Data center traffic analytics synchronization
A network analytics system can receive first sensor data, including first network activity and a first timestamp associated with a first clock of a first node, and second sensor data, including second network activity and a second timestamp associated with a second clock of a second node. The system can determine a first delta between the first clock and a third clock based on the first timestamp, and a second delta between the second clock and the third clock. The system can determine a first communication latency associated with a first sensor of the first node, and a second communication latency associated with a second sensor of the second node. The system can generate a report that synchronizes one or more data flows between the first node and the second node based on the first delta, the second delta, the first communication latency, and the second communication latency.
1 . A computer-implemented method, comprising:
receiving, by a device, network activity data from a first sensor and a second sensor, wherein the first and second sensors are associated with a network node relative to a clock of the network node and wherein the network activity data is associated with at least one timestamp and the network activity data includes network traffic traversing a network;
determining a delta between the at least one timestamp and a second timestamp determined by the device relative to a clock of the device;
determining a latency of a communication channel between the device and the network node;
adjusting the delta based on the latency;
generating a report that includes a new timestamp by synchronizing the at least one timestamp and second timestamp with the adjusted delta associated with the network activity data; and
synchronizing the report with a plurality of other reports from network activity data of a plurality of other sensors.
2 . The method of claim 1 , wherein the at least one timestamp indicates when the sensor sent a report to a collector and is based on a clock of the network node.
3 . The method of claim 1 , further comprising:
generating a timeline from the report and a plurality of other reports from other devices.
4 . The method of claim 1 , wherein the latency is determined on a periodic basis.
5 . The method of claim 1 , wherein the latency is precalculated.
6 . The method of claim 1 , determining the latency further comprising:
sending a request message to the sensor;
receiving an automatic reply packet from the sensor;
determining a timestamp of when the automatic reply packet was received; and
determining the latency based on the timestamp of when the automatic reply packet was received and a timestamp of when the request message was sent.
7 . A device, comprising:
one or more processors;
memory including instructions that, when executed by the one or more processors, cause the device to:
receive network activity data from a first sensor and a second sensor, wherein the first and second sensors are associated with a network node relative to a clock of the network node and wherein the network activity data is associated with at least one timestamp and the network activity data includes network traffic traversing a network;
determine a delta between the at least one timestamp and a second timestamp determined by the device relative to a clock of the device;
determine a latency of a communication channel between the device and the network node;
adjust the delta based on the latency;
generate a report that includes a new timestamp by synchronizing the at least one timestamp and second time stamp with the adjusted delta associated with the network activity data; and
synchronizing the report with a plurality of other reports from network activity data of a plurality of other sensors.
8 . The device of claim 7 , wherein the at least one timestamp indicates when the first or second sensor sent a report to a collector and is based on a clock of the network node.
9 . The device of claim 7 , further comprising instructions, which when executed by the one or more processors, cause the device to:
generate a timeline from the report and a plurality of other reports from other devices.
10 . The device of claim 7 , wherein the latency is determined on a periodic basis.
11 . The device of claim 7 , wherein the latency is precalculated.
12 . The device of claim 7 , further comprising instructions, which when executed by the one or more processors, cause the device to:
send a request message to the sensor;
receive an automatic reply packet from the sensor;
determine a timestamp of when the automatic reply packet was received; and
determine the latency based on the timestamp of when the automatic reply packet was received and a timestamp of when the request message was sent.
13 . A non-transitory computer-readable medium including instructions that, when executed by one or more processors of a device, cause the device to:
receive network activity data from a first sensor and a second sensor, wherein the first and second sensors are associated with a network node relative to a clock of the network node and wherein the network activity data is associated with at least one timestamp and the network activity data includes network traffic traversing a network;
determine a delta between the at least one timestamp and a second timestamp determined by the device relative to a clock of the device;
determine a latency of a communication channel between the device and the network node;
adjust the delta based on the latency;
generate a report that includes a new timestamp by synchronizing the at least one timestamp and second time stamp with the adjusted delta associated with the network activity data; and
synchronizing the report with a plurality of other reports from network activity data of a plurality of other sensors.
14 . The non-transitory computer-readable medium of claim 13 ,
wherein the at least one timestamp indicates when the first or second sensor sent a report to a collector and is based on a clock of the network node.
15 . The non-transitory computer-readable medium of claim 13 , wherein the latency is determined on a periodic basis.
16 . The non-transitory computer-readable medium of claim 13 , wherein the latency is precalculated.
17 . The non-transitory computer-readable medium of claim 13 , further comprising instructions, which when executed by the one or more processors, cause the device to:
send a request message to the sensor;
receive an automatic reply packet from the sensor;
determine a timestamp of when the automatic reply packet was received; and
determine the latency based on the timestamp of when the automatic reply packet was received and a timestamp of when the request message was sent.
18 . The method of claim 1 , wherein the network node is a routing or switching device.
19 . The method of claim 1 , wherein the network node is a server.