Network Flow Enrichment with Exit Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network monitoring tools face challenges in efficiently analyzing and understanding network traffic patterns due to the complexity of routing data and the need for manual analysis of voluminous data, which can lead to inefficiencies in network operations.
Innovation Solution
A network monitoring engine that enriches flow records with exit information using BGP routing and SNMP interface data, allowing for real-time analysis of how traffic is routed through the network, reducing the need for long-term data storage and computational resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If network monitoring tools collect voluminous amounts of traffic data, then the ability to analyze network usage is improved, but computational resources and storage requirements increase significantly
Solution Approach 1:
The patent extracts and enriches flow records with specific exit information (egress device and interface) from the voluminous traffic data. Instead of storing and analyzing all raw traffic data, the system extracts only the essential routing path information needed for analysis, significantly reducing storage and computational requirements while maintaining network usage analysis capability.
Solution Approach 2:
The system performs preliminary enrichment of flow records with exit information at the point of data collection. By pre-processing the data to include egress device and interface details in the flow records themselves, the system eliminates the need for complex post-processing and repeated analysis of raw traffic data, reducing overall computational burden.
2Loss of information
If manual analysis of collected traffic data is performed, then detailed network usage understanding is achieved, but time consumption increases
Solution Approach 1:
The flow records are enriched with exit information automatically through the enrichment process, making the data self-descriptive. The enriched flow records contain inherent routing path information that enables automated analysis without requiring manual interpretation, thus reducing analysis time while maintaining comprehensive network usage understanding.
3Productivity
If routing efficiency is optimized dynamically, then network performance is improved, but data consistency and reliability may be compromised
Solution Approach 1:
The system captures routing information (BGP and SNMP data) at the time of flow record enrichment, creating a timestamped snapshot of the routing state. This preliminary capture of routing context ensures that even if routing changes dynamically later, the enriched flow records maintain consistent and reliable routing path information for accurate historical analysis.
Data Source
AI summary
A network monitoring engine uses the routing and interface data of a monitored network to enrich received flow records with exit information. The routing data of the same network device at which the flow record is received is used to determine a next hop based upon the destination IP address of the flow record. In addition, interface data of the other devices is used to determine an egress device and interface of the network used to transmit traffic to the identified next hop. The flow record is enriched with exit information indicating an interface of the network the data packets of the flow record are expected to exit the network. By enriching the flow records as they are received, the exit information reflects how traffic is routed through the network at that time, even if the routing or interface information of the network later changes.