Virtual machine discovery and identification
View Patent ↗Methods, systems and computer readable media for virtual machine discovery and identification are described.
1. A method for discovering and identifying a virtual machine in a network, the method comprising:
receiving, at one or more processors, information from the virtual machine of the network, the information including values of one or more of a time stamp, an Internet Protocol (IP) address, and a Medium Access Control (MAC) address;
comparing, at the one or more processors, the information received from the virtual machine of the network to stored virtual machine information retrieved from a database;
in response to the comparing, determining whether at least one value from the values of the virtual machine of the network matches a corresponding at least one value of a virtual machine associated with the stored virtual machine information, wherein the determining whether the at least one value from the values of the virtual machine of the network matches the corresponding at least one value of the virtual machine associated with the stored virtual machine information is based on determining the at least one value from the values of the virtual machine of the network and the corresponding at least one value of the virtual machine associated with the stored virtual machine information are within a given range from each other and the at least one value from the values of the virtual machine of the network and the corresponding at least one value of the virtual machine associated with the stored virtual machine information are not equivalent;
based on the determining, if the match is missing, determining the virtual machine as an unknown virtual machine;
in response to the determining the virtual machine of the network as the unknown virtual machine, adding the information received from the virtual machine of the network to the database and associating the stored virtual machine information retrieved from the database with the virtual machine of the network to generate an updated database; and
utilizing the updated database to monitor the virtual network.
2. The method of claim 1 , further comprising determining whether a unique identifier for the virtual machine of the network is available from a hypervisor associated with the virtual machine of the network and, when the unique identifier is available, receiving the unique identifier and storing the unique identifier in a database record associated with the virtual machine of the network.
3. The method of claim 2 , further comprising generating the unique identifier, when the unique identifier is not available from the hypervisor, and storing the generated unique identifier at a known location in the virtual machine of the network.
4. The method of claim 3 , wherein the generating includes using a hash function.
5. The method of claim 1 , wherein the at least one value from the values of the virtual machine of the network is within a range of the corresponding at least one value of the virtual machine associated with the stored virtual machine information based on a determination that a received IP address of the information received from the virtual machine of the network is in a same subnet range as an IP address in the stored virtual machine information and further on a determination that a received time stamp of the information received from the virtual machine of the network is within a time range of a stored timestamp in the stored virtual machine information.
6. The method of claim 1 , wherein at least two values of the virtual machine of the network are determined to match at least two corresponding values of the virtual machine associated with the stored virtual machine information.
7. A system for discovering and identifying virtual machines in a network, the system comprising:
one or more processors configured to perform operations including:
providing a representation of the virtual network;
receiving, at the one or more processors, information from a virtual machine of the network;
comparing, at the one or more processors, the information received from the virtual machine of the network to stored virtual machine information retrieved from a database;
in response to the comparing, determining whether at least one value from values of the virtual machine of the network matches a corresponding at least one value of a virtual machine associated with the stored virtual machine information, wherein the determining whether the at least one value from the values of the virtual machine of the network matches the corresponding at least one value of the virtual machine associated with the stored virtual machine information is based on determining the at least one value from the values of the virtual machine of the network and the corresponding at least one value of the virtual machine associated with the stored virtual machine information are within a given range from each other and the at least one value from the values of the virtual machine of the network and the corresponding at least one value of the virtual machine associated with the stored virtual machine information are not equivalent;
based on the determining, if the match is missing, determining the virtual machine of the network as an unknown virtual machine;
in response to determining the virtual machine of the network as the unknown virtual machine, adding the information received from the virtual machine of the network to the database and associating the stored virtual machine information retrieved from the database with the virtual machine of the network to generate an updated representation of the virtual network;
displaying the updated representation of the virtual network, including a topology of the virtual network; and
utilizing the updated representation of the virtual network to monitor the virtual network.
8. The system of claim 7 , wherein the information from the virtual machine of the network includes one or more of a time stamp, an IP address, and a MAC address.
9. The system of claim 7 , wherein the operations further comprise determining whether a unique identifier for the virtual machine of the network is available from a hypervisor associated with the virtual machine of the network and, when the unique identifier is available, receiving the unique identifier and storing the unique identifier in a database record associated with the virtual machine of the network.
10. The system of claim 9 , wherein the operations further comprise generating the unique identifier, when the unique identifier is not available from the hypervisor, and storing the generated unique identifier at a known location in the virtual machine of the network.
11. The system of claim 10 , wherein the generating includes using a hash function.
12. The system of claim 7 , wherein the information received from the virtual machine of the network includes one or more of a time stamp, and an Internet Protocol (IP) address and wherein the at least one value from the values of the virtual machine of the network is within a range of the corresponding at least one value of the virtual machine associated with the stored virtual machine information based on a determination that the IP address is in a same subnet range as an IP address in the stored virtual machine information and further on a determination that a value of the time stamp is within a time range of a stored timestamp in the stored virtual machine information.
13. The system of claim 7 , wherein at least two values of the virtual machine of the network are determined to match at least two corresponding values of the virtual machine associated with the stored virtual machine information.
14. A non-transitory computer readable medium having stored thereon software instructions that, when executed by a processor, cause the processor to perform operations including:
providing a representation of a network;
receiving, at one or more processors, information from a virtual machine of the network;
comparing, at the one or more processors, the information received from the virtual machine of the network to stored virtual machine information retrieved from a database;
in response to the comparing, determining whether at least one value from values of the virtual machine of the network matches a corresponding at least one value of a virtual machine associated with the stored virtual machine information, wherein the determining whether the at least one value from the values of the virtual machine of the network matches the corresponding at least one value of the virtual machine associated with the stored virtual machine information is based on determining the at least one value from the values of the virtual machine of the network and the corresponding at least one value of the virtual machine associated with the stored virtual machine information are within a given range from each other and the at least one value from the values of the virtual machine of the network and the corresponding at least one value of the virtual machine associated with the stored virtual machine information are not equivalent;
based on the determining, if the match is missing, determining the virtual machine of the network as an unknown virtual machine;
in response to determining the virtual machine of the network as the unknown virtual machine, adding the information to the database and associating the stored virtual machine information retrieved from the database with the virtual machine of the network to generate an updated representation of the virtual network;
providing the updated representation of the virtual network; and
utilizing the updated representation of the virtual network to monitor the virtual network.
15. The non-transitory computer readable medium of claim 14 , wherein the information includes one or more of a time stamp, an IP address, and a MAC address.
16. The non-transitory computer readable medium of claim 14 , wherein the operations further comprise determining whether unique identifier for the virtual machine of the network is available from a hypervisor associated with the virtual machine of the network and, when a unique identifier is available, receiving the unique identifier and storing the unique identifier in a database record associated with the virtual machine of the network.
17. The non-transitory computer readable medium of claim 16 , wherein the operations further comprise generating the unique identifier, when the unique identifier is not available from the hypervisor, and storing the generated unique identifier at a known location in the virtual machine of the network.
18. The non-transitory computer readable medium of claim 17 , wherein the generating includes using a hash function.
19. The non-transitory computer readable medium of claim 14 , wherein the information received from the virtual machine of the network includes values of one or more of a time stamp and an Internet Protocol (IP) address and wherein the at least one value from the values of the virtual machine of the network is within a range of the corresponding at least one value of the virtual machine associated with the stored virtual machine information based on a determination that the IP address is in a same subnet range as an IP address in the stored virtual machine information and further on a determination that the time stamp is within a time range of a stored timestamp in the stored virtual machine information.