Sample based determination of network policy violations
View Patent ↗Disclosed herein are a system, computer-readable medium, and method for enforcing network policies. Samples of data traveling through at least some nodes of a network are collected. It is determined whether a node violated a predefined network policy based on the samples.
1. A system comprising,
a network comprising a plurality of interconnected nodes;
a plurality of sensors which, if executed, instruct at least one processor to collect samples of data traveling through at least some nodes in the network;
a network service sentinel comprising at least one hardware processor to:
determine whether a node violates a predefined network policy based on the samples; and
if the node violates the predefined network policy, generate an alert containing an identification of the node and the predefined network policy being violated by the node; and
a mirroring module which, if executed, instructs at least one processor to replicate real time data traveling through the node to the network management server, in response to a determination that the node violates the predefined network policy.
2. The system of claim 1 , further comprising a network management server which, if executed, instructs at least one processor to display the alert generated by the network service sentinel.
3. The system of claim 1 , wherein the predefined network policy comprises regular expressions and Boolean logic.
4. The system of claim 1 , wherein at least some of the plurality of nodes connects to the network using an edge switch.
5. The system of claim 3 , wherein at least one of the plurality of sensors executes in the edge switch.
6. A non-transitory computer readable medium, comprising instructions therein which, if executed, instruct at least one processor to:
read samples collected by a plurality of sensors distributed across a network of interconnected nodes, the samples comprising network data packets traveling through at least some nodes in the network;
determine whether a node violates a predefined network policy based on the collected samples; and
if the node violates the predefined network policy, identify the node violating the predefined network policy, replicate real time data packets traveling through the node to a network management server, and generate an alert to indicate the predefined network policy violated by the node.
7. The non-transitory computer readable medium of claim 6 , wherein the instructions therein, if executed, further instruct at least one processor to forward the alert to a network management server.
8. The non-transitory computer readable medium of claim 6 , wherein the predefined network policy comprises regular expressions and Boolean logic.
9. The non-transitory computer readable medium of claim 6 , wherein at least some of the plurality of nodes connects to the network using an edge switch.
10. The non-transitory computer readable medium of claim 9 , wherein at least one of the plurality of sensors executes in the edge switch.
11. A method comprising:
reading, using at least one processor, samples of network data packets traveling through at least some nodes of a network;
determining, using at least one processor, whether a node violates a predefined network policy based on the samples;
if the node violates the predefined network policy, displaying, using at least one processor, an alert identifying the node and indicating the predefined network policy violated by the node; and
displaying, using at least one processor, copies of the real time data packets traveling through the node, in response to a determination that the node violates the predefined network policy.
12. The method of claim 11 , wherein the predefined network policy comprises regular expressions and Boolean logic.
13. The method of claim 11 , wherein at least some of the nodes connects to the network using an edge switch.
14. The method of claim 13 , wherein the edge switch comprises a sensor to collect the samples of network data.