming data from each of the devices 110. Load balancer 141 can distribute traffic across multiple stream collectors to ensure the stream collectors' active / active failover strategy. In some examples, multiple load balancers 141 may be required to ensure high availability and scalability.

[0038] Flow collector 142 collects data from load balancer 141. For example, flow collector 142 of network analysis system 140 receives and processes flow packets from each device 110 (after processing by load balancer 141). Flow collector 142 sends flow packets upstream to queue and event store 143. In some examples, flow collector 142 can address, process, and / or accommodate uniform data in sFlow, NetFlow v9, IPFIX, jFlow, trace flow, and other formats. Flow collector 142 may be able to parse internal headers in sFlow packets and other data flow packets. Flow collector 142 may be able to handle message overflows and rich flow records using topology information (e.g., AppFormix topology information). Flow collector 142 is also able to convert data into binary format before writing or sending data to queue and event store 143. The underlying flow data of the “sFlow” type (referring to “sampled flow”) is a standard for packet derivation at Layer 2 of the OSI model. It provides means for deriving truncated packets and interface counters for network monitoring.

[0039] The queue and event store 143 processes the collected data. For example, the queue and event store 143 may receive data from one or more stream collectors 142, store the data, and make the data available for ingestion by the data store 145. In some examples, this allows separating the task of receiving and storing large amounts of data from the task of indexing the data and preparing it for analytical queries. In some examples, the queue and event store 143 may also enable independent users to directly consume streams of stream records. In some examples, the queue and event store 143 may be used to detect anomalies and generate alerts in near real-time or apparent real-time. In some examples, stream data can be parsed by reading encapsulated packets containing MPLS over VXLAN, UDP, and MPLS over GRE. The queue and event store 143 parses the source IP, destination IP, source port, destination port, and protocol from the internal (lower-level) packets. Some types of stream data (including sFlow data) include only a portion of the sampled network traffic (e.g., the first 128 bytes); therefore, in some cases, stream data may not include all internal fields. In such examples, such data may be marked as missing.

[0040] Topology and metric source 144 can enrich or enhance data with topology information and / or metric information. For example, topology and metric source 144 can provide network topology metadata, which may include identified nodes or network devices, configuration information, configurations, established links, and other information about such nodes and / or network devices. In some examples, topology and metric source 144 may use AppFormix topology data or may be an executed AppFormix module. Information received from topology and metric source 144 can be used to enrich the stream data collected by stream collector 142 and support the stream API 146 in processing queries from data store 145.

[0041] Data storage 145 can be configured to store data received from queues and event storage 143, as well as topology and metric sources 144, in an indexed format, enabling fast aggregation queries and fast random access data retrieval. In some examples, data storage 145 can achieve fault tolerance and high availability by sharding and replicating data.

[0042] Flow API 146 can process query requests sent by one or more user interface devices 129. For example, in some examples, Flow API 146 may receive query requests from user interface device 129 via an HTTP POST request. In such an example, Flow API 146 translates the information contained in the request into a query for data storage 145. To create the query, Flow API 146 may use topology information from topology and metric source 144. Flow API 146 may perform analysis on behalf of user interface device 129 using one or more such queries. This analysis may include traffic deduplication, overlay-underlying correlation, traffic path identification, and / or heatmap traffic calculation. Specifically, this analysis may involve correlating underlying flow data with overlay flow data to identify which underlying network devices are associated with traffic flowing on a virtual network and / or between two virtual machines.

[0043] Using techniques according to one or more aspects of this disclosure, such as correlated underlying stream data with overlay stream data, network analysis system 140 can determine which tenant in a multi-tenant data center a given data stream belongs to. Furthermore, network analysis system 140 can also determine which virtual computing instances (e.g., virtual machines or containers) are the source and / or destination virtual computing instances of such a stream. As described herein, techniques according to one or more aspects of this disclosure enable the identification of virtual networks through which bare metal devices (e.g., host devices or servers) have communicated. Advantageously, this identification can be determined with little or no overlay stream data. Furthermore, techniques are described for enriching underlying stream data with information about overlay data or virtual networks, thereby facilitating analysis that may involve bare metal servers included within the network.

[0044] Figure 2 This is a block diagram illustrating an exemplary network for analyzing service flows on a network and / or within a data center, according to one or more aspects of this disclosure. Figure 2 The network system 200 can be described as Figure 1A or Figure 1B An example or alternative implementation of the network system 100. Figure 2 One or more aspects can be Figure 1A and Figure 1B This is described in the context of the paper.

[0045] Despite data centers (such as, Figure 1A , Figure 1B and Figure 2 The data center shown can be operated by any entity, but some data centers are operated by service providers whose business models may involve providing computing power to customers or clients. For this purpose, a data center typically contains a large number of compute nodes or host devices. To operate efficiently, these hosts must be interconnected and connected to the outside world, and this capability is provided through physical network devices, which can be leaf-backbone interconnects. The collection of these physical devices (such as network devices and hosts) forms the underlying network.

[0046] In such a data center, each host device typically has multiple virtual machines running on it, known as workloads. Clients in the data center typically access these workloads and can install applications and use them to perform other operations. Workloads running on different host devices but accessible to a specific client are organized into virtual networks. Each client typically has at least one virtual network. These virtual networks are also known as overlay networks. In some cases, clients in the data center may experience connectivity issues between two applications running on different workloads. Troubleshooting such problems is often complex due to the deployment of workloads in large, multi-tenant data centers. Furthermore, performing analysis on specific virtual networks or specific clients or tenants tends to be more complicated due to the deployment of workloads in large, multi-tenant data centers.

[0047] exist Figure 2 In the example, network 205 connects network analysis system 240, host device 210A, host device 210B, and host device 210N. Network analysis system 240 can correspond to... Figure 1A and Figure 1B Examples or alternative implementations of the network analysis system 140 shown. Host devices 210A, 210B to 210N may be collectively referred to as "host device 210", representing any number of host devices 210.

[0048] Each host device 210 may be Figure 1A and Figure 1B An example of device 110, but in Figure 2 In the example, in contrast to network devices, each host device 210 is implemented as a server or host device operating as a physical or virtual computing node in a virtualized data center. As further described herein, one or more host devices 210 (e.g., Figure 2 Host device 210A can execute multiple virtual computing instances (such as virtual machines 228), and furthermore, one or more host devices 210 (e.g., one or more of host devices 210B to 210N) can execute application or service modules on non-virtualized, single-tenant, and / or bare metal servers. Therefore, as in Figure 1A and Figure 1B middle, Figure 2 The example illustrates a network system that includes a hybrid of virtualized server devices and bare metal server devices.

[0049] As in Figure 1A and Figure 1BIn this network, a user interface device 129, which can be operated by an administrator 128, is also connected to the network 205. In some examples, the user interface device 129 may present one or more user interfaces on a display device associated with the user interface device 129, some of which may have a form similar to user interface 400.

[0050] Figure 2 The diagram also illustrates underlying flow data 204 and overlay flow data 206 flowing within network system 200. Specifically, underlying flow data 204 is shown leaving backbone device 202A and flowing to network analysis system 240. Similarly, overlay flow data 206 is shown leaving host device 210A and flowing through network 205. In some examples, overlay flow data 206 is transmitted via network 205 to network analysis system 240 as described herein. For simplicity, Figure 2 A single instance of underlying flow data 204 and a single instance of overlay flow data 206 are shown. However, it should be understood that each of the backbone device 202 and leaf device 203 can generate underlying flow data 204 and transmit it to the network analysis system 240, and in some examples, each of the host devices 210 (and / or other devices) can generate underlying flow data 204 and transmit such data to the network analysis system 240 via network 205. Furthermore, it should be understood that one or more of the host devices 210 (and / or other devices) can generate overlay flow data 206 and transmit such data to the network analysis system 240 via network 205. However, in some examples, one or more host devices 210 may be implemented as bare-metal servers or single-tenant servers that do not generate overlay flow data 206. Figure 2 In the example, host device 210B and host device 210N can be implemented as bare metal servers.

[0051] Network 205 can correspond to Figure 1A and Figure 1B The network 205 may correspond to either the switching structure 121 and / or the service provider network 106, or alternatively, a combination of the switching structure 121, the service provider network 106, and / or another network. The network 205 may also include... Figure 1A and Figure 1B Some components include gateway 108, SDN controller 132, and orchestration engine 130.

[0052] Within network 205 are shown backbone devices 202A and 202B (collectively referred to as "backbone devices 202" and any number of backbone devices 202) and leaf devices 203A, 203B, and 203C (collectively referred to as "leaf devices 203" and any number of leaf devices 203). Although network 205 is shown as having backbone devices 202 and leaf devices 203, other types of network devices may be included in network 205, including core switches, edge network devices, top-of-rack devices, and other network devices.

[0053] Typically, network 205 can be the Internet, or it can include or represent any public or private communications network or other network. For example, network 205 can be cellular, ZigBee, Bluetooth, Near Field Communication (NFC), satellite, enterprise, service provider, and / or other types of networks capable of transmitting data between computing systems, servers, and computing devices. One or more client devices, server devices, or other devices may use any suitable communication technology to send and receive data, commands, control signals, and / or other information on network 205. Network 205 may include one or more network hubs, network switches, network routers, disc satellite TV antennas, or any other network devices. Such devices or components may be operatively interconnected to provide information exchange between computers, devices, or other components (e.g., between one or more client devices or systems and one or more server devices or systems). Figure 2 Each of the devices or systems shown can be operatively coupled to network 205 using one or more network links. The link coupling such a device or system to network 205 can be Ethernet, Asynchronous Transfer Mode (ATM), or other types of network connection, and such connection can be wireless and / or wired. Figure 2 One or more of the devices or systems shown or otherwise on network 205 may be located in a remote location relative to one or more other devices or systems shown.

[0054] The network analysis system 240 can be implemented as any suitable computing system, such as one or more server computers, workstations, mainframes, appliances, cloud computing systems, and / or other computing systems capable of performing the operations and / or functions described in one or more aspects of this disclosure. In some examples, the network analysis system 240 represents a cloud computing system, server cluster, and / or server group (or a portion thereof) that provides services to client devices and other devices or systems. In other examples, the network analysis system 240 may represent one or more virtualized computing instances (e.g., virtual machines, containers) of a data center, cloud computing system, server cluster, and / or server group, or be implemented through one or more virtualized computing instances (e.g., virtual machines, containers) of a data center, cloud computing system, server cluster, and / or server group.

[0055] exist Figure 2 In the example, network analysis system 240 may include a power supply 241, one or more processors 243, one or more communication units 245, one or more input devices 246, and one or more output devices 247. Storage device 250 may include one or more collector modules 252, user interface modules 254, streaming APIs 256, and data storage 259.

[0056] One or more of the devices, modules, storage areas, or other components of the network analysis system 240 may be interconnected to enable inter-component communication (physical, communicative, and / or operational). In some examples, such connectivity may be provided via a communication channel (e.g., communication channel 242), a system bus, a network connection, an inter-process communication data structure, or any other method for communicating data.

[0057] Power supply 241 can provide power to one or more components of network analysis system 240. Power supply 241 may receive power from a primary alternating current (AC) power source at a data center, building, home, or other location. In other examples, power supply 241 may be a battery or a device that supplies direct current (DC). In yet another example, network analysis system 240 and / or power supply 241 may receive power from another source. One or more devices or components shown within network analysis system 240 may be connected to power supply 241 and / or may receive power from power supply 241. Power supply 241 may have intelligent power management or consumption capabilities, and this feature may be controlled, accessed, or adjusted by one or more modules of network analysis system 240 and / or by one or more processors 243 to intelligently consume, distribute, supply, or otherwise manage power.

[0058] One or more processors 243 of the network analysis system 240 may implement functions associated with the network analysis system 240 or with one or more modules shown and / or described herein and / or execute instructions associated with the network analysis system 240 or with one or more modules shown and / or described herein. The one or more processors 243 may be processing circuitry performing operations according to one or more aspects of this disclosure, may be part of processing circuitry performing operations according to one or more aspects of this disclosure, and / or may include processing circuitry performing operations according to one or more aspects of this disclosure. Examples of processors 243 include microprocessors, application processors, display controllers, auxiliary processors, one or more sensor hubs, and any other hardware configured to function as a processor, processing unit, or processing device. A central monitoring system may use one or more processors 243 to perform operations according to one or more aspects of this disclosure using software, hardware, firmware, or a mixture of hardware, software, and firmware residing in and / or executing at the network analysis system 240.

[0059] One or more communication units 245 of the network analysis system 240 can communicate with devices outside the network analysis system 240 by sending and / or receiving data, and in some respects can operate as input and output devices. In some examples, the communication unit 245 can communicate with other devices via a network. In other examples, the communication unit 245 can send and / or receive radio signals on a radio network, such as a cellular radio network. Examples of communication units 245 include network interface cards (e.g., Ethernet cards), optical transceivers, radio frequency transceivers, GPS receivers, or any other type of device capable of sending and / or receiving information. Other examples of communication units 245 may include those capable of transmitting and / or receiving information via… Devices that communicate via GPS, NFC, ZigBee, and cellular networks (e.g., 3G, 4G, 5G), as well as those appearing in mobile devices and Universal Serial Bus (USB) controllers, etc. Radio. Such communication may follow, implement, or comply with appropriate protocols, including Transmission Control Protocol / Internet Protocol (TCP / IP), Ethernet, Bluetooth, NFC, or other technologies or protocols.

[0060] One or more input devices 246 may represent any input device of the network analysis system 240 not otherwise separately described herein. One or more input devices 246 may generate, receive, and / or process input from any type of device capable of detecting input from a person or machine. For example, one or more input devices 246 may generate, receive, and / or process input in the form of electrical, physical, audio, image, and / or visual input (e.g., peripheral devices, keyboards, microphones, cameras).

[0061] One or more output devices 247 may represent any output device of the network analysis system 240 not otherwise separately described herein. One or more output devices 247 may generate, receive, and / or process input from any type of device capable of detecting input from a person or machine. For example, one or more output devices 247 may generate, receive, and / or process output in the form of electrical and / or physical outputs (e.g., peripheral devices, actuators).

[0062] One or more storage devices 250 within the network analysis system 240 may store information for processing during operation of the network analysis system 240. Storage devices 250 may store program instructions and / or data associated with one or more modules described according to one or more aspects of this disclosure. One or more processors 243 and one or more storage devices 250 may provide an operating environment or platform for such modules, which may be implemented as software, but in some examples may include any combination of hardware, firmware, and software. One or more processors 243 may execute instructions, and one or more storage devices 250 may store instructions and / or data of one or more modules. The combination of processors 243 and storage devices 250 may retrieve, store, and / or execute instructions and / or data of one or more application programs, modules, or software. Processors 243 and / or storage devices 250 may also be operatively coupled to one or more other software and / or hardware components, including but not limited to one or more components of the network analysis system 240 and / or shown as one or more devices or systems connected to the network analysis system 240.

[0063] In some examples, one or more storage devices 250 are implemented as temporary memory, meaning that the primary purpose of one or more storage devices is not long-term storage. The storage device 250 of the network analysis system 240 may be configured as volatile memory for short-term storage of information, and therefore the stored content is not retained if it is deactivated. Examples of volatile memory include random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), and other forms of volatile memory known in the art. In some examples, the storage device 250 also includes one or more computer-readable storage media. The storage device 250 may be configured to store a larger amount of information than volatile memory. The storage device 250 may be further configured as non-volatile memory space for long-term storage of information, and retain information after an activation / deactivation cycle. Examples of non-volatile memory include magnetic hard disks, optical disks, flash memory, or electrically programmable memory (EPROM) or electrically erasable programmable memory (EEPROM).

[0064] Collector module 252 can perform functions related to receiving both the underlying streaming data 204 and the overlay streaming data 206, and perform load balancing as needed to ensure high availability, throughput, and scalability for collecting such streaming data. Collector module 252 can process data, preparing it for storage in data memory 259. In some examples, collector module 252 may store data in data memory 259.

[0065] User interface module 254 can perform functions related to generating a user interface for presenting the results of analytical queries performed by streaming API 256. In some examples, user interface module 254 can generate enough information to generate a set of user interfaces and cause communication unit 245 to output such information via network 205 for use by user interface device 129, thereby presenting one or more user interfaces at a display device associated with user interface device 129.

[0066] Stream API 256 can perform analytical queries involving data stored in data storage 259, derived from a collection of underlying stream data 204 and overlay stream data 206. In some examples, Stream API 256 can receive requests in the form of information derived from HTTP POST requests, and in response, can translate the requests into queries to be executed on data storage 259. Furthermore, in some examples, Stream API 256 can obtain topology information about device 110 and perform analyses including data deduplication, overlay-underlying association, traffic path identification, and heatmap traffic calculation.

[0067] Data storage 259 can represent any suitable data structure or storage medium for storing information related to data flow information, including storing data derived from underlying flow data 204 and overlay flow data 206. Data storage 259 can be responsible for storing data in an indexed format, enabling fast data retrieval and query execution. The information stored in data storage 259 can be searchable and / or categorizable, allowing one or more modules within network analysis system 240 to provide input requesting information from data storage 259 and, in response to that input, receive information stored in data storage 259. Data storage 259 can be primarily maintained by collector module 252. Data storage 259 can include configuration information that allows identification of virtual networks based solely on virtual network identifiers or coded references to virtual networks. In some examples, the information stored in data storage 259 can correspond to or include a trajectory configuration database associated with a trajectory cloud network automation solution from Juniper Networks, Inc., Sunnyvale, California. Data storage 259 can be implemented using multiple hardware devices and can achieve fault tolerance and high availability through data sharding and replication. In some examples, the data store 259 can be implemented using the open-source ClickHouse column-oriented database management system. In some examples, the data store 259 can achieve fault tolerance and high availability by sharding and replicating data across multiple storage devices, which can be placed across multiple physical hosts.

[0068] Each host device 210 represents a physical computing device or computing node that provides a runtime environment for virtual hosts, virtual machines, containers, and / or other virtualized computing resources. In some examples, each host device 210 may be a component of a cloud computing system, server cluster, and / or server group (or part thereof) that provides services to client devices and other devices or systems.

[0069] This document describes certain aspects of host device 210A. Other host devices 210 (e.g., host devices 210B to 210N) may be described similarly and may also include components with the same numbering, which may represent the same, similar, or corresponding components, means, modules, functions, and / or other features. Therefore, the description of host device 210A herein may be applied accordingly to one or more other host devices 210 (e.g., host devices 210B to 210N).

[0070] exist Figure 2In the example, host device 210A includes underlying physical computing hardware, which includes a power supply 211A, one or more processors 213A, one or more communication units 215A, one or more input devices 216A, one or more output devices 217A, and one or more storage devices 220A. In the illustrated example, storage device 220A may include a hypervisor module 221A, which may include a kernel module 222A, a virtual router module 224A, and an agent module 226A. Virtual machines 228A to 228N (collectively referred to as “virtual machines 228” and representing any number of virtual machines 228) execute on or are controlled by hypervisor 221A. Similarly, virtual router agent 229A may execute on or under the control of hypervisor 221A. One or more of the devices, modules, storage areas, or other components of host device 210A may be interconnected to enable inter-component communication (physically, communicatively, and / or operatively). In some examples, such a connection may be provided via a communication channel (e.g., communication channel 212A), a system bus, a network connection, an inter-process communication data structure, or any other method for communicating data.

[0071] Power supply 211A provides power to one or more components of host device 210A. Processor 213A implements functions associated with host device 210A and / or executes instructions associated with host device 210A. Communication unit 215A communicates with other devices or systems on behalf of host device 210A. One or more input devices 216A and output devices 217A represent input and / or output devices associated with host device 210A. Storage device 220A stores information processed during operation of host device 210A. Each of these components may be integrated with network analysis system 240 or otherwise implemented in a manner similar to those described herein.

[0072] Hypervisor 221A can be used as a module or system for instantiating, creating, and / or executing one or more virtual machines 228 on the underlying host hardware device. In some contexts, hypervisor 221A may be referred to as a virtual machine manager (VMM). Hypervisor 221A may execute within an execution environment provided by storage device 220A and processor 213A or on an operating system kernel (e.g., kernel module 222A). In some examples, hypervisor 221A is an operating system-level component that executes on a hardware platform (e.g., host device 210A) to provide a virtualization operating environment and orchestration controller for virtual machines 228A and / or other types of virtual computing instances. In other examples, hypervisor 221A may be a software and / or firmware layer that provides a lightweight kernel and operates to provide a virtualization operating environment and orchestration controller for virtual machines 228A and / or other types of virtual computing instances. Hypervisor 221A may include the functionality of kernel module 222A (e.g., as a "Type 1 hypervisor"), such as Figure 2 As shown in the diagram. In other examples, hypervisor 221A may execute on the kernel (e.g., as a "type 2 hypervisor").

[0073] Virtual router module 224A can execute multiple routing instances of the corresponding virtual network within data center 101 (see...). Figure 1A or Figure 1B The virtual router module 224A can route packets to the appropriate virtual machine executing within the operating environment provided by host device 110A. The virtual router module 224A can also be responsible for collecting overlay flow data, such as trace flow data used when deployed in an infrastructure with trace SDN. Therefore, one or more host devices 210 may include a virtual router. Packets received by the virtual router module 224A of host device 210A, for example from the underlying physical network structure, may include an external header to allow the physical network structure to tunnel the payload or “internal packet” to the physical network address of the network interface of host device 210A. The external header may include not only the physical network address of the server’s network interface but also a virtual network identifier (such as a VXLAN label or a Multiprotocol Label Switching (MPLS) label) identifying one of the virtual networks and the corresponding routing instance performed by the virtual router. The internal packet includes an internal header with a destination network address that conforms to the virtual network addressing space of the virtual network identified by the virtual network identifier.

[0074] Agent module 226A may execute as part of hypervisor 221A, or it may execute in kernel space or as part of kernel module 222A. Agent module 226A may monitor some or all of the performance metrics associated with host device 210A, and may implement and / or enforce the ability to monitor performance metrics from the policy controller. Figure 2(Not shown in the image) The receiving strategy. Proxy module 226A can configure virtual router module 224A to transmit overlay flow data to network analysis system 240.

[0075] Virtual machines 228A through 228N (collectively referred to as "virtual machines 228," meaning any number of virtual machines 228) can represent example instances of virtual machines 228. Host device 210A can partition the virtual address space and / or physical address space provided by storage device 220A into user space for running user processes. Host device 210A can also partition the virtual address space and / or physical address space provided by storage device 220A into kernel space, which is protected and may be inaccessible to user processes.

[0076] Typically, each virtual machine 228 can be any type of software application, and each virtual machine can be assigned a virtual address for use within a corresponding virtual network, where each virtual network can be a different virtual subnet provided by the virtual router module 224A. Each virtual machine 228 can be assigned its own virtual Layer 3 (L3) IP address, for example, for sending and receiving communication, but the virtual machine is unaware of the IP address of the physical server on which it is running. In this way, the "virtual address" is associated with the underlying physical computer system (e.g., ...). Figure 2 The logical address of the host device 210A in the example is different from the address of the application.

[0077] Each virtual machine 228 may represent a tenant virtual machine running client applications (such as web servers, database servers, enterprise applications) or hosting virtualized services used to create service chains. In some cases, one or more of host devices 210 or other computing devices directly host client applications, i.e., not as virtual machines (e.g., one or more of host devices 210B to 210N, such as host devices 210B and 210N). Although one or more aspects of this disclosure have been described with respect to virtual machines or virtual hosts, the techniques described herein with respect to one or more aspects of this disclosure with respect to such virtual machines or virtual hosts may also be applied to containers, applications, processes, or other execution units (virtualized or non-virtualized) executing on host device 210.

[0078] exist Figure 2 In the example, the virtual router agent 229A is included within the host device 210A and can communicate with the SDN controller 132 (see Figure 1A and Figure 1BThe virtual router agent 229A communicates with the virtual router module 224A to control the coverage of the virtual network and coordinate the routing of data packets within the host device 210A. Typically, the virtual router agent 229A communicates with the SDN controller 132, which generates commands to control packet routing through the data center 101. The virtual router agent 229A can execute in user space and acts as a proxy for control plane messages between the virtual machine 228A and the SDN controller 132. For example, the virtual machine 228A may request to send a message via the virtual router agent 229A using its virtual address, and the virtual router agent 229A may in turn send a message and request to receive a response to the message for the virtual address of the virtual machine 228A that initiated the first message. In some cases, the virtual machine 228A may enable procedure or function calls presented by the application programming interface of the virtual router agent 229A, and in this example, the virtual router agent 229A also handles message encapsulation, including addressing.

[0079] exist Figure 2 In the example, similar to host device 210A, host device 210B includes underlying physical computing hardware, which includes a power supply 211B, one or more processors 213B, one or more communication units 215B, one or more input devices 216B, one or more output devices 217B, and one or more storage devices 220B. Storage device 220B may include one or more application modules 231B, which may correspond to applications executed by one or more tenants of host device 210B or executed on behalf of one or more tenants of host device 210B. Figure 2 In the example, host device 210B may be a bare metal server, which may mean that host device 210B operates as a single tenant device without virtualization components as in host device 210A. In such an example, host device 210B may not include any components or modules corresponding to virtual router module 224A, agent module 226A, and / or virtual router agent 229A of host device 210A. Without any such components or modules, host device 210B may be able to report underlying flow data 204, but may not be able to report overlay flow data 206, especially where the virtual router agent typically performs the function of reporting overlay flow data 206.

[0080] Host device 210 may be implemented as a virtualized computing node (e.g., as in host device 210A), a bare metal server (e.g., as in host device 210B), or in another manner. Figure 2As shown, host device 210N is illustrated as a bare metal server, similar to the bare metal server of host device 210B. Therefore, host device 210N is illustrated as having similarly numbered elements corresponding to those of host device 210B, and host device 210N can be implemented in a similar manner.

[0081] Network analysis system 240 can be configured to collect underlying flow data 204 from each of the backbone device 202 and leaf device 203. For example, in a reference... Figure 2 In the described example, the collector module 252 of the network analysis system 240 causes the communication unit 245 to output one or more signals through the network 205. Each of the backbone device 202 and leaf device 203 detects the signal and interprets it as a command to collect the underlying flow data 204. For example, upon detecting a signal from the network analysis system 240, the backbone device 202A configures itself to collect sFlow data and transmit the sFlow data (as underlying flow data 204) to the network analysis system 240 via the network 205. As another example, upon detecting a signal from the network analysis system 240, the leaf device 203A detects the signal and configures itself to collect sFlow data and transmit the sFlow data to the network analysis system 240 via the network 205. Furthermore, in some examples, each host device 210 may detect a signal from the network analysis system 240 and interpret the signal as a command to collect sFlow data. Therefore, in some examples, the sFlow data may be collected by a collector module executing on the host device 210.

[0082] Therefore, in the described example, backbone device 202, leaf device 203 (and possibly one or more or all of the host devices 210) collect sFlow data. However, in other examples, one or more of these devices may collect other types of underlying flow data 204, such as IPFIX and / or NetFlow data. Collecting any such underlying flow data may involve collecting 5-tuple data, which includes source and destination IP addresses, source and destination port numbers, and the network protocol being used.

[0083] Network analysis system 240 can configure one or more host devices 210 to collect overlay flow data 206. For example, continue to refer to Figure 2 As described in the example, collector module 252 causes communication unit 245 to output one or more signals through network 205. One or more host devices 210 detect signals that are interpreted as commands to collect overlay stream data 206 and transmit overlay stream data 206 to network analysis system 240.

[0084] For example, referring to host device 210A, the communication unit 215A of host device 210A detects a signal through network 205 and outputs information about the signal to management program 221A. Management program 221A outputs the information to agent module 226A. Agent module 226A interprets the information from management program 221A as a command to collect overlay flow data 206. Agent module 226A configures virtual router module 224A to collect overlay flow data 206 and transmits the overlay flow data 206 to network analysis system 240. However, host device 210, implemented as a bare metal server, may not be able to detect or respond to signals through network 205 to collect overlay flow data 206. For systems where host device 210 relies on a virtual router or virtual router agent corresponding to virtual router module 224A or agent module 226A to generate, collect, and / or report overlay flow data, network analysis system 240 may not be able to receive overlay flow data from host device 210, implemented as a bare metal server.

[0085] In at least some examples, the overlay flow data 206 collected by host device 210A includes 5-tuple information about the source and destination addresses, ports, and protocols. Additionally, the overlay flow data 206 may include information about the virtual networks associated with the flow (including source and destination virtual networks). In some examples, particularly for networks using a trajectory SDN configuration available from Juniper Networks in Sunnyvale, California, the overlay flow data 206 may correspond to trajectory flow data.

[0086] In the described example, agent module 226A configures virtual router module 224A of host device 210A to collect overlay flow data 206. However, in other examples, hypervisor 221A may configure virtual router module 224A to collect overlay flow data 206. Furthermore, in other examples, the overlay flow data 206 may be collected by another module (alternatively or additionally) such as agent module 226A, or even by hypervisor 221A or kernel module 222A. Thus, one or more host devices 210 may collect underlying flow data (sFlow data) and overlay flow data (e.g., trajectory flow data) in various ways.

[0087] The network analysis system 240 can receive both the underlying stream data 204 and the overlay stream data 206. For example, continuing with this example and referring to... Figure 2The backbone device 202A samples, detects, senses, and / or collects underlying streaming data 204. The backbone device 202A outputs signals via network 205. The communication unit 245 of the network analysis system 240 detects the signals from the backbone device 202A and outputs information about the signals to the collector module 252. The collector module 252 determines that the signals include information about the underlying streaming data 204 from the backbone device 202A.

[0088] Similarly, the virtual router module 224A of the host device 210A samples, detects, senses, and / or collects underlying flow data 204 and / or overlay flow data 206 at the host device 210A. The virtual router module 224A causes the communication unit 215A of the host device 210A to output signals through the network 205. The communication unit 245 of the network analysis system 240 detects the signal from the host device 210A and outputs information about the signal to the collector module 252. The collector module 252 determines that the signal includes information about the underlying flow data 204 and / or overlay flow data 206 from the host device 210A.

[0089] Furthermore, host device 210B can also sample, collect, sense, and / or collect underlying flow data 204. However, host device 210B may not be able to collect overlay flow data 206 because host device 210B can be implemented as a bare-metal server without virtual routers and / or virtual routing agents. However, one or more application modules 231B executing on host device 210B cause communication unit 215B to output signals via network 205. Communication unit 245 of network analysis system 240 detects the signal from host device 210B and outputs information about the signal to collector module 252. Collector module 252 determines that the signal contains information about underlying flow data 204 from host device 210B. Host device 210N can report underlying flow data 204 to network analysis system 240 in a similar manner.

[0090] Network analysis system 240 can process underlying flow data 204 and overlay flow data 206 received from different devices within network system 100. For example, continuing with the same example, collector module 252 processes signals received from backbone device 202A, host device 210, and other devices by distributing signals across one or more collector modules 252. In some examples, each collector module 252 may execute on a different physical server and may be scaled individually and horizontally to handle the expected or peak capacity of flow traffic from backbone device 202, leaf device 203, and host device 210. Each collector module 252 stores each instance of underlying flow data 204 and overlay flow data 206 and makes the stored data available for retrieval in data storage 259. Collector module 252 indexes the data and prepares it for analytical queries. In some examples, collector module 252 identifies a virtual network identifier associated with communication involving such a bare metal server and uses this virtual network identifier to identify the virtual network name associated with such communication from configuration information or other overlay flow data 206 reported by other devices, in order to correlate the underlying flow data 204 reported by any host device 210 implemented as a bare metal server.

[0091] The network analysis system 240 can store the underlying stream data 204 and the overlay stream data 206 in the data storage 259. For example, in Figure 2 In this process, collector module 252 outputs information to data storage 259. Data storage 259 determines that the information corresponds to underlying stream data 204 and overlay stream data 206. Data storage 259 stores data in an indexed format, enabling fast aggregation queries and fast random access data retrieval. In some examples, the underlying stream data 204 and overlay stream data 206 may be enriched before being stored in data storage 259. This enrichment enables the identification of virtual networks or overlay information associated with the underlying stream data 204, and also enables the identification of physical network devices associated with the virtual networks or overlay stream data 206. In other examples, the underlying stream data 204 and / or overlay stream data 206 may be stored without such enrichment, but with sufficient information to enable subsequent identification of virtual networks or overlay information associated with the underlying stream data 204 (e.g., via stream API 256), and / or to enable subsequent identification of physical network devices associated with the virtual networks or overlay stream data 206.

[0092] The network analysis system 240 can receive queries about information related to virtual networks. For example, continuing with the same example and referring to... Figure 2User interface device 129 detects input via network 205 and outputs signals derived from the input. Communication unit 245 of network analysis system 240 detects the signals and outputs information about the signals to stream API 256. Stream API 256 determines that the signal corresponds to a query from user interface device 129 regarding information about network devices used by the virtual network.

[0093] The network analysis system 240 can process queries. For example, refer again to... Figure 2 As described in the context of the example, the streaming API 256 of the network analysis system 240 queries the data store 259 to obtain information about the virtual network identified in the user's query. As previously described, the data store 259 may include enriched underlying streaming data 204 and overlay streaming data 206, which enables the identification of the underlying device associated with the virtual network, and / or the virtual network associated with the underlying device.

[0094] Specifically, data storage 259 may include information enabling the identification of bare metal servers used in the virtual network. For example, if the virtual network queried by a user involves communication between host device 210B and host device 210N, the virtual network may include network devices acting as bare metal servers. In such an example, both host device 210B and host device 210N may report underlying flow data 204 to network analysis system 240. However, because both host device 210B and host device 210N are implemented as bare metal servers, neither host device 210B nor host device 210N may report overlay flow data 206. If underlying flow data 204 and overlay flow data 206 are reported by host device 210B or host device 210N (or both), it will be possible to correlate underlying flow data 204 and overlay flow data 206 collected by host device 210B or host device 210N as described in U.S. Patent Application Serial No. 16 / 541,947, which is incorporated herein by reference. However, if neither host device 210B nor host device 210N reports overlay flow data 206, then different methods relying solely on the underlying flow data 204 collected by host device 210B and host device 210N can be used to determine whether both host device 210B and host device 210N are part of the queried virtual network.

[0095] According to one or more aspects of this disclosure, network analysis system 240 can determine that host devices 210B and 210N are part of a queried virtual network by identifying any virtual network identifiers associated with bare metal servers within network system 200. For example, underlying flow data 204 reported by host devices 210B, 210N, or other devices on network 205 may not include the name of the virtual network corresponding to traffic transmitted between bare metal host devices 210B and 210N. However, such underlying flow data 204 may include a reference to a virtual network identifier (i.e., an encoded reference or numeric identifier) ​​that can be used to identify by name any virtual network through which host devices 210B and / or 210N communicate. In some examples, the virtual network identifier is (e.g., by...) Figure 1B The virtual network identifier is a number or other code generated internally by the SDN controller 132 and / or orchestration engine 130. If the virtual network identifier is a code generated by the SDN controller 132 or orchestration engine 130, it may be unrecognizable to users or administrators. On the other hand, the virtual network name can be established based on input received from an administrator or user, thus being recognizable to the administrator or user and can be part of a query received from the user interface device 129. For at least this reason, it is important to be able to derive the virtual network name from the underlying flow data 204. In some examples, the virtual network name can be derived from the virtual network identifier based on configuration information and / or overlay flow data 206 reported by other network devices with virtual routers (i.e., other than host device 210B and host device 210N) (such as host device 210A). In order to derive the virtual network name from the underlying flow data 204 collected by host device 210B and host device 210N, the flow API 256 analyzes this configuration information stored in the data storage 259. The Stream API 256 identifies the virtual network name associated with the virtual network identifier in the underlying stream data 204 reported by any bare metal host device 210, and ensures that queries include business between bare metal servers during processing.

[0096] The network analysis system 240 can respond to queries. For example, continuing in Figure 2In the example described in the context of the query, the Stream API 256 identifies an attribute specified by the query, which may include one or more possible paths of traffic associated with the queried virtual network. The Stream API 256 outputs information about the identified possible paths to the User Interface Module 254. The User Interface Module 254 uses the information from the Stream API 256 to generate data sufficient to create a User Interface that presents information about possible paths of traffic associated with the queried virtual network. The User Interface Module 254 causes the Communication Unit 245 to output a signal through the Network 205. The User Interface Device 129 detects the signal through the Network 205 and determines that the signal contains sufficient information to generate the User Interface. The User Interface Device 129 generates a User Interface (e.g., User Interface 400) and presents it at a display associated with the User Interface Device 129. In some examples, the User Interface 400 (e.g., such as...) Figure 4 The interface shown presents information illustrating one or more possible paths of traffic associated with the queried virtual network. In other examples, the user interface 400 may present information about the structural devices in use, present a topology view, present information about the top "N" devices processing traffic for the queried virtual network, and / or present other analyses.

[0097] Figure 2 The modules shown (e.g., virtual router module 224A, agent module 226A, application module 231B, collector module 252, user interface module 254, stream API 256, and others) and / or shown or described elsewhere in this disclosure may perform the described operations using software, hardware, firmware, or a mixture of hardware, software, and firmware residing in and / or executing on one or more computing devices. For example, a computing device may use multiple processors or multiple devices to execute one or more such modules. A computing device may execute one or more such modules as virtual machines executing on the underlying hardware. One or more such modules may execute as one or more services of an operating system or computing platform. One or more such modules may execute as one or more executable programs at the application layer of a computing platform. In other examples, the functionality provided by the modules may be implemented by dedicated hardware devices.

[0098] While certain modules, data memories, components, programs, executable files, data items, functional units, and / or other items included within one or more storage devices may be shown individually, one or more such items may be combined or operated as a single module, component, program, executable file, data item, or functional unit. For example, one or more modules or data memories may be combined or partially combined such that they operate or provide functionality as a single module. Furthermore, one or more modules may interact with each other and / or operate in combination with each other, such that, for example, one module serves as a service or extension of another module. Additionally, each module, data memory, component, program, executable file, data item, functional unit, or other item shown within the storage device may include multiple components, subcomponents, modules, submodules, data memories, and / or other components or modules or data memories not shown.

[0099] Furthermore, each module, data storage device, component, program, executable file, data item, functional unit, or other item shown within the storage device can be implemented in various ways. For example, each module, data storage device, component, program, executable file, data item, functional unit, or other item shown within the storage device can be implemented as a downloadable or pre-installed application or "app". In other examples, each module, data storage device, component, program, executable file, data item, functional unit, or other item shown within the storage device can be implemented as part of an operating system executing on a computing device.

[0100] Figure 3A This is a conceptual diagram illustrating an exemplary virtual network data structure associated with a virtual network maintained by a configuration database, according to one or more aspects of this disclosure. When in a network (e.g., Figure 1B When establishing a virtual network within a network system 100, it is possible to create (for example, through...) Figure 1B Orchestration engine 130 or SDN controller 132) Figure 3A The virtual network data structure 320 includes multiple fields, including a virtual network identifier field 321 and a virtual network name field 322. Figure 3A In the example, the virtual network name field 322 corresponds to the name of the virtual network associated with the virtual network identifier field 321. The virtual network name field 322 can be based on administrator input (“vred-vn”), and therefore identifiable by the administrator or user. The virtual network identifier field 321 can be an encoded reference (“18”) to the virtual network name field 322, which corresponds to the virtual network name field 322, and this encoded reference can be included in the... Figure 1BThe underlying stream data 204 is transmitted by one or more devices 110. In the example shown, the virtual network identifier field 321 corresponds to the "vxlan_network_identifier" field of the virtual network data structure 320.

[0101] Figure 3B This is a conceptual diagram illustrating an exemplary instance of sFlow data according to one or more aspects of this disclosure. Figure 3B The sFlow data 330 can be generated by a bare metal server (such as host device 210B or host device 210N (see...) Figure 2 An instance of sFlow data reported by (or another network device). The virtual network identifier field 331 of sFlow data 330 corresponds to Figure 3A The virtual network identifier field 321. Therefore, for reporting two bare-metal server host devices (e.g., Figure 2 The sFlow data 330 between the host device 210 in the middle) is used for communication if information such as the virtual network data structure 320 of each virtual network is available (e.g., in Figure 2 If the data is stored in the data storage 259 of the network analysis system 240, then the sFlow data 330 is sufficient to identify the virtual network through which the bare metal host device can communicate. If information such as the virtual network data structure 320 is available, the virtual network name field 322 can be derived from the sFlow data 330 by associating the virtual network identifier field 331 of the sFlow data 330 with the virtual network identifier field 321 of the virtual network data structure 320 and extracting the virtual network name field 322 from the virtual network data structure 320.

[0102] Figure 4 This is a conceptual diagram illustrating an exemplary user interface presented by a user interface device according to one or more aspects of this disclosure. Figure 4 User interface 400 is shown. Although user interface 400 is shown as a graphical user interface, other types of interfaces may be presented in other examples, including text-based user interfaces, console- or command-based user interfaces, voice-prompt user interfaces, or any other suitable user interface. Figure 4 The user interface 400 shown may correspond to the user interface module 254 generated by the network analysis system 240 and in Figure 2 The user interface is presented at location 129 of the user interface device. Here you can... Figure 2 The context describes one or more aspects related to the generation and / or presentation of the user interface 400.

[0103] According to one or more aspects of this disclosure, network analysis system 240 can perform queries to identify paths associated with virtual networks. For example, in reference to... Figure 2 In the described example, user interface device 129 detects input and outputs signals via network 205. The communication unit 245 of network analysis system 240 detects a signal corresponding to a query for network information via streaming API 256. Streaming API 256 executes the query (e.g., using a combination of...). Figure 3A and Figure 3B The described technology) and outputs information about the results to the user interface module 254. In order to find the path between two virtual machines, the flow API 256 can determine the most likely path (and the business traveling on the determined path).

[0104] The network analysis system 240 can generate a user interface (such as a user interface 400) for presentation on a display device. For example, still referring to... Figure 2 and Figure 4 The user interface module 254 generates the underlying information of the user interface 400 and causes the communication unit 245 to output signals through the network 205. The user interface device 129 detects the signals and determines that the signals contain sufficient information to present the user interface. The user interface device 129 uses... Figure 4 The user interface 400 is presented on a display device associated with the user interface device 129 in the manner shown.

[0105] exist Figure 4 In this context, a user interface 400 is presented within a display window 401. The user interface 400 includes a sidebar area 404, a main display area 406, and an options area 408. The sidebar area 404 provides an indication of which user interface mode is presented within the user interface 400. Figure 4 In this example, the user interface mode corresponds to the "structure" mode. Other modes can be applied to other network analysis scenarios. Along the top of the main display area 406 is the navigation interface component 427, which can also be used to select the type or mode of network analysis to perform. The status notification display element 428 can provide information about alarms or other status information related to one or more networks, users, components, or resources.

[0106] The main display area 406 presents the network diagram and can provide the topology of different network devices included within the network being analyzed. Figure 4 In the example shown, as indicated in the legend shown along the bottom of the main display area 406, the network is depicted as having backbone devices, leaf devices, hosts, and instances. The actual or potential data paths between network devices and other components are shown within the main display area 406. Although Figure 4A limited number of different types of network devices and components are shown, but in other examples, other types of devices, components, or elements may be presented and / or specifically shown, including core switch devices, other backbone and leaf devices, physical or virtual routers, virtual machines, containers, and / or other devices, components, or elements. Furthermore, some data paths or components of the network (e.g., instances) may be hidden or minimized within the user interface 400 to facilitate the presentation and / or display of components or data paths most relevant to a given network analysis.

[0107] Option area 408, located along the right-hand side of user interface 400, provides numerous input fields relating to the virtual network and / or heatmap or other parameters, as well as the selected item to be analyzed. User interface 400 accepts input by interacting with the user through one or more of the displayed input fields, and based on the data input into the input fields, user interface module 254 presents response information about the network being analyzed.

[0108] For example, in Figure 4 In the example, user interface 400 accepts input in option area 408 regarding a specific time frame (e.g., time range) and a specific source virtual network and / or destination virtual network. Using the input provided in option area 408, network analysis system 240 determines information about one or more possible data paths (e.g., the most likely data path) through underlying network devices (which may include bare metal host devices 410B and 410N). Network analysis system 240 determines such possible data paths based on data collected by network analysis system 240 (e.g., by collector module 252) during the time range specified in option area 408. User interface module 254 of network analysis system 240 generates data that enables the presentation of user interface 400, in which one possible data path is highlighted (by drawing each segment of the data path with thick lines), such as... Figure 4 As shown in the diagram. In some examples, more than one data path from the source virtual network to the destination virtual network may be highlighted. Furthermore, in some examples, one or more data paths in the main display area 406 may be presented using a heatmap color scheme, meaning that a data path is shown with a color (or gray shading) corresponding to the amount of data transmitted on that path or the degree to which the corresponding path is being used. Although Figure 4 The data path is shown using a heatmap color (or grayscale shading) scheme, but in other examples, data about the data path or the use or business of the network device may be presented in other appropriate ways (e.g., applying color to other elements of the main display area 406, presenting pop-ups, or presenting other user interface elements).

[0109] In some examples, option area 408 (or other areas of user interface 400) may include charts or other indicators that provide information about utilization or business on one or more paths. In such examples, the charts may be related to or generated in response to user input entered into input fields within option area 408.

[0110] Figure 5 This is a flowchart illustrating the operations performed by an exemplary network analysis system according to one or more aspects of this disclosure. (The document is located in...) Figure 2 The network analysis system 240 is described in the context of Figure 5 In other examples, Figure 5 The operations described herein can be performed by one or more other components, modules, systems, or devices. Furthermore, in other examples, in conjunction with... Figure 5 The described operations may be combined, performed in a different order, omitted, or may cover additional operations that are not specifically stated or described.

[0111] exist Figure 5 During the process shown, and according to one or more aspects of this disclosure, the network analysis system 240 may store virtual network configuration information (501). For example, in reference to Figure 2 In the described example, user interface device 129 detects input and outputs signals via network 205. Communication unit 245 of network analysis system 240 detects the signals via network 205 and outputs information about the signals to stream API 256. Stream API 256 determines that the signal corresponds to administrator input for establishing a virtual network within network system 200. Stream API 256 stores configuration information associated with the virtual network in data storage 259. In some examples, the configuration information stored in data storage 259 may be similar to... Figure 3A The virtual network data structure 320.

[0112] The network analysis system 240 can collect underlying flow data 204 (502). For example, continue to refer to Figure 2 In the described example, the collector module 252 of the network analysis system 240 causes the communication unit 245 to output one or more signals through the network 205. Devices within the network system 200 (e.g., host devices 210B and 210N) detect the signals and interpret them as commands to collect underlying stream data 204. Subsequently, each of these devices, including host devices 210B and 210N, can occasionally, periodically, or continuously transmit the underlying stream data 204 to the network analysis system 240 through the network 205. The collector module 252 of the network analysis system 240 receives the underlying stream data 204 and stores it in the data memory 259.

[0113] Network analysis system 240 can determine (503) that communication (identified by underlying flow data 204) is occurring on a specific virtual network. For example, referring again to the described example, collector modules 252 can receive information about the collected data from communication unit 245 of network analysis system 240. Collector modules 252 can determine that the data corresponds to underlying flow data 204 collected from one or more host devices 210B and 210N. Collector modules 252 output the information to flow API 256. Flow API 256 analyzes the received underlying flow data 204 and uses previously stored configuration information (stored in data memory 259) to identify the virtual network through which communication occurs between host devices 210B and 210N. Flow API 256 can enrich such underlying flow data 204 with information about one or more virtual networks.

[0114] Network analysis system 240 can generate a user interface (504). For example, referring again to the described example, user interface module 254 receives an input instruction corresponding to a query received from a user of user interface device 129. User interface module 254 outputs information about the query to stream API 256. Stream API 256 determines that the query corresponds to a request for information about a virtual network. Stream API 256 uses information stored in data memory 259 (e.g., underlying stream data 204) to identify network devices associated with or used by the requested virtual network. Stream API 256 outputs information about its analysis to user interface module 254. User interface module 254 generates a user interface based on this information. User interface module 254 causes communication unit 245 of network analysis system 240 to output a signal through network 205. User interface device 129 detects the signal through network 205 and determines that the signal contains sufficient information to generate a user interface. User interface device 129 presents a user interface in response to the query (e.g., ...). Figure 4 User interface 400).

[0115] For any processes, apparatuses, and other examples or illustrations contained in any work diagram or flowchart described herein, certain operations, actions, steps, or events included in any technology described herein may be performed in a different order, may be added, combined, or omitted entirely (e.g., not all described actions or events are necessary for the practice of the technology). Furthermore, in some examples, operations, actions, steps, or events may be performed concurrently, rather than sequentially, for example, through multithreading, interrupt handling, or multiple processors. Additionally, certain operations, actions, steps, or events may be performed automatically, even if not specifically identified as such. Furthermore, certain operations, actions, steps, or events described as automatically performed may alternatively not be automatically performed, but in some examples may be performed in response to input or another event.

[0116] For ease of illustration, only a limited number of devices (e.g., user interface device 129, backbone device 202, leaf device 203, host device 210, network analysis system 240, and other devices) are shown in the accompanying drawings and / or other illustrations referenced herein. However, the techniques according to one or more aspects of this disclosure can be implemented using many more such systems, components, devices, modules, and / or items, and concentrated references to such systems, components, devices, modules, and / or items can refer to any number of such systems, components, devices, modules, and / or items.

[0117] The accompanying drawings illustrate at least one example implementation of one aspect of this disclosure. However, the scope of the invention is not limited to such implementations. Thus, other examples or alternative implementations of the systems, methods, or techniques described herein may be adapted to other examples, in addition to those shown in the drawings. Such implementations may include a subset of the means and / or components included in the drawings, and / or may include additional means and / or components not shown in the drawings.

[0118] The detailed description above is intended to describe various configurations, and not to represent the only configuration that can be implemented using the subject matter. The detailed description includes specific details and is intended to provide a thorough understanding of the various concepts. However, these concepts can be implemented without these specific details. In some cases, well-known structures and components are shown in block diagram form in the accompanying drawings to avoid obscuring these concepts.

[0119] Therefore, although one or more implementations of various systems, devices, and / or components may be described with reference to specific figures, these systems, devices, and / or components may be implemented in many different ways. For example, the figures herein (e.g., Figure 1A , Figure 1B and / or Figure 2One or more devices shown as independent devices in the accompanying drawings may alternatively be implemented as a single device; one or more components shown as independent components may alternatively be implemented as a single component. Furthermore, in some examples, one or more devices shown as a single device in the accompanying drawings may alternatively be implemented as multiple devices; one or more components shown as a single component may alternatively be implemented as multiple components. Each of such multiple devices and / or components may be directly coupled via wired or wireless communication and / or remotely coupled via one or more networks. Additionally, one or more devices or components shown in the various accompanying drawings may alternatively be implemented as part of another device or component not shown in those drawings. In this and other ways, some of the functions described herein may be performed via distributed processing of two or more devices or components.

[0120] Furthermore, certain operations, techniques, features, and / or functions may be described herein as being performed by a specific component, device, and / or module. In other examples, such operations, techniques, features, and / or functions may be performed by different components, devices, or modules. Thus, in other examples, some operations, techniques, features, and / or functions that may be described herein as belonging to one or more components, devices, or modules may belong to other components, devices, and / or modules, even if not specifically described in this way herein.

[0121] While specific advantages have been identified in conjunction with the description of some examples, various other examples may include some of the listed advantages, advantages not listed, or advantages including all of the listed advantages. Other techniques or other advantages will be apparent to those skilled in the art from this disclosure. Furthermore, although specific examples have been disclosed herein, aspects of this disclosure can be implemented using any number of techniques, whether currently known or not, and therefore, this disclosure is not limited to the examples specifically described and / or shown herein.

[0122] In one or more examples, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored on or transmitted via a computer-readable medium as one or more instructions or code, and executed by a hardware-based processing unit. A computer-readable medium may include a computer-readable storage medium corresponding to a tangible medium, such as a data storage medium, or a communication medium that includes any medium facilitating the transfer of a computer program from one place to another (e.g., according to a communication protocol). In this way, a computer-readable medium may generally correspond to: (1) a non-transitory tangible computer-readable storage medium; or (2) a communication medium such as a signal or carrier wave. A data storage medium may be any available medium accessible by one or more computers or one or more processors to retrieve instructions, code, and / or data structures to implement the techniques described in this disclosure. Computer program products may include computer-readable media.

[0123] By way of example, and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage, or other magnetic storage devices, flash memory, or any other medium that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer. Furthermore, any connector is appropriately referred to as a computer-readable medium. For example, if coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, radio, and microwave) is used to transmit instructions from a website, server, or other remote source, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, radio, and microwave) are included in the definition of medium. However, it should be understood that computer-readable storage media and data storage media do not include connectors, carrier waves, signals, or other transient media, but rather refer to non-transient tangible storage media. Disks and optical discs used include compact disks (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, and optical discs typically reproduce data optically using lasers. The above combinations should also be included within the scope of computer-readable media.

[0124] Instructions can be executed by one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), or other equivalent integrated or discrete logic circuit systems. Therefore, the terms "processor" or "processing circuitry" as used herein can refer to any of the foregoing structures or any other structure suitable for implementing the techniques described herein. Furthermore, in some examples, the described functionality may be provided within dedicated hardware and / or software modules. Moreover, these techniques can be fully implemented in one or more circuit or logic elements.

[0125] The techniques disclosed herein can be implemented in a wide variety of devices or apparatuses, including wireless handsets, mobile or non-mobile computing devices, wearable or non-wearable computing devices, integrated circuits (ICs), or a set of ICs (e.g., chipsets). Various components, modules, or units are described in this disclosure to emphasize functional aspects of a device configured to perform the disclosed techniques without requiring implementation by separate hardware units. Rather, as described above, various units may be combined within hardware units, or provided as a collection of interoperable hardware units incorporating one or more processors as described above, combined with suitable software and / or firmware.

Claims

1. A method for generating information, the method comprising: A network analysis system operating within the network stores configuration information, including names associated with virtual networks. The network analysis system collects underlying stream data associated with communication between a first server and a second server, wherein the second server is physically separated from the first server. Based on the underlying stream data and the stored configuration information, the network analysis system determines that the first server and the second server have communicated through the virtual network; and The network analysis system generates a user interface that includes information indicating that the first server and the second server have communicated through the virtual network.

2. The method according to claim 1, wherein, The configuration information stored includes: A network identifier that uniquely identifies the virtual network is stored as part of the configuration information.

3. The method according to claim 2, wherein, Determining that the first server and the second server have communicated through the virtual network includes: Based on the network identifier stored as part of the configuration information, the underlying stream data is used to determine that the first server and the second server have communicated through the virtual network.

4. The method according to claim 3, wherein, Collecting the underlying stream data includes: Collect sFlow data.

5. The method according to claim 4, wherein, The collection of the sFlow data includes: Collect sFlow data that includes the network identifier but excludes the name associated with the virtual network.

6. The method according to claim 5, The network identifier mentioned therein is a VXLAN label.

7. The method according to any one of claims 1 to 6, wherein, The configuration information stored includes: The network analysis system receives input including the name associated with the virtual network; and In response to receiving the input, the configuration information is stored.

8. The method according to any one of claims 1 to 6, wherein, The first server is implemented as a bare metal server.

9. The method according to claim 8, wherein, The second server is implemented as a bare metal server.

10. The method according to any one of claims 1 to 6, wherein, Generating the user interface includes: Receive an input instruction requesting information about a requested virtual network, wherein the input instruction includes a time frame and a name associated with the requested virtual network, and Generate the user interface that identifies the virtual network using the name.

11. A computing system comprising a storage system and processing circuitry, wherein, The processing circuit accesses the storage system and is configured to: Store configuration information within the network, including the name associated with the virtual network; Collect underlying streaming data associated with communication between a first server and a second server, wherein the second server is physically separated from the first server; Based on the underlying streaming data and the stored configuration information, it is determined that the first server and the second server have communicated through the virtual network; and Generate a user interface that includes information indicating that the first server and the second server have communicated through the virtual network.

12. The computing system according to claim 11, wherein, To store the configuration information, the processing circuit is further configured to: A network identifier that uniquely identifies the virtual network is stored as part of the configuration information.

13. The computing system according to claim 12, wherein, To determine that the first server and the second server have communicated through the virtual network, the processing circuit is further configured to: Based on the network identifier stored as part of the configuration information, and using information included in the underlying stream data, it is determined that the first server and the second server have communicated through the virtual network.

14. The computing system according to claim 13, wherein, To collect the underlying stream data, the processing circuit is further configured to: Collect sFlow data.

15. The computing system according to claim 14, wherein, To collect the sFlow data, the processing circuit is further configured to: Collect sFlow data that includes the network identifier but excludes the name associated with the virtual network.

16. The computing system according to claim 15, wherein, The network identifier is a VXLAN label.

17. The computing system according to any one of claims 11 to 16, wherein, To store the configuration information, the processing circuit is further configured to: The computing system receives input including the name associated with the virtual network; and In response to receiving the input, the configuration information is stored.

18. The computing system according to any one of claims 11 to 16, wherein, The first server is implemented as a bare metal server.

19. The computing system according to claim 18, wherein, The second server is implemented as a bare metal server.

20. A computer-readable medium encoded with instructions that, when executed, cause one or more programmable processors to perform the method of any one of claims 1 to 10.

Images