PHYSICAL ADDRESS CORRELATION FOR NETWORK TRAFFIC TRACKING
Network traffic may be logged and analyzed to perform accounting on amount of a chargeable network resource that is consumed fulfilling requests for different clients or for different servers. A network device may report network traffic to a server through NetFlow data records. The network traffic may be analyzed by identifying physical addresses recorded for transmitted data in the NetFlow data records. The physical addresses may be correlated to computer names, which are then billed for the network traffic.
1 . A method, comprising:
receiving information for a packet of network traffic;
identifying a physical address associated with the packet;
identifying a computer name corresponding to the physical address; and
assigning the packet to the computer name for charging.
2 . The method of claim 1 , further comprising summarizing the network traffic assigned to the computer name.
3 . The method of claim 1 , in which the step of identifying the computer comprises reading a look-up table, the look-up table comprising a mapping of computer names and physical addresses.
4 . The method of claim 1 , in which the network traffic comprises internet protocol (IP) packets.
5 . The method of claim 4 , further comprising detecting duplicate internet protocol (IP) addresses in the network traffic before identifying the physical address.
6 . The method of claim 4 , in which the physical address is a media access control (MAC) address.
7 . A computer program product, comprising:
a non-transitory computer readable medium comprising:
code to receive information for a packet of network traffic;
code to identify a physical address associated with the one packet;
code to identify a computer name corresponding to the physical address; and
code to assigning the packet to the computer name for charging.
8 . The computer program product of claim 7 , in which the medium further comprises code to summarize the network traffic assigned to the computer name.
9 . The computer program product of claim 7 , in which the medium further comprises code to read a look-up table, the look-up table comprising a mapping of computer names and physical addresses.
10 . The computer program product of claim 7 , in which the network traffic comprises internet protocol (IP) packets.
11 . The computer program product of claim 10 , in which the medium further comprises code to detect duplicate internet protocol (IP) addresses in the network traffic before identifying the physical address.
12 . The computer program product of claim 10 , in which the physical address is a media access control (MAC) address.
13 . An apparatus, comprising:
a memory; and
a processor coupled to the memory, in which the processor is configured:
to receive information for a packet of network traffic;
to identify, for at least one of the packets of logged network traffic, a physical address associated with the one packet;
to identify a computer name corresponding to the physical address; and
to assigning the packet to the computer name for charging.
14 . The apparatus of claim 13 , in which the processor is further configured to summarize the network traffic assigned to the computer name.
15 . The apparatus of claim 13 , in which the processor is further configured to read a look-up table, the look-up table comprising a mapping of computer names and physical addresses.
16 . The apparatus of claim 13 , in which the network traffic comprises internet protocol (IP) packets.
17 . The apparatus of claim 16 , in which the processor is further configured to detect duplicate internet protocol (IP) addresses in the network traffic before identifying the physical address.
18 . The apparatus of claim 16 , in which the physical address is a media access control (MAC) address.