Microservice Topology Maps via Network Packet Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional monitoring solutions for cloud applications based on microservices are inadequate due to increased complexity in monitoring interactions between services, as they rely on code instrumentation and logs, which are less effective for network interactions and fail to provide dynamic visualization of arbitrary and overlapping layers in modern cloud architectures.
Innovation Solution
A system and method for networked microservice modeling and visualization that collects network interactions in real-time using lightweight collectors, processes packets and metadata, and generates enhanced time series data to create dynamic topology maps, enabling visibility into service interactions and infrastructure performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional code instrumentation and log-based monitoring are used, then monitoring can be implemented with existing tools, but the ability to monitor network interactions between microservices is insufficient
Solution Approach 1:
The patent introduces network collectors as intermediary components that capture network traffic between microservices. These collectors act as mediators between the network layer and monitoring systems, extracting relevant interaction data without requiring code instrumentation changes. The collectors process packets and generate structured monitoring data that traditional log-based systems cannot obtain from network-layer interactions alone.
Solution Approach 2:
The patent replaces code instrumentation (white-box monitoring) with network packet capture (black-box monitoring). Instead of modifying application code to embed monitoring logic, the system uses network collectors to intercept and analyze traffic at the network layer. This substitution enables monitoring of microservice interactions without changing the services themselves, addressing the adaptability challenge.
2Loss of information
If code instrumentation is used for monitoring, then detailed application-level data can be collected, but the complexity increases when migrating to microservices architecture
Solution Approach 1:
The patent segments the monitoring function into separate network collectors that operate independently of the microservices themselves. Each collector handles network traffic for specific services or zones, dividing the complex monitoring task into manageable units. This segmentation reduces the complexity burden on individual services while maintaining complete interaction data collection across the distributed system.
Solution Approach 2:
By introducing network collectors as intermediary components between network traffic and monitoring systems, the patent decouples monitoring complexity from the microservices. The collectors handle all packet processing and data extraction, allowing services to remain simple while still obtaining detailed interaction information through the collector layer.
3Ease of manufacture
If traditional log-based monitoring is used, then existing infrastructure can be leveraged, but dynamic visualization of arbitrary and overlapping layers is not achieved
Solution Approach 1:
The patent implements network collectors that can monitor multiple types of network interactions simultaneously (service-to-service, service-to-database, external API calls). The same collector infrastructure handles different protocols and interaction patterns, providing universal monitoring capability across arbitrary and overlapping architectural layers without requiring separate monitoring systems for each layer type.
Solution Approach 2:
The patent adds network traffic analysis as a new dimension to traditional log-based monitoring. By capturing and processing network packets at the network layer, the system creates a third dimension of observability alongside application logs and infrastructure metrics. This dimensional expansion enables visualization of interactions across multiple architectural layers simultaneously.
Data Source
AI summary
In a distributed cloud environment, a collecting agent deployed external to a kernel of a compute host collects network data packets describing various raw events communicated between compute instances of the environment and metadata associated with the events from various sources. The collecting agent communicates the metadata to a cloud application. The collecting agent also communicates the packets to a stream processor that is decoupled from the collecting agent. The stream processor processes the packets in a stateful manner to generate a set of time series data. The time series data is communicated to the cloud application, where a set of enhanced time series data is generated by merging the time series data with the metadata in a distributed manner. A topology map describing the compute instances of the distributed cloud environment is then generated based on the set of enhanced time series data. The topology map is then displayed.