Network device, method for flow monitoring, and computer readable storage medium

Abstract

A network device, a method for flow monitoring, and a computer readable storage medium are disclosed. An exemplary network device includes: a memory; a communication unit; and a processing circuit coupled to the memory and the communication unit. The processing circuitry is configured to receive a first sample of a stream sampled at a first sampling rate from an interface of another network device and determine a first parameter based on the first sample. The processing circuit is configured to receive a second sample of the stream sampled at a second sampling rate from the interface, where the second sampling rate is different from the first sampling rate and determine a second parameter based on the second sample. The processing circuit is configured to: determine a third sampling rate based on the first parameter and the second parameter; controlling the communication unit to send a signal indicating a third sampling rate to another network device; and receive, from the interface, a third sample of the stream sampled at a third sampling rate.

Description

[0001] This application is a divisional application of Chinese Patent Application No. 202210845876.0, the entire contents of which are incorporated herein by reference.

[0002] This application claims the benefit of U.S. Patent Application No. 17 / 410,887, filed August 24, 2021, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure relates to the analysis of computer networks. Background Technology

[0004] Virtualized data centers are becoming a core foundation of modern information technology (IT) infrastructure. Modern data centers widely utilize virtualization environments, in which virtual machines, such as virtual machines or containers, are deployed and run on the underlying computing platform of physical computing devices.

[0005] Virtualization within large-scale data centers offers several advantages, including efficient use of computing resources and simplified network configuration. Therefore, in addition to the efficiency and increased return on investment (ROI) provided by virtualization, enterprise IT personnel often prefer virtualized computing clusters in data centers due to their management advantages. However, virtualization can present some challenges when analyzing, evaluating, and / or troubleshooting network operations. Summary of the Invention

[0006] This disclosure describes techniques for adaptive flow monitoring. Flow monitoring includes the process of monitoring traffic flows within a network. Flow monitoring enables network administrators to gain a better understanding of the networks they manage, automates specific network management tasks, and / or performs other activities.

[0007] Ideally, those skilled in the art could sample every packet; however, sampling every packet can be costly to implement, potentially burdening processing resources and adding to the network equipment footprint. Therefore, techniques such as sampled flows (sFlow) have been developed to sample flows at a given sampling rate. Currently, network administrators can set this sampling rate in a flow collector for a given interface of another network device, such as a top-of-rack (ToR) switch or other network device. However, flows change over time, and manually set sampling rates may become ineffective or burden processing resources. For example, a manually set sampling rate may not be fast enough to sample all flows on an interface or may be too fast for processing circuitry to handle. Therefore, adaptive flow sampling may be desirable.

[0008] According to the technology disclosed herein, a network device can change the sampling rate of a flow from an interface based on whether the sampling parameters of the flow have changed or whether the sampling parameters of the flow have little or no change (or little significant change). For example, if changing to a lower sampling rate results in detecting approximately the same number of flows as at a higher sampling rate, then a lower sampling rate may be better than a higher sampling rate because a higher sampling rate might be considered a waste of processing resources. On the other hand, if changing to a lower sampling rate results in detecting a significantly lower number of flows than at a higher sampling rate, then a higher sampling rate may be better than a lower sampling rate because a lower sampling rate does not allow all flows to be detected.

[0009] In one example, this disclosure describes a method comprising: receiving a first sample of a stream sampled at a first sampling rate from an interface of a network device; determining a first parameter based on the first sample; receiving a second sample of a stream sampled at a second sampling rate from the interface, wherein the second sampling rate is different from the first sampling rate; determining a second parameter based on the second sample; determining a third sampling rate based on the first parameter and the second parameter; transmitting a signal indicating the third sampling rate to the network device; and receiving a third sample of a stream sampled at the third sampling rate from the interface.

[0010] In another example, this disclosure describes a network device including: a memory configured to store a plurality of sampling rates; a communication unit configured to transmit signals and receive samples of a data stream; and processing circuitry communicatively coupled to the memory and the communication unit, the processing circuitry being configured to: receive a first sample of a stream sampled at a first sampling rate from an interface of another network device; determine a first parameter based on the first sample; receive a second sample of a stream sampled at a second sampling rate from the interface, wherein the second sampling rate is different from the first sampling rate; determine a second parameter based on the second sample; determine a third sampling rate based on the first and second parameters; control the communication unit to transmit a signal indicating the third sampling rate to the other network device; and receive a third sample of a stream sampled at the third sampling rate from the interface.

[0011] In another example, this disclosure describes a computer-readable medium including instructions for causing a programmable processor to: receive from an interface a first sample of a stream sampled at a first sampling rate; determine a first parameter based on the first sample; receive from the interface a second sample of the stream at a second sampling rate, wherein the second sampling rate is different from the first sampling rate; determine a second parameter based on the second sample; determine a third sampling rate based on the first and second parameters; control a communication unit to transmit a signal indicating the third sampling rate to a network device; and receive from the interface a third sample of the stream sampled at the third sampling rate.

[0012] Details of one or more examples are set forth in the accompanying drawings and the following description. Other features, objectives, and advantages will become apparent from the description and drawings, and from the claims. Attached Figure Description

[0013] Figure 1A This is a conceptual diagram illustrating an exemplary network including a system for analyzing traffic flows between and / or within a data center, according to one or more aspects of this disclosure.

[0014] Figure 1B This is a conceptual diagram illustrating exemplary components of a system for analyzing traffic flows between networks and / or within a data center, according to one or more aspects of this disclosure.

[0015] Figure 2 This is a block diagram illustrating an exemplary network analysis system according to one or more aspects of this disclosure.

[0016] Figure 3 This is a block diagram illustrating an exemplary network device according to one or more aspects of this disclosure.

[0017] Figure 4 This is a flowchart illustrating an exemplary method according to one or more techniques disclosed herein. Detailed Implementation

[0018] Data centers utilizing virtual environments offer efficiency, cost, and organizational advantages. In a virtual environment, virtual hosts, such as virtual machines or containers, are deployed and run on the underlying computing platform of physical computing devices. However, gaining meaningful insights into application workloads is undoubtedly crucial when managing arbitrary data center architectures. Collecting streaming datagrams (which may include traffic samples) from network devices can help provide this insight.

[0019] Sampling every single packet can be prohibitively expensive and may prevent network devices from performing their primary functions, such as routing, switching, or packet processing. Sampling of packets on an interface can be performed at a sampling rate that balances the expense of sampling every single packet with allowing the network device to focus its processing power on its primary purpose. However, a statically provided sampling rate may become obsolete as flows change. Therefore, adaptive flow monitoring may be desirable.

[0020] According to one or more aspects of this disclosure, a network device can adapt the sampling rate of an interface based on changes in flow parameters, such as changes in the number of flows determined at different sampling rates. In the various examples described herein, a network device may recursively receive samples of flows sampled at different sampling rates from the interface of another network device and determine the parameters of that flow until the last determined parameter differs from or is substantially different from the immediately preceding determined parameter. In some examples, the determined parameter is the number of flows. In some examples, the different sampling rates progressively decrease, each sampling rate lower than the previous sampling rate. In some examples, once the network device determines that the last determined parameter differs from or is substantially different from the immediately preceding determined parameter, the network device may instruct another network device to sample at a higher sampling rate than the last sampling rate. The flow samples can provide insights into the network and provide users, administrators, and / or other personnel with tools for network discovery, investigation, and troubleshooting.

[0021] Figure 1A This is a conceptual diagram illustrating an exemplary network including a system for analyzing traffic flows between and / or within a data center, according to one or more aspects of this disclosure. Figure 1A An exemplary implementation of network system 100 and data center 101 is shown, whereby data center 101 hosts one or more computing networks, computing domains or projects, and / or cloud-based computing networks, typically referred to herein as cloud computing clusters. The cloud-based computing clusters may coexist in a common monolithic computing environment (such as a single data center) or be distributed across environments (such as across different data centers). For example, the cloud-based computing clusters may be different cloud environments, such as OpenStack cloud environments, Kubernetes cloud environments, or various combinations of other computing clusters, domains, networks, etc. In other instances, other implementations of network system 100 and data center 101 may be suitable. This implementation may include... Figure 1A The examples include a subset of components and / or may include Figure 1A Additional components not shown.

[0022] exist Figure 1A In the example, data center 101 provides an operating environment for applications and services to customer 104 coupled to data center 101 via service provider network 106. Although combined Figure 1A The functions and operations described in the network system 100 can be shown as cross-... Figure 1A Distributed across multiple devices, however, in other examples, it can be performed internally by one or more local components of that device. Figure 1AThe features and technologies of one or more devices described herein. Similarly, one or more of these devices may include specific components and may perform various technologies additionally attributed to one or more other devices described herein. Furthermore, this disclosure may be combined with... Figure 1A This describes a specific operation, technique, feature, and / or function, or a specific operation, technique, feature, and / or function performed by a particular component, device, and / or module. In other examples, other components, devices, or modules may perform the operation, technique, feature, and / or function. Accordingly, even if not specifically described in this manner herein, some operations, techniques, features, and / or functions attributable to one or more components, devices, or modules may be attributable to other components, devices, and / or modules.

[0023] Data center 101 houses infrastructure equipment such as network and storage systems, redundant power supplies, and environmental controls. Service provider network 106 can be coupled to one or more networks managed by other vendors and can thus form part of a large-scale public network infrastructure, such as the Internet.

[0024] In some examples, data center 101 can represent one of multiple geographically distributed network data centers. For example... Figure 1A As illustrated in the example, data center 101 is a facility that provides network services to client 104. Client 104 can be a collective entity such as a business or government entity or individual. For example, a network data center may host network services for several businesses and end users. Other exemplary services may include data storage, virtual private networks, traffic engineering, file services, data mining, scientific or supercomputing, etc. In some examples, data center 101 is an individual network server, network peer, or something else.

[0025] exist Figure 1AIn this example, data center 101 includes a collection of storage systems, application servers, compute nodes, or other devices, including network devices 110A to 110N (collectively, “Network Device 110”, representing any number of network devices). Devices 110 may be interconnected via a high-speed switching structure 121 provided by one or more layers of physical network switches and routers. In some examples, devices 110 may be included within structure 121; however, for ease of illustration, structure 121 is shown separately. Network devices 110 may be any number of different types of network devices (core switches, top-of-rack (TOR) switches, spine network devices, leaf network devices, edge network devices, or other network devices); however, in some examples, one or more devices 110 may serve as physical compute nodes in the data center. For example, one or more devices 110 may provide an operating environment for the operation of one or more customer-specified virtual machines or other virtual instances (such as containers). In this example, one or more devices 110 may be alternatively referred to as host compute devices or more simply as hosts. Thus, network device 110 can run one or more virtual instances, such as virtual machines, containers, or other virtual runtime environments for running one or more services, such as virtual network functions (VNFs).

[0026] Typically, each network device 110 can be any type of device that operates on a network and can generate data (e.g., streaming datagrams, sFlow datagrams, NetFlow datagrams, etc.) accessible via telemetry or other means. It can include any type of computing device, sensor, camera, node, monitoring device, or other device. Further, some or all of the network devices 110 can represent components of another device, wherein the component can generate data collected via telemetry or other means. For example, some or all of the network devices 110 can represent physical or virtual network devices, such as switches, routers, hubs, gateways, security devices such as firewalls, intrusion detection systems, and / or intrusion prevention devices.

[0027] Data center 101 may include one or more non-edge switches, routers, hubs, gateways, security devices such as firewalls, intrusion detection and / or intrusion prevention devices, servers, computer terminals, laptops, printers, databases, wireless mobile devices such as cellular phones or personal digital assistants, wireless access points, bridges, cable modems, application accelerators, or other network devices. Switching infrastructure 121 can perform Layer 3 routing via service provider network 106 to route network traffic between data center 101 and customer 104. Gateway 108 is used to forward and receive packets between switching infrastructure 121 and service provider network 106.

[0028] Software-defined networking (“SDN”) controller 132 provides a logically (and in some cases physically) centralized controller for operating one or more virtual networks within data center 101, according to one or more examples of this disclosure. In some examples, SDN controller 132 operates in response to configuration input received from orchestration engine 130 via northbound API 131, and may further operate in response to configuration input received from administrator 128 who interacts with and / or operates user interface device 129.

[0029] User interface device 129 can be implemented as any suitable device for presenting output and / or accepting user input. For example, user interface device 129 may include a display. User interface device 129 can be a computing system, such as a mobile or non-mobile computing device operated by a user and / or an administrator 128. For example, user interface device 129 can represent a workstation, laptop or notebook computer, desktop computer, tablet computer, or any other computing device operated by a user and / or presenting a user interface according to one or more aspects of this disclosure. In some examples, user interface device 129 may be physically separate from controller 201 and / or located in a different location from controller 201. In this example, user interface device 129 may communicate with controller 201 via a network or other communication means. In other examples, user interface device 129 may be a local peripheral device of controller 201 or may be integrated into controller 201.

[0030] In some examples, orchestration engine 130 manages data center functions such as compute, storage, networking, and application resources. For instance, orchestration engine 130 can create virtual networks for tenants within data center 101 or across data centers. Orchestration engine 130 can attach virtual machines (VMs) to tenants' virtual networks. Orchestration engine 130 can connect tenants' virtual networks to external networks, such as the Internet or a VPN. Orchestration engine 130 can enforce security policies across VM groups or at the boundary of tenant networks. Orchestration engine 130 can deploy network services (e.g., load balancers) within tenants' virtual networks.

[0031] In some examples, SDN controller 132 manages network and network services such as load balancing and security, and can allocate resources from device 110, used as a host device, to various applications via southbound API 133. That is, southbound API 133 represents a set of communication protocols used by SDN controller 132 to ensure that the actual state of the network is equal to the desired state specified by orchestration engine 130. For example, SDN controller 132 can fulfill high-level requests from orchestration engine 130 by configuring physical switches (e.g., TOR switches, chassis switches, and switching fabric 121), physical routers, physical service nodes such as firewalls and load balancers, and virtual services such as virtual firewalls in VMs. SDN controller 132 maintains routing, physical, and configuration information within a state database.

[0032] Network analysis system 140 interacts with one or more devices 110 (and / or other devices) to collect streaming datagrams from data center 101 and / or network system 100. A streaming datagram is a datagram that includes data representing a flow of network traffic. For example, an agent operating within data center 101 and / or network system 100 can sample the flow of packets within data center 101 and / or network system 100 and encapsulate the sampled packets into streaming datagrams. The agent can forward the streaming datagrams to network analysis system 140, thereby enabling network analysis system 140 to collect the streaming datagrams.

[0033] According to one or more aspects of this disclosure, Figure 1A The network analysis system 140 can configure each device 110 to sample packets at adaptive sampling rates and generate streaming datagrams. For example, in the reference... Figure 1A In the described example, network analysis system 140 outputs signals to various devices 110. Each device 110 receives the signals and interprets them as commands to sample at a specified sampling rate and generate streaming datagrams (including sampled packets). Subsequently, as the data packets are processed by each device 110, each device 110 communicates streaming datagrams including the streaming data to network analysis system 140. Figure 1A In this example, other network devices, including those within switching fabric 121 (and not specifically shown), may also be configured to generate streaming datagrams. Network analysis system 140 receives the streaming datagrams.

[0034] Network analysis system 140 can store rule data about one or more applications. In this disclosure, "application" is a label used for a specific type of traffic data. In some examples, an application can be a general service, an internal service, or an external application. A general service can be identified based on calculations of ports and protocols. Examples of general services may include Transmission Control Protocol (TCP), port 80 with Hypertext Transfer Protocol (HTTP), port 443 with Hypertext Transfer Protocol Security (HTTPS), port 22 with Secure Shell (SSH), etc. An internal service can be a custom service deployed on a virtual machine (VM) or a set of VMs. An internal service can be identified by a combination of Internet Protocol (IP) address, port, protocol, and Virtual Network (VN). An external application can be a global service name related to traffic. An external application can be identified by a combination of port, IP address, Domain Name Service (DNS) domain, etc.

[0035] As described above, network analysis system 140 can receive a series of streaming data packets. Network analysis system 140 can use rule data about the application to identify the application-related streaming data packets within the series of streaming data packets.

[0036] When sampling flows, the processing resources of a network device such as network device 110A need to add flow headers (such as sFlow headers) and, after receiving samples from, for example, a packet forwarding engine (PFE), transmit the samples to a network analysis system (e.g., the flow collector of network analysis system 140). It may be desirable to ensure that the processing resource usage of the flow daemon does not affect other functions of network device 110A. A relatively low sampling rate can be used to avoid excessively burdening the processing resources of the network device. However, due to the relatively low sampling rate, network analysis system 140 may not be able to capture some flows.

[0037] Therefore, it may be desirable to determine the sampling rate of the interface of a network device such as network device 110A, i.e., without unduly burdening the processing capacity of network device 110A, but still allowing network analysis system 140 to receive samples from the various flows processed by the interface to obtain accurate statistics. For example, network analysis system 140 can send a command to network device 110A to sample the flows at an initial first sampling rate. In some examples, this initial first sampling rate may be relatively high to capture samples of the various flows processed by the interface of network device 110A. Network device 110A can send flow datagrams to network analysis system 140, including samples of the flows sampled at the initial sampling rate. Network analysis system 140 can determine a first parameter associated with the flow datagram. Network analysis system 140 can send a command to network device 110A to sample the flows at a lower second sampling rate. Network device 110A can send flow datagrams to network analysis system 140, including samples of the flows sampled at the second sampling rate. Network analysis system 140 can determine a second parameter associated with a flow datagram based on samples of the flow sampled at a second sampling rate. Network analysis system 140 can compare a first parameter with the second parameter and determine if the first parameter is substantially the same as the second parameter. If the first parameter is the same as or substantially the same as the second parameter (e.g., within a predetermined threshold of each other), network analysis system 140 can send a command to network device 110A to sample the flow of the interface at a still lower third sampling rate. Network analysis system 140 and network device 110A can recursively continue this process until the parameters are different or substantially different (e.g., beyond a predetermined threshold of each other), at which point network analysis system 140 can send a command to network device 110A to sample at a higher sampling rate.

[0038] For example, network analysis system 140 can send a command to network device 110A to sample flows at an initial first sampling rate. Network device 110A can send flow datagrams to network analysis system 140, including samples of flows sampled at the initial sampling rate. Network analysis system 140 can determine a first flow count based on the samples sampled at the first sampling rate. Network analysis system 140 can then send a command to network device 110A to sample flows at a lower second sampling rate. Network device 110A can send flow datagrams to network analysis system 140, including samples of flows sampled at the second sampling rate. Network analysis system 140 can determine a second flow count based on the samples sampled at the second sampling rate. Network analysis system 140 can compare the first flow count with the second flow count. If the first flow count is equal to or relatively equal to the second flow count (e.g., within a predetermined threshold between them), network analysis system 140 can send a command to network device 110A to sample the interface flows at an even lower third sampling rate. Network analysis system 140 and network device 110A can recursively continue this process until the determined number of flows is less or substantially less (e.g., beyond each other's predetermined thresholds). At this point, network analysis system 140 can send a command to network device 110A to sample at a higher sampling rate. In some examples, network analysis system 140 can periodically repeat this process via network device 110. In this way, network analysis system 140 can determine the appropriate sampling rate for any given interface of network device 110, thereby avoiding overloading the processing resources of the network device and keeping the device operating at a relatively optimal level even if the traffic patterns of the interface change.

[0039] In some examples, the network analysis system 140 can determine the maximum number of flows that the network analysis system 140 can handle, and the sampling rate can be further based on the maximum number of flows to avoid overloading the network analysis system 140.

[0040] In some examples, a particular interface of network device 110 may handle a relatively large number of flows, which could require a higher sampling rate than other interfaces to sample the individual flows processed by that particular interface. In such cases, a less aggressive approach can be used to reduce the sampling rate of these interfaces. For example, network analysis system 140 may receive samples of flows sampled at an initial first sampling rate from a second interface of network device 110A. Network analysis system 140 may determine the number of flows based on the samples. Network analysis system 140 may determine that the number of flows is greater than or equal to a predetermined threshold. Network analysis system 140 may determine a new fourth sampling rate based on the number of flows greater than or equal to the predetermined threshold and send a signal indicating the new fourth sampling rate to network device 110A. This new fourth sampling rate may be higher than the second sampling rate mentioned above. In this way, the network analysis system less aggressively reduces the sampling rate of the second interface that is processing a relatively large number of flows.

[0041] In some examples, a particular interface may be considered more important because it can handle traffic, i.e., more meaningful flows for the application's Quality of Experience (QoE). In this case, a less aggressive approach can be used to reduce the sampling rate of these particular interfaces. For example, network analysis system 140 can receive samples of flows sampled at an initial first sampling rate from a second interface of network device 110A. Network analysis system 140 can determine that the second interface is handling flows that are more meaningful for QoS than the first interface. For example, network analysis system 140 can perform deep packet inspection to determine that the second interface is handling flows that are more meaningful for QoS than the first interface. Network analysis system 140 can determine a new fourth sampling rate based on the fact that the second interface is handling flows that are more meaningful for QoS than the first interface, and send a signal indicating this new fourth sampling rate to network device 110A. This new fourth sampling rate may be higher than the second sampling rate mentioned above. In this way, the network analysis system less aggressively reduces the sampling rate of the second interface that is handling flows that are more meaningful for QoS than the first interface.

[0042] For example, network analysis system 140 can independently and dynamically adjust the sampling rate of each interface of network device 110 to identify the appropriate sampling rate for each interface. In some examples, network analysis system 140 can send commands to network devices (e.g., network device 110A) to maintain the sampling rate at an appropriate sampling rate for a given interface.

[0043] For example, the initial first sampling rate could be 1 packet out of every 100 packets. Network analysis system 140 can send a command to network device 110A to sample the flow at a rate of 1 packet out of every 100 packets. Network analysis system 140 can receive flow datagrams from network device 110 including samples of the flow sampled at a rate of 1 packet out of every 100 packets. Network analysis system 140 can determine the number of flows based on these samples. Then, network analysis system 140 can send a command to sample the flow at a lower sampling rate, such as 1 packet out of every 200 packets. Network analysis system 140 can receive flow datagrams from network device 110 including samples of the flow sampled at a rate of 1 packet out of every 200 packets. Network analysis system 140 can determine the number of flows based on these samples. Network analysis system 140 can compare the determined number of flows. If the determined number of flows is equal or relatively equal, the network analysis system 140 can continue to reduce the sampling rate, such as to 1 packet per 400 packets. This process can be repeated until the determined number of flows is not equal or substantially different, at which point the network analysis system 140 can send a command to increase the sampling rate. In some examples, when a suitable sampling rate is determined for a given interface, the network analysis system can stop applying adaptive sampling to that interface or apply adaptive sampling less frequently. Although the sampling rate discussed herein is based on the number of packets, in some examples, the sampling rate can be based on time, for example, 1 sample per tenth of a second.

[0044] Figure 1B This is a conceptual diagram illustrating exemplary components of a system for analyzing traffic flows between networks and / or within a data center, according to one or more aspects of this disclosure. Figure 1B Including combination Figure 1A The described multiple identical elements. Figure 1B The components shown can be used with Figure 1A The text appears to be a mix of Chinese characters and symbols, making it difficult to translate accurately. A more coherent translation would require the original, uncorrupted text. Figure 1A The reference numerals in the diagram correspond to the elements identified by similar designations. Typically, in some examples, although the element may involve alternative implementations with more, fewer, and / or different capabilities and properties, it can be combined with... Figure 1A The provided corresponding component description is consistent with the implementation of the similarly numbered component.

[0045] However, unlike Figure 1A , Figure 1BComponents of a network analysis system 140 are shown. The network analysis system 140 is shown as including a load balancer 141, a flow collector 142, a queue & event store 143, a topology & metric source 144, a data store 145, and a flow API 146. Typically, the network analysis system 140 and its components are designed and / or configured to ensure high availability and the ability to handle large volumes of streaming data. In some examples, multiple instances of the components of the network analysis system 140 can be orchestrated (e.g., by orchestration engine 130) to run on different physical servers to ensure that no single component of the network analysis system 140 has a single point of failure. In some examples, the network analysis system 140 or its components can be scaled independently and horizontally to achieve efficient and / or effective processing of desired traffic volumes (e.g., streaming data).

[0046] as Figure 1A , Figure 1B The network analysis system 140 can configure each device 110 to generate streaming datagrams at a specific sampling rate. For example, the network analysis system 140 can output signals to each device 110 to configure each device 110 to generate streaming datagrams, including streaming datagrams indicating underlying streaming data and overlaying streaming data. Then, one or more devices 110 can generate streaming datagrams and report them to the network analysis system 140.

[0047] exist Figure 1B In this system, the load balancer 141 of the network analysis system 140 receives flow datagrams from the device 110. The load balancer 141 can distribute flow datagrams across multiple flow collectors to ensure the active / active failover strategy of the flow collectors. In some examples, multiple load balancers 141 may be required to ensure high availability and scalability.

[0048] Flow collector 142 collects streaming datagrams from load balancer 141. For example, flow collector 142 of network analysis system 140 receives streaming datagrams from device 110 and processes them (after processing by load balancer 141). Flow collector 142 forwards upstream streaming datagrams to queue & event store 143. In some examples, flow collector 142 can address, process, and / or adapt unified datagrams of sFlow, NetFlow v9, IPFIX, jFlow, Contrail Flow, and other formats. Flow collector 142 is capable of parsing the internal headers (i.e., the headers of at least partially encapsulated packets) in sFlow datagrams and other streaming datagrams. Flow collector 142 is capable of processing message overflows, rich stream records with topology information (e.g., AppFormix topology information), and other types of messages and datagrams. Flow collector 142 is also capable of converting data into binary format before writing or forwarding it to queue & event store 143. The "sFlow" type of underlying stream data (referring to "sampled stream") is a layer 2 packet export standard of the OSI model. It provides a way to export truncated packets together with interface counters for network monitoring purposes.

[0049] According to the technology disclosed herein, flow collector 142 can receive a first sample of a flow sampled at a first sampling rate from an interface of network device 110A. Flow collector 142 can determine a first parameter based on the first sample. Flow collector 142 can receive a second sample of a flow sampled at a second sampling rate, wherein the second sampling rate is different from the first sampling rate. Flow collector 142 can determine a second parameter based on the second sample. Flow collector 142 can determine a third sampling rate based on the first and second parameters. Flow collector 142 can send a signal indicating the third sampling rate to the network device. Flow collector 142 can receive a third sample of a flow sampled at the third sampling rate from the interface.

[0050] The queue & event store 143 can receive data from one or more stream collectors 142, store data, and make data available for ingestion in the data store 145. In some examples, this allows the task of receiving and storing large amounts of data to be separated from the task of indexing the data and preparing it for analytical queries. In some examples, the queue & event store 143 also allows individual users to directly consume the stream record. In some examples, the queue & event store 143 can be used to detect anomalies and generate real-time alerts. In some examples, streaming data can be parsed by reading encapsulated packets, including VXLAN, UDP MPLS, and GRE MPLS.

[0051] Topology & metric source 144 can enrich or augment datagrams using topology and / or metric information. For example, topology & metric source 144 can provide network topology metadata, which may include identified nodes or network devices, configuration information, configurations, established links, and other information about the node and / or network device. In some examples, topology & metric source 144 may use AppFormix topology data or may be a running AppFormix module. Information received from topology & metric source 144 can be used to enrich the flow datagrams collected by flow collector 142 and support the flow API 146 when processing queries on data store 145.

[0052] Data storage 145 can be configured to store indexed data (such as datagrams) received from queue & event storage 143 and topology & metric source 144, thereby enabling fast aggregate queries and fast random access data retrieval. In some examples, data storage 145 can achieve fault tolerance and high availability by sharing and replicating data.

[0053] Streaming API 146 can process query requests transmitted by one or more user interface devices 129. For example, in some examples, Streaming API 146 may receive query requests from user interface devices 129 via HTTP POST requests. In this example, Streaming API 146 transforms the information included in the request into a query for data storage 145. To create the query, Streaming API 146 may use topology information from topology & metric source 144. Streaming API 146 may use one or more of these queries to perform analysis on behalf of user interface devices 129. This analysis may include traffic deduplication, overlay-underlying correlation, traffic path identification, and / or heatmap traffic calculation. Specifically, the analysis may involve associating underlying flow data with overlay flow data, thereby identifying which underlying network devices are associated with throughput quantities flowing through virtual networks and / or between two virtual machines. Using techniques according to one or more aspects of this disclosure, network analysis system 140 is able to correlate data flows with applications in a data center, such as a multi-tenant data center.

[0054] Figure 2 This is a block diagram illustrating an exemplary network analysis system according to one or more aspects of this disclosure.

[0055] The network analysis system 140 can be implemented as any suitable computing system, such as one or more server computers, workstations, hosts, devices, cloud computing systems, and / or other computing systems capable of performing the operations and / or functions described in one or more aspects of this disclosure. In some examples, the network analysis system 140 represents a cloud computing system, server farm, and / or server cluster (or a portion thereof) that provides services to client devices and other devices or systems. In other examples, the network analysis system 140 may represent one or more virtual computing instances (e.g., virtual machines, containers) of a data center, cloud computing system, server farm, and / or server cluster, or may be implemented through one or more virtual computing instances (e.g., virtual machines, containers) of a data center, cloud computing system, server farm, and / or server cluster.

[0056] exist Figure 2 In one example, network analysis system 140 may include a power supply 241, processing circuitry 243, one or more communication units 245, one or more input devices 246, one or more output devices 247, and one or more storage devices 250. The one or more storage devices 250 may include one or more collector modules 252, a command interface module 254, an API server 156, and a stream database 259. In some examples, network analysis system 140 may include additional components, fewer components, or different components.

[0057] One or more devices, modules, storage areas, or other components in the network analysis system 140 can be interconnected to enable communication between components (physically, communicatively, and / or operationally). In some examples, this connectivity may be provided via a communication channel (e.g., communication channel 242), a system bus, a network connection, an inter-process communication data structure, or any other method for communicating data.

[0058] Power supply 241 can provide power to one or more components in network analysis system 140. Power supply 241 may receive power from a primary alternating current (AC) power source at a data center, building, residence, or other location. In other examples, power supply 241 may be a battery or a device that supplies direct current (DC). In yet another example, network analysis system 140 and / or power supply 241 may receive power from another power source. One or more devices or components shown within network analysis system 140 may be connected to power supply 241 and / or may receive power from power supply 241. Power supply 241 may have intelligent power management or consumption capabilities, and this feature may be controlled, accessed, or adjusted by one or more modules in network analysis system 140 and / or by processing circuitry 243 to intelligently consume, distribute, supply, or otherwise manage power.

[0059] The processing circuitry 243 of the network analysis system 140 can implement and / or execute functions and / or instructions associated with the network analysis system 140 or with one or more modules shown and / or described herein. The processing circuitry 243 may be, may include, or may form part of processing circuitry that performs operations according to one or more aspects of this disclosure. Examples of the processing circuitry 243 include a microprocessor, application processor, display controller, auxiliary processor, one or more sensor hubs, and any other hardware configured to function as a processor, processing unit, or processing device. The network analysis system 140 may utilize the processing circuitry 243 to perform operations according to one or more aspects of this disclosure using software, hardware, firmware, or a mixture of hardware, software, and firmware residing in and / or running in the network analysis system 140.

[0060] For example, processing circuitry 243 can receive a first sample of a stream sampled at a first sampling rate from an interface of another network device (e.g., network device 110A). Processing circuitry 243 can determine a first parameter based on the first sample. For example, processing circuitry 243 can count the number of first streams based on the first sample. In some examples, processing circuitry 243 can control one or more communication units 245 to send a signal indicating a second sampling rate to network device 110A. Processing circuitry 243 can receive a second sample of a stream sampled at a second sampling rate from an interface, wherein the second sampling rate is different from the first sampling rate. Processing circuitry 243 can determine a second parameter based on the second sample. For example, processing circuitry 243 can count the number of second streams based on the second sample. Processing circuitry 243 can determine a third sampling rate based on the first and second parameters. For example, if the first and second parameters are substantially the same, the processing circuitry can determine a third sampling rate lower than the first and second sampling rates. If the first and second parameters are substantially different, processing circuitry 243 can determine a third sampling rate higher than the second sampling rate. Processing circuitry 243 can control one or more communication units 245 to send a signal indicating a third sampling rate to network device 110A. Processing circuitry 243 can receive a third sample of the stream sampled at the third sampling rate from the interface.

[0061] One or more communication units 245 of the network analysis system 140 can communicate with devices located outside the network analysis system 140 by sending and / or receiving data, and in some respects can operate as both input and output devices. For example, one or more communication units 245 can send signals indicating various sampling rates to network devices, such as network device 210. One or more communication units 245 can also receive datagrams comprising samples of packets sampled at various sampling rates.

[0062] In some examples, one or more communication units 245 can communicate with other devices via a network. In other examples, one or more communication units 245 can transmit and / or receive radio signals via a radio network such as a cellular radio network. Examples of one or more communication units 245 include network interface cards (e.g., such as Ethernet cards), optical transceivers, radio frequency transceivers, GPS receivers, or any other type of device capable of transmitting and / or receiving information. Other examples of communication units 245 may include those found in mobile devices and Universal Serial Bus (USB) controllers, etc. GPS, NFC, ZigBee, and cellular networks (e.g., 3G, 4G, 5G), and A device that communicates via radio. This communication may follow, implement, or comply with appropriate protocols, including Transmission Control Protocol / Internet Protocol (TCP / IP), Ethernet, Bluetooth, NFC, or other technologies or protocols.

[0063] One or more input devices 246 may represent any input device of the network analysis system 140 not otherwise described separately herein. One or more input devices 246 may generate, receive, and / or process input from any type of device capable of detecting human or machine input. For example, one or more input devices 246 may generate, receive, and / or process input in the form of electrical, physical, audio, image, and / or visual input (e.g., peripherals, keyboards, microphones, cameras).

[0064] One or more output devices 247 may represent any output device of the network analysis system 140 that is not otherwise separately described herein. One or more output devices 247 may generate, receive, and / or process input from any type of device capable of detecting human or machine input. For example, one or more output devices 247 may generate, receive, and / or process output in the form of electrical and / or physical outputs (e.g., peripheral devices, actuators).

[0065] One or more storage devices 250 within the network analysis system 140 may store information for processing during the operation of the network analysis system 140. One or more storage devices 250 may store program instructions and / or data associated with one or more modules described according to one or more aspects of this disclosure. Processing circuitry 243 and one or more storage devices 250 may provide an operating environment or platform for the module, which may be implemented as software; however, in some examples, it may include any combination of hardware, firmware, and software. Processing circuitry 243 may execute instructions, and one or more storage devices 250 may store instructions and / or data of one or more modules. The combination of processing circuitry 243 and one or more storage devices 250 may retrieve, store, and / or execute instructions and / or data of one or more applications, modules, or software. Processing circuitry 243 and / or one or more storage devices 250 may also be operatively coupled to one or more other software and / or hardware components, including but not limited to one or more components of the network analysis system 140 and / or one or more devices or systems shown as connected to the network analysis system 140.

[0066] In some examples, one or more storage devices 250 are implemented as temporary memory, meaning that the primary purpose of the one or more storage devices is not long-term storage. One or more storage devices 250 of the network analysis system 140 can be configured as volatile memory for short-term storage of information, and therefore, if deactivated, the stored content is not retained. Examples of volatile memory include random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), and other forms of volatile memory known in the art. In some examples, one or more storage devices 250 also include one or more computer-readable storage media. One or more storage devices 250 can be configured to store a larger amount of information than volatile memory. One or more storage devices 250 can be further configured to store information long-term as non-volatile memory space and retain the information after an activation / deactivation cycle. Examples of non-volatile memory include magnetic hard disks, optical disks, flash memory, or electrically erasable memory (EPROM) or electrically erasable and programmable (EEPROM) memory.

[0067] Collector module 252 can perform functions related to: receiving streaming datagrams; determining parameters associated with the sampled stream, such as the number of streams sampled at a given sampling rate; and performing load balancing as needed to ensure high availability, throughput, and scalability for collecting the streaming data while processing circuitry 243 is executing. Collector module 252 can process the data and prepare it for storage in streaming database 259. In some examples, collector module 252 can store streaming data in streaming database 259.

[0068] Command interface module 254 can perform functions related to generating a user interface for presenting the results of an analysis query performed by API server 256, when executed by processing circuitry 243. In some examples, command interface module 254 can generate enough information to generate a set of user interfaces.

[0069] API server 256 can execute analytical queries involving data stored in streaming database 259 derived from a collection of streaming datagrams. In some examples, API server 256 can receive requests in the form of information derived from HTTP POST requests and, in response, can translate the requests into queries to be executed on streaming database 259. Further, in some examples, API server 256 can obtain topology information related to network device 110A and perform analyses including data deduplication, overlay-bottom layer correlation, traffic path identification, and heatmap traffic calculation.

[0070] The streaming database 259 can represent any suitable data structure or storage medium for storing information related to data streams, including the storage of streaming datagrams. The streaming database 259 can store data in an indexed format, enabling fast data retrieval and execution of queries. The information stored in the streaming database 259 is searchable and / or categorized, allowing one or more modules within the network analysis system 140 to provide input requesting information from the streaming database 259 and, in response to input, receive information stored within the streaming database 259. The streaming database 259 is primarily maintained by the collector module 252. The streaming database 259 can be implemented using multiple hardware devices and can achieve fault tolerance and high availability through data sharing and replication. In some examples, the streaming database 259 can be implemented using the open-source ClickHouse column-oriented database management system.

[0071] For example, the command interface module 254 of the network analysis system 140 can receive queries from the user interface device 129. Figures 1A to 1BThe communication unit 245 of the network analysis system 140 detects signals and provides information to the command interface module 254, which then provides a query to the API server 256 based on the provided information. The query may be a request for information about the network system 100 within a given time window. The API server 256 processes queries about data in the flow database 259. For example, a user of the user interface device 129 (e.g., an administrator 128) may want to determine which network devices 110 are involved in a flow associated with a specific application. API 146 ( Figure 1B It can be operated in the same way as API server 256.

[0072] The network analysis system 140 can cause a user interface to be displayed on the user interface device 129 based on query results. For example, the API server 256 can output information about the query results to the command interface module 254. In this example, the command interface module 254 uses the information from the API server 256 to generate data sufficient to create a user interface. Further, in this example, the command interface module 254 causes one or more communication units 245 to output signals. In this example, the user interface device 129 detects the signals and generates a user interface based on the signals. The user interface device 129 displays the user interface on a display associated with the user interface device 129.

[0073] Figure 2 The modules shown and / or described herein or elsewhere (collector module 252, command interface module 254, API server 256) can perform operations described using software, hardware, firmware, or a mixture of hardware, software, and firmware residing in and / or executing on one or more computing devices. For example, the computing device may utilize multiple processors or multiple devices to run one or more of these modules. The computing device may run one or more of these modules as a virtual machine running on the underlying hardware. One or more of these modules may run as one or more services in an operating system or computing platform. One or more of these modules may run as one or more executable programs in the application layer of a computing platform. In other examples, the functionality provided by the modules may be implemented through dedicated hardware devices.

[0074] While specific modules, data stores, components, programs, executables, data items, functional units, and / or other items included within one or more storage devices may be shown individually, one or more of these items may be combined and operate as a single module, component, program, executable, data item, or functional unit. For example, one or more modules or data stores may be combined or partially combined, and thus operate or provide functionality as a single module. Furthermore, one or more modules may interact with each other and / or operate in combination with each other; thus, for example, one module may serve as a service or an extension of another module. Additionally, the various modules, data stores, components, programs, executables, data items, functional units, or other items shown within the storage device may include multiple components, subcomponents, modules, submodules, data stores, and / or other components or modules or data stores not shown.

[0075] Furthermore, the various modules, data stores, components, programs, executables, data items, functional units, or other items shown within the storage device can be implemented in various ways. For example, the various modules, data stores, components, programs, executables, data items, functional units, or other items shown within the storage device can be implemented as downloadable or pre-installed applications or "apps." In other examples, the various modules, data stores, components, programs, executables, data items, functional units, or other items shown within the storage device can be implemented as part of an operating system running on a computing device.

[0076] Figure 3 This is a block diagram illustrating an exemplary network device according to one or more aspects of this disclosure. In some examples, network device 110A may be an example of a TOR switch or a chassis switch.

[0077] exist Figure 3In the illustrative examples, network device 110A includes a control unit 32, which in some examples provides control plane functionality for network device 110A. Control unit 32 may include processing circuitry 40, a routing engine 42 including routing information 44 and resource modules 46, software plug-in 48, hypervisor 50, and VMs 52A–52N (collectively, “VM 52”). In some examples, processing circuitry 40 may include one or more processors configured to implement and / or process functions and / or instructions for execution within control unit 32. For example, processing circuitry 40 may be capable of processing instructions stored in a storage device. For example, processing circuitry 40 may include a microprocessor, DSP, ASIC, FPGA, or equivalent discrete or integrated logic circuitry, or a combination of any of the foregoing devices or circuitry. Accordingly, processing circuitry 40 may include any suitable structure, whether hardware, software, firmware, or any combination thereof, to perform the functions attributable to processing circuitry 40 herein.

[0078] In some cases, processing circuitry 40 may include a set of compute nodes. A compute node may be a component of a central processing unit (CPU) that receives information, outputs information, performs computations, performs actions, manipulates data, or any combination thereof. Furthermore, in some examples, a compute node may include temporary storage, a network, memory, and processing resources, containers, container pools, or other types of workloads for running one or more VMs. Thus, a compute node can represent compute resources used to run workloads. A compute node used to run a workload may be referred to herein as a "used compute node." Furthermore, a compute node not used to run a workload may be referred to herein as an "unused compute node." Therefore, if processing circuitry 40 includes a relatively large number of unused compute nodes, processing circuitry 40 may have a relatively large number of compute resources available for running workloads, and if processing circuitry 40 includes a relatively small number of unused compute nodes, processing circuitry 40 may have a relatively small number of compute resources available for running workloads.

[0079] Processing circuit 40 can sample the flow processed by network device 110A and can create flow datagrams that include sampled packets of the flow. This sampling and creation of flow datagrams utilizes the processing resources of processing circuit 40. By adaptively changing the sampling rate, the techniques of this disclosure can balance the use of processing resources of processing circuit 40 with the monitoring of flows by flow collector 142.

[0080] In some examples, the amount of available computing resources in control unit 32 depends on the network device 110A. Figure 1A and Figure 1BThe role within data center 101. For example, if network device 110A represents the master switch of a logical switch, it may occupy a significant amount of computing resources within processing circuitry 40 to provide control plane functions to the individual switches within the logical switch (e.g., individual network devices 110B-110N). Therefore, if network device 110A represents a line card, it may occupy fewer computing resources within processing circuitry 40 compared to the case where network device 110A represents the master switch, because the line card can receive control plane functions from the master switch.

[0081] In some examples where the control unit 32 provides control plane functionality to network device 110A and / or other network devices, the control unit 32 includes components configured to communicate with... Figure 2 The routing engine 42 communicates with the forwarding unit 60 and other forwarding units of the network device (not shown). In some cases, where the network device is part of a logical switch, the routing engine 42 may represent control plane management of packet forwarding throughout the network device. For example, network device 110A includes interface cards 70A-70N (collectively referred to as "IFC 70") that receive packets via inbound links and transmit packets via outbound links. IFC 70 typically has one or more physical network interface ports. In some examples, each network interface port (also referred to herein as an interface) may be sampled at a sampling rate independently determined by the flow collector 142 based on a comparison of parameters associated with sampling at different sampling rates, the number of flows being processed by the interface, and / or whether the flow being processed by the interface is more meaningful for QoS than another interface. In some examples, after receiving a packet via IFC 70, network device 110A uses forwarding unit 60 to forward the packet to the next destination based on the operation performed by routing engine 42.

[0082] Routing engine 42 can support various protocols executed at different layers of the network stack. Figure 2 (Not shown in the image) provides the operating environment. The routing engine 42 can be responsible for maintaining the routing information 44 to reflect the current topology of the network and other network entities connected to the network device 110A. Specifically, the routing protocol periodically updates the routing information 44 based on routing protocol messages received by the network device 110A to accurately reflect the topology of the network and other entities. The protocol can be a software process running on the processing circuitry 40. Thus, the routing engine 42 can occupy a set of computing nodes in the processing circuitry 40 so that this set of computing nodes cannot be used to run VMs. For example, the routing engine 42 may include a bridging port extension protocol such as IEEE 802.1BR. The routing engine 42 may also include network protocols that operate at the network layer of the network stack. Figure 2In some examples, the network protocol may include one or more control and routing protocols, such as Border Gateway Protocol (BGP), Interior Gateway Protocol (IGP), Label Distribution Protocol (LDP), and / or Resource Reservation Protocol (RSVP). In some examples, the IGP may include Open Shortest Path First (OSPF) or Intermediate System to Intermediate System (IS-IS) protocol. The routing engine 42 may also include one or more daemons, including user-level processes that run network management software, execute routing protocols to communicate with peer routers or switches, maintain and update one or more routing tables, create one or more forwarding tables for installation into the forwarding unit 60, and perform other functions.

[0083] For example, routing information 44 may include routing data describing various routes within the network, and corresponding next-hop data for each route instructing appropriate neighboring devices within the network. Network device 110A updates routing information 44 based on received advertisements to accurately reflect the network topology. Based on routing information 44, routing engine 42 can generate forwarding information (…). Figure 2 (Not shown in the image) and installs the forwarding data structure into the forwarding information within the forwarding unit 60. The forwarding information associates the network destination with the specified next hop and the corresponding interface port within the forwarding plane. Furthermore, the routing engine 42 may include one or more resource modules 46 for configuring resources of extended ports and uplink ports on satellite equipment interconnected with network device 110A. Resource modules 46 may include a scheduler module for configuring Quality of Service (QoS) policies, a firewall module for configuring firewall policies, or other modules for configuring resources of network devices.

[0084] In some examples, processing circuitry 40 runs software plug-in 48 and hypervisor 50. In some examples, software plug-in 48 enables network device 110A to communicate with orchestration engine 130. Software plug-in 48 can be configured to interface with lightweight message broker and hypervisor 50, such that software plug-in 48 acts as an intermediary between orchestration engine 130 and hypervisor 50, whereby orchestration engine 130 outputs instructions to manage VM 52, and hypervisor 50 is configured to implement instructions received from orchestration engine 130.

[0085] Software plugin 48 can interface with lightweight message brokers such as RabbitMQ to exchange messages with orchestration engine 130. Therefore, the software plugin can implement any combination of AMQP, STOMP, MQTT, and HTTP. Software plugin 48 can be configured to generate and process messages sent via the lightweight message broker.

[0086] In some cases, hypervisor 50 can be configured to communicate with software plug-in 48 to manage the lifecycle of VM 52. In some examples, hypervisor 50 represents a Kernel-based Virtual Machine (KVM) hypervisor, or a special operating mode that allows the Linux Kernel to be used as a Quick Emulator (QEMU) for the hypervisor. Hypervisor 50 can perform hardware-assisted virtualization, thereby creating virtual machines that emulate the functionality of computer hardware when running the appropriate virtual machine on the compute node using processing circuitry 40. Hypervisor 50 can interface with software plug-in 48.

[0087] Forwarding unit 60 represents the hardware and logic functions that provide high-speed forwarding of network traffic. In some examples, forwarding unit 60 can be implemented as a programmable forwarding plane. Forwarding unit 60 may include one or more sets of forwarding chips programmed with forwarding information that maps network destinations using specified next hops and corresponding output interface ports. In some examples, forwarding unit 60 includes forwarding information. Based on routing information 44, forwarding unit 60 maintains forwarding information that associates network destinations with specified next hops and corresponding interface ports. For example, routing engine 42 can analyze routing information 44 and generate forwarding information based on routing information 44. Forwarding information can be maintained in the form of one or more tables, link lists, cardinality trees, databases, flat files, or any other data structure. Although... Figure 2 Although not shown in the diagram, forwarding unit 60 may include a CPU, memory, and one or more ASICs.

[0088] This is shown for illustrative purposes only. Figure 2 The architecture of network device 110A is shown. This disclosure is not limited to this architecture. In other examples, network device 110A can be configured in various ways. In one example, some functions of routing engine 42 and forwarding unit 60 can be distributed within IFC 70.

[0089] Elements in control unit 32 may be implemented solely in software or hardware, or may be implemented as a combination of software, hardware, or firmware. For example, control unit 32 may include one or more processors, one or more microprocessors, DSPs, ASICs, FPGAs, or any other equivalent integrated or discrete logic circuitry, or any combination thereof, that execute software instructions. In this case, the various software modules of control unit 32 may include executable instructions stored, embedded, or encoded in a computer-readable medium, such as a computer-readable storage medium containing the instructions. For example, when the instructions are executed, the instructions embedded or encoded in the computer-readable medium may cause a programmable processor or other processor to perform a method. Computer-readable storage media may include random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), non-volatile random access memory (NVRAM), flash memory, hard disk, CD-ROM, floppy disk, magnetic tape, solid-state drive, magnetic media, optical media, or other computer-readable media. Computer-readable media, such as protocols, can be encoded using instructions corresponding to various aspects of the network device 110A. In some examples, the control unit 32 retrieves instructions from memory and executes them for these aspects.

[0090] Figure 4 This is a flowchart illustrating an exemplary method according to one or more techniques of this disclosure. Network Analysis System 140 ( Figure 2 The processing circuit 243 of network device 110A can receive a first sample (400) of a stream sampled at a first sampling rate from the interface of another network device. For example, the processing circuit 40 of network device 110A ( Figure 3 It can be sampled at the first sampling rate for IFC 70A ( Figure 3 The processing circuit 243 samples the stream being processed, creates a first datagram including the sample, and forwards the first datagram to the network analysis system 140 that receives the first sample in the first datagram. The processing circuit 243 can determine a first parameter (402) based on the first sample. For example, the processing circuit 243 can count the number of first streams in the first sample to determine the first parameter.

[0091] Processing circuit 243 can receive a second sample (404) of a stream sampled at a second sampling rate, which is different from the first sampling rate, from the interface. For example, processing circuit 40 can sample the stream being processed by IFC 70A at the second sampling rate, create a second datagram including the second sample, and forward the second datagram to network analysis system 140 that receives the second sample in the second datagram. Processing circuit 243 can determine a second parameter (406) based on the second sample. For example, processing circuit 243 can count the number of second streams in the second sample to determine the second parameter.

[0092] Processing circuit 243 can determine a third sampling rate (408) based on the first parameter and the second parameter. The third sampling rate can be different from the second sampling rate (e.g., higher or lower). For example, processing circuit 243 can compare the first parameter (e.g., the number of first streams) with the second parameter (e.g., the number of second streams) to determine whether the first parameter is equal to the second parameter or whether the first parameter is within a predetermined threshold of the second parameter. For example, if the first parameter is equal to the second parameter or within the predetermined threshold of the second parameter, processing circuit 243 can determine that the third sampling rate is a lower sampling rate than the second sampling rate. If the first parameter is not equal to the second parameter or is not within the predetermined threshold of the second parameter, processing circuit 243 can determine that the third sampling rate is a higher sampling rate than the second sampling rate; for example, the third sampling rate can be equal to the first sampling rate or can be a sampling rate between the second and first sampling rates.

[0093] Processing circuitry 243 can control one or more communication units 245 to send a signal indicating a third sampling rate to another network device (410). For example, network management system 140 can instruct network device 110A to sample IFC 70A at a third sampling rate. Processing circuitry 243 can receive a third sample (412) of the stream sampled at the third sampling rate from the interface. For example, processing circuitry 40 can sample the stream being processed by IFC 70A at the third sampling rate, create a third datagram including the third sample, and forward the third datagram to network management system 140 that receives the third sample.

[0094] In some examples, the first parameter refers to the number of first flows and the second parameter refers to the number of second flows. In some examples, IFC 70A is the first interface, and network management system 140 can receive a fourth sample of a flow sampled at a first sampling rate from a second interface (e.g., IFC 70B). Network management system 140 can determine a third flow number based on the fourth sample. Network management system 140 can determine that the third flow number is greater than or equal to a predetermined threshold. Network management system 140 can determine a fourth sampling rate based on the third flow number greater than or equal to the predetermined threshold. Network management system 140 can send a signal indicating the fourth sampling rate to network device 110A, wherein the fourth sampling rate is higher than the second sampling rate. Network management system 140 can receive a fifth sample of a flow sampled at the fourth sampling rate from the second interface.

[0095] In some examples, IFC 70A is the first interface, and network management system 140 can receive a fourth sample of the stream sampled at the first sampling rate from a second interface (e.g., IFC 70B). Network management system 140 can determine that the second interface is processing a stream that is more meaningful in terms of experience quality than the first interface. Network management system 140 can determine the fourth sampling rate based on the fact that the second interface is processing a stream that is more meaningful in terms of experience quality than the first interface. Network management system 140 can send a signal indicating the fourth sampling rate to network device 110A, wherein the fourth sampling rate is higher than the second sampling rate. Network management system 140 can receive a fifth sample of the stream sampled at the fourth sampling rate from the second interface.

[0096] In some examples, the first number of flows is equal to or within a predetermined threshold of the second number of flows, and the third sampling rate is lower than the second sampling rate. In some examples, the predetermined threshold is static or based on the number of flows determined at one of a plurality of sampling rates. For example, the predetermined threshold can be the number of flows or a percentage of the number of flows determined at a certain sampling rate, such as the second sampling rate. The predetermined threshold can be a user-configured value or determined based on device capabilities or device roles. When determined based on device capabilities, more powerful devices can have relatively higher thresholds than less powerful devices. When determined based on device roles, various device roles such as server blades, boundary leads, gateways, spines, etc., can have predetermined corresponding thresholds.

[0097] In some examples, the first sampling rate is higher than the second sampling rate, the first number of streams is greater than the second number of streams, and the third sampling rate is higher than the second sampling rate. In some examples, the third sampling rate is equal to the first sampling rate.

[0098] In some examples, the first, second, and third samples are sFlow samples. In some examples, the network management system 140 can repeat this process periodically. Figure 4 The technology in it.

[0099] For the processes, apparatuses, and other examples or illustrations included in any flowchart or diagram described herein, specific operations, actions, steps, or events included in any technology described herein may be performed in a different order, may be added, combined, or may be omitted entirely (e.g., not all described actions or events are necessary for implementation of this technology). Moreover, in certain examples, for example, operations, actions, steps, or events may be performed by multithreading, interrupt handling, or simultaneous execution by multiple processors, rather than sequentially. Further specific operations, actions, steps, or events may be performed automatically, even if not specifically identified as automatic execution. Furthermore, alternatively, specific operations, actions, steps, or events described as automatically executed may not be performed automatically; rather, in some examples, the operation, action, step, or event may be performed in response to input or another event.

[0100] The figures included herein each illustrate at least one exemplary implementation of an aspect of this disclosure. However, the scope of this disclosure is not limited to these implementations. Accordingly, in addition to those shown in the figures, other examples or alternative implementations of the systems, methods, or techniques described herein may be appropriate in other instances. Such implementations may include a subset of the devices and / or components included in the figures and / or may include additional devices and / or components not shown in the figures.

[0101] The detailed descriptions presented above are intended as a description of various configurations and are not intended to represent the only configuration in which the concepts described herein can be implemented. The detailed descriptions include specific details for the purpose of providing a full understanding of the various concepts. However, these concepts can be implemented without these specific details. In some instances, well-known structures and components are shown in block diagram form in the reference figures to avoid obscuring the concepts.

[0102] Accordingly, while specific diagrams may be used to describe one or more implementations of various systems, devices, and / or components, these systems, devices, and / or components can be implemented in many different ways. For example, one or more devices shown as independent devices in the diagrams here may alternatively be implemented as a single device; one or more components shown as independent components may alternatively be implemented as a single component. Furthermore, in some examples, one or more devices shown as single devices in the diagrams here may alternatively be implemented as multiple devices; one or more components shown as single components may alternatively be implemented as multiple components. Each of these multiple devices and / or components may be directly coupled via wired or wireless communication and / or remotely coupled via one or more networks. Additionally, one or more devices or components shown in the various diagrams here may alternatively be implemented as part of another device or component not shown in the diagram. Thus, and in other ways, two or more devices or components may perform some of the functions described herein via distributed processing.

[0103] Furthermore, specific operations, techniques, features, and / or functions may be described herein as being performed by specific components, devices, and / or modules. In other examples, the operation, technique, feature, and / or function may be performed by different components, devices, or modules. Accordingly, in other examples, even if not specifically described in this manner herein, some operations, techniques, features, and / or functions described herein as belonging to one or more components, devices, or modules may belong to other components, devices, and / or modules.

[0104] Although specific advantages have been identified in conjunction with the description of some examples, various other examples may include, exclude, or include all of the listed advantages. Other technical or other advantages may become apparent to those skilled in the art in this disclosure. Furthermore, although specific examples have been disclosed herein, any number of techniques, whether currently known or not, can be used to implement aspects of this disclosure, and accordingly, this disclosure is not limited to the examples specifically described and / or shown herein.

[0105] In one or more examples, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored as one or more instructions or code on a computer-readable medium and / or transmitted via a computer-readable medium and executed by a hardware-based processing unit. A computer-readable medium may include a computer-readable storage medium (as opposed to a temporary medium such as a data storage medium) or a communication medium that includes any medium facilitating the transfer of a computer program from one place to another (e.g., according to a communication protocol). Thus, a computer-readable medium may generally correspond to: (1) a tangible computer-readable storage medium, i.e., non-temporary; or (2) a communication medium such as a signal or carrier wave. A data storage medium may be any available medium accessible to one or more computers or one or more processors for retrieving instructions, code, and / or data structures for implementing the techniques described in this disclosure. A computer program product may include a computer-readable medium.

[0106] For example, and not limited to, the computer-readable storage medium may include RAM, ROM, EEPROM, CD-ROM, or other optical disc storage, magnetic disk storage, or other magnetic storage devices, flash memory, or any other medium capable of storing instruction or data structure form and required program code accessible to a computer. Furthermore, any connection is appropriately defined as a computer-readable medium. For example, if instructions are transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, the definition of medium includes coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave. However, it should be understood that computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other transient media, but instead refer to non-transient tangible storage media. The disks and optical discs used include compact discs (CDs), laser discs, optical discs, digital universal discs (DVDs), floppy disks, and Blu-ray discs, wherein disks typically reproduce data magnetically, while optical discs utilize lasers to reproduce data optically. The above combinations should also be included within the scope of computer-readable media.

[0107] Instructions can be executed by one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field-programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Accordingly, the terms "processor" or "processing circuit" as used herein can each refer to any of the foregoing structures or any other structures suitable for implementing the described techniques. Furthermore, in some examples, the described functionality can be provided within dedicated hardware and / or software modules. Additionally, the techniques can be implemented entirely within one or more circuit or logic elements.

[0108] The techniques of this disclosure can be implemented in a wide variety of devices or apparatuses, including wireless mobile phones, mobile or non-mobile computing devices, wearable or non-wearable computing devices, integrated circuits (ICs) or IC sets (e.g., chipsets). In this disclosure, various components, modules, or units are described as aspects that enhance the functionality of a device configured to perform the disclosed techniques; however, they are not necessarily required to be implemented by different hardware units. Specifically, as described above, various units can be combined within hardware units or provided as a collection of interoperable hardware units combined with suitable software and / or firmware, including one or more processors as described above.

[0109] In addition, this technology can be configured as follows.

[0110] (1) A method for flow monitoring, the method comprising:

[0111] Receive the first sample of the stream sampled at a first sampling rate from the interface of the network device;

[0112] The first parameter is determined based on the first sample;

[0113] Receive a second sample of the stream sampled at a second sampling rate from the interface, wherein the second sampling rate is different from the first sampling rate;

[0114] The second parameter is determined based on the second sample;

[0115] The third sampling rate is determined based on the first parameter and the second parameter;

[0116] The signal indicating the third sampling rate is sent to the network device; and

[0117] (2) Receive a third sample of the stream sampled at the third sampling rate from the interface. (1) The method according to (1), wherein the first parameter refers to the number of the first stream, and its

[0118] In this context, the second parameter refers to the number of second streams.

[0119] (3) The method according to (2), wherein the interface is a first interface, and the method further includes:

[0120] Receive a fourth sample of the stream sampled at the first sampling rate from the second interface of the network device;

[0121] The quantity of the third stream is determined based on the fourth sample;

[0122] The number of the third stream is determined to be greater than or equal to a predetermined threshold;

[0123] The fourth sampling rate is determined based on the number of third streams that is greater than or equal to the predetermined threshold;

[0124] The signal indicating the fourth sampling rate is sent to the network device, wherein...

[0125] The fourth sampling rate is higher than the second sampling rate; and

[0126] Receive a fifth sample of the stream sampled at the fourth sampling rate from the second interface.

[0127] (4) The method according to (2), wherein the interface is a first interface, and the method further includes:

[0128] Receive a fourth sample of the stream sampled at the first sampling rate from the second interface of the network device;

[0129] Determine that the second interface is processing a stream that is more meaningful in terms of experience quality than the first interface;

[0130] The fourth sampling rate is determined based on the fact that the second interface is processing a stream that is more meaningful in terms of experience quality than the first interface.

[0131] The signal indicating the fourth sampling rate is sent to the network device, wherein...

[0132] The fourth sampling rate is higher than the second sampling rate; and

[0133] Receive a fifth sample of the stream sampled at the fourth sampling rate from the second interface.

[0134] (5) The method according to (2), wherein the number of first streams is equal to the number of second streams or within a predetermined threshold of the number of second streams, and wherein the third sampling rate is lower than the second sampling rate.

[0135] (6) The method according to (5), wherein the predetermined threshold is static or based on the number of streams determined at one of a plurality of sampling rates.

[0136] (7) The method according to (2), wherein the first sampling rate is higher than the second sampling rate, wherein the number of first streams is greater than the number of second streams, and wherein the third sampling rate is higher than the second sampling rate.

[0137] (8) The method according to (7), wherein the third sampling rate is equal to the first sampling rate.

[0138] (9) The method according to any one of (1) to (8), wherein the first sample, the second sample, and the third sample are sFlow samples.

[0139] (10) The method according to any one of (1) to (8), wherein the method is repeated periodically.

[0140] (11) A network device, comprising:

[0141] The memory is configured to store multiple sampling rates;

[0142] A communication unit is configured to transmit signals and receive samples of a data stream; and

[0143] The processing circuitry, communicatively coupled to the memory and the communication unit, is configured to:

[0144] Receive the first sample of the stream sampled at the first sampling rate from the interface of another network device;

[0145] The first parameter is determined based on the first sample;

[0146] Receive a second sample of the stream sampled at a second sampling rate from the interface, wherein the second sampling rate is different from the first sampling rate;

[0147] The second parameter is determined based on the second sample;

[0148] The third sampling rate is determined based on the first parameter and the second parameter;

[0149] The control unit will send a signal indicating the third sampling rate to the other network device; and

[0150] (12) Receive a third sample of the stream sampled at the third sampling rate from the interface. (11) The network device according to (11), wherein the first parameter refers to the number of first streams.

[0151] Furthermore, the second parameter refers to the number of second streams.

[0152] (13) The network device according to (12), wherein the interface is a first interface, and wherein the processing circuitry is further configured to:

[0153] Receive a fourth sample of the stream sampled at the first sampling rate from the second interface of the other network device;

[0154] The quantity of the third stream is determined based on the fourth sample;

[0155] The number of the third stream is determined to be equal to or greater than a predetermined threshold;

[0156] The fourth sampling rate is determined based on the number of third streams that are greater than or equal to the predetermined threshold;

[0157] The control unit transmits a signal indicative of the fourth sampling rate to the other network device, wherein the fourth sampling rate is higher than the second sampling rate; and

[0158] Receive a fifth sample of the stream sampled at the fourth sampling rate from the second interface.

[0159] (14) The network device according to (12), wherein the interface is a first interface, and wherein the processing circuitry is further configured to:

[0160] Receive a fourth sample of the stream sampled at the first sampling rate from the second interface of the other network device;

[0161] Determine that the second interface is processing a stream that is more meaningful in terms of experience quality than the first interface;

[0162] The fourth sampling rate is determined based on the fact that the second interface is processing a stream that is more meaningful in terms of experience quality than the first interface.

[0163] The control unit transmits a signal indicative of the fourth sampling rate to the other network device, wherein the fourth sampling rate is higher than the second sampling rate; and

[0164] Receive a fifth sample of the stream sampled at the fourth sampling rate from the second interface.

[0165] (15) The network device according to (12), wherein the number of first flows is equal to the number of second flows or within a predetermined threshold of the number of second flows, and wherein the third sampling rate is lower than the second sampling rate.

[0166] (16) The network device according to (15), wherein the predetermined threshold is static or based on the number of streams determined at one of the plurality of sampling rates.

[0167] (17) The network device according to (12), wherein the first sampling rate is higher than the second sampling rate, wherein the first number of streams is greater than the second number of streams, and wherein the third sampling rate is higher than the second sampling rate.

[0168] (18) The network device according to (12), wherein the third sampling rate is equal to the first sampling rate.

[0169] (19) The network device according to any one of (11) to (18), wherein the first sample, the second sample and the third sample are sFlow samples.

[0170] (20) A computer-readable storage medium coded with instructions for causing one or more programmable processors to perform the method according to any one of (1) to (10).

Claims

1. A method for flow monitoring, the method comprising: Based on first information about the first rate of the data stream from the network device, determine the first metric of the data stream; A second metric of the data stream is determined based on second information about the second rate of the data stream from the network device, wherein the first rate is different from the second rate; Based on the first metric and the second metric of the data stream, a third rate of the data stream is determined, wherein the third rate is different from the second rate; and The information indicating the third rate is transmitted to the network device.

2. The method according to claim 1, wherein, The first metric of the stream is a first number of streams, the second metric of the stream is a second number of streams, wherein the first rate is a first sampling rate, and wherein the second rate is a second sampling rate.

3. The method according to claim 2, further comprising: A third metric of the data stream is determined based on the fourth information from the first rate of the network device; Determine whether the third metric of the data stream is greater than or equal to a predetermined threshold; A fourth rate of the data stream is determined based on the fact that the third metric of the data stream is greater than or equal to the predetermined threshold, wherein the fourth rate is higher than the second rate; as well as The information indicating the fourth rate is transmitted to the network device.

4. The method according to claim 2, further comprising: It is determined that the second interface of the network device is processing a flow that is more meaningful in terms of quality of experience than the first interface of the network device. A fourth rate of data flow is determined based on the fact that the second interface is processing a flow that is more meaningful in terms of experience quality than the first interface, wherein the fourth rate is higher than the second rate; The information indicating the fourth rate is transmitted to the network device.

5. The method according to claim 2, wherein, The first quantity of the flow is equal to the second quantity of the flow or is within a predetermined threshold of the second quantity of the flow, and wherein the third rate is lower than the second rate.

6. The method according to claim 5, wherein, The predetermined threshold is static or based on the number of flows determined at one of a plurality of rates.

7. The method according to claim 2, wherein, The first rate is higher than the second rate, wherein the first quantity of the flow is greater than the second quantity of the flow, and wherein the third rate is higher than the second rate.

8. The method according to claim 7, wherein, The third rate is equal to the first rate.

9. The method according to any one of claims 1 to 8, wherein, The first and second information include sFlow samples.

10. The method according to any one of claims 1 to 8, wherein, The method is repeated periodically.

11. A network device, comprising: The memory is configured to store multiple sampling rates; The communication unit is configured to transmit signals and receive information from another network device; as well as The processing circuitry, communicatively coupled to the memory and the communication unit, is configured to: Based on first information about the first rate of the data stream from the other network device, a first metric of the data stream is determined. A second metric of the data stream is determined based on second information about the second rate of the data stream from the other network device, wherein the first rate is different from the second rate; Based on the first metric and the second metric of the data stream, a third rate of the data stream is determined, wherein the third rate is different from the second rate; and The control unit transmits information indicating the third rate to the other network device.

12. The network device according to claim 11, wherein, The first metric of the stream is a first number of streams, wherein the second metric of the stream is a second number of streams, wherein the first rate is a first sampling rate, and wherein the second rate is a second sampling rate.

13. The network device according to claim 12, wherein, The processing circuit is further configured to: A third metric of the data stream is determined based on the fourth information from the first rate of the other network device; Determine whether the third metric of the flow is greater than or equal to a predetermined threshold; A fourth rate of the data stream is determined based on the fact that the third metric of the data stream is greater than or equal to the predetermined threshold, wherein the fourth rate is higher than the second rate; and The control unit transmits information instructing the fourth rate to another network device.

14. The network device according to claim 12, wherein, The processing circuit is further configured to: It is determined that the second interface of the other network device is processing a flow that is more meaningful in terms of quality of experience than the first interface of the other network device. A fourth rate of data flow is determined based on the fact that the second interface is processing a flow that is more meaningful in terms of experience quality than the first interface, wherein the fourth rate is higher than the second rate; and The control unit transmits information indicating the fourth rate to the other network device.

15. The network device according to claim 12, wherein, The first quantity of the flow is equal to the second quantity of the flow or is within a predetermined threshold of the second quantity of the flow, and wherein the third rate is lower than the second rate.

16. The network device according to claim 15, wherein, The predetermined threshold is static or based on the number of flows determined at one of a plurality of rates.

17. The network device according to claim 12, wherein, The first rate is higher than the second rate, wherein the first quantity of the flow is greater than the second quantity of the flow, and wherein the third rate is higher than the second rate.

18. The network device according to claim 17, wherein, The third rate is equal to the first rate.

19. The network device according to any one of claims 11 to 18, wherein, The first and second information include sFlow samples.

20. A computer-readable storage medium coded with instructions for causing one or more programmable processors to perform the method according to any one of claims 1 to 10.

Images