Method and system for managing a distributed network of network monitoring devices
View Patent ↗Network traffic information for nodes of a first logical hierarchy is stored at a monitoring device according to ranks of the nodes within the logical hierarchy as determined by each node's position therein and user preferences. At least some of the network traffic information stored at the network monitoring device may then be reported to another network monitoring device, where it can be aggregated with similar information from other network monitoring devices. Such reporting may occur according to rankings of inter-node communication links between nodes of different logical hierarchies of monitored nodes.
1. A computer-implemented method of monitoring a portion of a network, wherein a network monitoring device among a plurality of network monitoring devices has been assigned to monitor the portion of the network, said method comprising:
determining, by the network monitoring device, a logical grouping of nodes for the portion of the network to which the network monitoring device has been assigned;
determining, by the network monitoring device, a hierarchy that ranks nodes within the logical grouping, wherein the network monitoring device prunes the hierarchy based on a capacity of the network monitoring device;
receiving, by the network monitoring device, network traffic information corresponding to nodes within the logical grouping; and
selectively storing, by the network monitoring device, network traffic corresponding to the nodes within the logical grouping according to their respective positions within the hierarchy.
2. The computer-implemented method of claim 1 , further comprising
reporting from the network monitoring device to a second network monitoring device at least some of the stored network traffic information based on the ranking of the nodes corresponding to the network traffic information that was received.
3. The computer-implemented method of claim 2 , wherein the second network monitoring device receives selected portions of the network traffic information stored by the network monitoring device according to rankings of inter-node communication links between nodes in the logical grouping.
4. The computer-implemented method of claim 3 , wherein the rankings of inter-node communication links are determined according to ranks of individual nodes associated with the communication links in the logical grouping.
5. The computer-implemented method of claim 2 , wherein the ranks of nodes within the logical grouping are determined according to a first distance measured from a root node of the hierarchy to a node under consideration and a second distance measured from a leaf node of the hierarchy to the node under consideration.
6. A computer-implemented method for monitoring a portion of a network by a network monitoring device, said method comprising:
defining, by the network monitoring device, a logical grouping of nodes in the network based on instructions supplied from a user, wherein the logical grouping indicates at least a root node for the logical grouping;
determining, by the network monitoring device, a hierarchy for the nodes within the logical grouping based on their respective distances from the root node;
ranking, by the network monitoring device, the nodes in the logical grouping according to each node's position within the hierarchy; and
selectively storing network traffic data associated with the nodes of the logical grouping according to each node's rank and a capacity of the network monitoring device.
7. The computer-implemented method of claim 6 , further comprising transferring from the network monitoring device to a second network monitoring device at least some of the network traffic data stored according to each node's rank.
8. The computer-implemented method of claim 7 , wherein the network traffic data stored according to each node's rank is transferred to the second network monitoring device if said rank satisfies additional ranking criteria concerning communications between nodes of different groupings.
9. A computer-implemented method of monitoring a network by a plurality of network monitoring devices, wherein the plurality of network devices comprises a set of appliances assigned to monitor portions of the network and a central monitoring device configured to direct the set of appliances, said method comprising:
assigning, to each of the appliances, respective portions of the network that comprise a logical grouping of nodes, wherein the logical groupings are defined based on one or more user-specified instructions, and wherein the logical groupings comprise a root node;
determining, by each of the appliances, a ranking for each node in the logical grouping based on proximity of each node to the root node and a hierarchy that arranges the nodes within the logical grouping according to their respective rankings;
selectively pruning, by each of the appliances, the hierarchy based on a capacity of each appliance;
defining, by the central monitoring node, a global ranking for nodes in the logical groupings assigned to the appliances; and
aggregating, at the central monitoring node, network traffic collected by the appliances based on the respective global rankings and a capacity of the central monitoring device.
10. The computer-implemented method of claim 9 , wherein said aggregating proceeds incrementally for each branch of the hierarchy constructed by the appliance.
11. The computer-implemented method of claim 9 , wherein the global ranks of the nodes are based on one or more user preferences.
12. The system of claim 4 , wherein each rank is also determined based on one or more user preferences.
13. The system of claim 5 , wherein the ranks also determined based on one or more user preferences.
14. The computer-implemented method of claim 6 , wherein the ranking of nodes is also based on one or more user preferences.
15. The computer-implemented method of claim 9 , wherein the ranks of the individual nodes are also based on one or more user preferences.
16. A network monitoring system for monitoring a network, wherein said network comprises a plurality of logical groupings of nodes defined by a user, said system comprising:
a plurality of network monitoring devices each collecting traffic data from a logical grouping to which it has been assigned, wherein each logical grouping comprises a hierarchy that indicates rankings of nodes in the logical grouping, wherein each monitoring device selectively collects traffic data from the nodes in its logical grouping based on the rankings of nodes, wherein the ranking of each node is based on a position of each node within the hierarchy; and
a central monitoring device that ranks the logical groupings relative to each other and aggregates the traffic data from the network monitoring devices based on the rankings.
17. The system of claim 16 , wherein the central network monitoring system is configured to receive information related to select portions of the traffic data based on the relative rankings.
18. The system of claim 17 , wherein each of the network monitoring devices have a relative ranking among the plurality of network monitoring devices, and the select portions of the traffic data sent to the central monitoring device is also based on the relative ranking of the corresponding network monitoring device.
19. The system of claim 17 , wherein groups of one or more monitoring devices of the plurality of monitoring devices have an associated ranking, and the select portions of the traffic data is also based on the associated ranking of the corresponding group of network monitoring devices.