Workload Identification in Hybrid Networks with Non-Unique IP Addresses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In hybrid networking environments with non-unique IP addresses, existing network flow analysis systems face challenges in accurately identifying source and destination workloads, leading to difficulties in traffic pattern visibility and application dependency analysis due to overlapping IP addresses.
Innovation Solution
The method involves determining administrative domains within the network using topology and routing data, generating observation point mapping information and lookup tables to uniquely identify workloads by mapping IP addresses to administrative domains, and creating a workload identification table to disambiguate flow records.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If IP addresses are used for flow record analysis in hybrid networks, then network traffic can be tracked and analyzed, but accurate workload identification becomes impossible due to non-unique IP addresses across different administrative domains
Solution Approach 1:
The network is segmented into multiple administrative domains, each with its own IP address space. Flow records are enriched with administrative domain identifiers to distinguish between different network segments. This segmentation allows accurate workload identification despite IP address overlaps across domains.
Solution Approach 2:
An intermediary enrichment system is introduced that adds administrative domain context to flow records. This intermediary layer maps IP addresses to their corresponding administrative domains and workloads, enabling accurate identification without modifying the underlying IP addressing scheme or requiring changes to existing network infrastructure.
2Loss of information
If flow records are captured and aggregated centrally for global analysis, then network-wide traffic patterns can be observed, but the complexity of mapping flow records to local network contexts increases significantly in hybrid environments
Solution Approach 1:
Administrative domain identifiers and workload mappings are pre-computed and stored in enrichment tables before flow records arrive. When flow records are captured centrally, these pre-computed mappings are used to quickly enrich the records with contextual information, eliminating the need for complex real-time mapping calculations.
Solution Approach 2:
An intermediary enrichment database is introduced that stores the mapping between IP addresses, administrative domains, and workloads. This intermediary repository allows central aggregation points to quickly resolve flow record contexts without directly implementing complex mapping logic, simplifying the overall system architecture.
3Productivity
If third-party network flow analysis systems are used, then basic IP address level analytics can be provided, but enrichment beyond simple network topology is restricted and workload-level detail is lost
Solution Approach 1:
The system adds a new dimension of administrative domain identification to traditional IP address-based flow analysis. By enriching flow records with both IP address and administrative domain context, the system enables workload-level analytics while maintaining compatibility with existing IP address analysis capabilities.
Solution Approach 2:
An intermediary enrichment layer is introduced between flow record capture and analysis that adds workload-level details to IP address-based records. This intermediary process enriches basic flow data with administrative domain context and workload identifiers, enabling deeper analytics without replacing existing analysis systems.
Data Source
AI summary
Embodiments described herein generally involve identifying workloads in a networking environment based on a flow record from an observation point. In one embodiment, network data is received from one or more endpoints and used to determine a plurality of administrative domains. Each administrative domain comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique. The network data may be used to generate observation point mapping information that maps each observation point to an administrative domain, lookup tables associated with each of the plurality of administrative domains that map IP addresses to administrative domains, and a workload identification table that maps combinations of IP addresses and administrative domains to workloads. The flow record is received from the observation point and a source and destination workload of the flow record are identified using the observation point mapping information, applicable lookup table, and workload identification table.