Network Routing Analysis via Flow Record Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for monitoring routing changes in packet switched networks are unable to provide precise information about the data plane on short time scales, especially in determining the impact of changes at individual routers and the exact paths taken by packets.
Innovation Solution
A system that generates routing information by analyzing flow records from routers, using a flow record collector and analyzer to infer routing table changes and path dynamics across the network, allowing for precise determination of routing changes and path analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If routing protocol message exchanges are monitored by specialized route monitors, then the control plane state can be measured, but precise information about the data plane on short time scales cannot be obtained
Solution Approach 1:
The patent segments the measurement approach by deploying multiple independent flow record collectors at different network vantage points. Each collector independently measures flow records for the same traffic flows, allowing the system to reconstruct routing path information by correlating measurements from multiple locations. This segmentation enables precise data plane measurement without relying on control plane messages.
Solution Approach 2:
The patent introduces flow records as an intermediary mechanism that bridges the control plane and data plane. Flow records capture detailed information about actual packet flows including source/destination addresses, interfaces, and timestamps. These records serve as intermediaries that provide precise data plane information without requiring direct access to control plane routing protocol messages.
2Reliability
If router log messages are monitored to identify events, then control plane changes can be detected, but precise assessment of impact at individual routers cannot be determined
Solution Approach 1:
The patent implements feedback by continuously monitoring flow records and comparing them against expected routing behavior. When routing changes occur, the system detects deviations in flow paths and provides feedback about the actual impact at individual routers. This feedback loop enables precise assessment of routing change impacts by measuring actual flow behavior rather than relying on log messages.
Solution Approach 2:
The patent performs preliminary action by establishing baseline flow records before routing changes occur. By continuously collecting and storing flow record data, the system has pre-established information about normal routing paths and flow characteristics. When changes occur, this preliminary data enables immediate and precise impact assessment without waiting for log message analysis.
3Loss of information
If active end-to-end measurement of the data plane is performed, then the impact of routing changes can be inferred, but only in a coarse and imprecise manner
Solution Approach 1:
The patent adds another dimension to measurement by incorporating spatial information from multiple network vantage points. Instead of single end-to-end measurements, the system collects flow records from multiple collectors at different locations, adding spatial dimensionality to the measurement. This enables precise localization of routing changes and their impact at specific routers by analyzing patterns across the dimensional space of network locations.
Solution Approach 2:
The patent performs preliminary action by pre-collecting and storing detailed flow record information including source/destination addresses, interface identifiers, and timestamps. This preliminary data collection creates a rich information base that enables precise post-hoc analysis of routing impact. The system has already captured the necessary granular information before analysis is needed, allowing precise assessment rather than coarse inference.
Data Source
AI summary
A system and method to use network flow records to generate information about changes in network routing and to understand the impact of these changes on network traffic. The inferences made can be determinative, if sufficient information is available. If sufficient information is not available to make determinative inferences, inferences may be made that narrow the range of possible changes that may have occurred to network traffic and the underlying network.