Automated passive discovery of applications
Embodiments are directed to monitoring communication over a network using a network monitoring device (NMD) to discover devices, roles, applications, and application dependencies present on the monitored networks. A NMD may monitor network packets that may be flowing on monitored networks. Using OSI L2-to-L3 data the NMD may determine the devices that may be on the monitored networks. Also, the NMD may determine the network protocols that may be in use on the monitored networks. Further, the NMD may reassemble monitored network packets into transactions based on knowledge regarding the network protocols are in use on the monitored networks. The NMD may perform various tests to determine the applications that may be running on the discovered devices. Some of the tests used by the NMD may examine OSI L4-L7 data that may be included in the transactions.
1. A method for monitoring communication over a network with a network device that is operative to perform actions, comprising:
passively monitoring a plurality of packets on the network and determining at least one other network device on the network and at least one network protocol based on at least data included in the monitored packets, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model;
determining a plurality of transactions by reassembling at least a portion of the plurality of monitored packets based on the at least one determined network protocol;
determining at least one application based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet; and
generating at least one application profile that includes at least an identity of the application and associating the application profile with the at least one other network device.
2. The method of claim 1 , further comprising, determining at least one operating system that is associated with the at least one other network device based on testing the at least portion of L4-L7 data included in the monitored packets.
3. The method of claim 1 , further comprising, determining at least one application dependency based on at least a comparison of a plurality of transactions that are associated with two or more separate network devices.
4. The method of claim 1 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, correlating two or more transactions that are on separate network flows based on L4-L7 data included in each transaction.
5. The method of claim 1 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, determining the at least one application based on an accumulation of L4-L7 data from a plurality of transactions.
6. The method of claim 1 , further comprising, determining at least one role for the at least one other network device based on examining the L4-L7 data associated with the at least one other network device.
7. The method of claim 1 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, employing at least one heuristic technique based on at least one known property of the at least one application.
8. A system arranged for monitoring communication over a network, comprising:
a server device, including:
a transceiver that is operative to communicate over the network;
a memory that is operative to store at least instructions; and
a processor device that is operative to execute instructions that enable actions, including:
passively monitoring a plurality of packets on the network and determining at least one other network device on the network and at least one network protocol based on at least data included in the monitored packets, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model;
determining a plurality of transactions by reassembling at least a portion of the plurality of monitored packets based on the at least one determined network protocol;
determining at least one application based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet; and
generating at least one application profile that includes at least an identity of the application and associating the application profile with the at least one other network device; and
a client device, comprising,
a transceiver that is operative to communicate over the network;
a memory that is operative to store at least instructions; and
a processor device that is operative to execute instructions that enable actions, including:
displaying at least a portion of one device profile that corresponds to the at least one other network device; and
displaying at least a portion of the at least one application profile.
9. The system of claim 8 , further comprising, determining at least one operating system that is associated with the at least one other network device based on testing the at least portion of L4-L7 data included in the monitored packets.
10. The system of claim 8 , further comprising, determining at least one application dependency based on at least a comparison of a plurality of transactions that are associated with two or more separate network devices.
11. The system of claim 8 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, correlating two or more transactions that are on separate network flows based on L4-L7 data included in each transaction.
12. The system of claim 8 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, determining the at least one application based on an accumulation of L4-L7 data from a plurality of transactions.
13. The system of claim 8 , further comprising, determining at least one role for the at least one other network device based on examining the L4-L7 data associated with the at least one other network device.
14. The system of claim 8 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, employing at least one heuristic technique based on at least one known property of the at least one application.
15. A network device that is operative for monitoring communication over a network, comprising:
a transceiver that is operative to communicate over a network;
a memory that is operative to store at least instructions; and
a processor device that is operative to execute instructions that enable actions, including:
passively monitoring a plurality of packets on the network and determining at least one other network device on the network and at least one network protocol based on at least data included in the monitored packets, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model;
determining a plurality of transactions by reassembling at least a portion of the plurality of monitored packets based on the at least one determined network protocol;
determining at least one application based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet; and
generating at least one application profile that includes at least an identity of the application and associating the application profile with the at least one other network device.
16. The network device of claim 15 , further comprising, determining at least one operating system that is associated with the at least one other network device based on testing the at least portion of L4-L7 data included in the monitored packets.
17. The network device of claim 15 , further comprising, determining at least one application dependency based on at least a comparison of a plurality of transactions that are associated with two or more separate network devices.
18. The network device of claim 15 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, correlating two or more transactions that are on separate network flows based on L4-L7 data included in each transaction.
19. The network device of claim 15 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, determining the at least one application based on an accumulation of L4-L7 data from a plurality of transactions.
20. The network device of claim 15 , further comprising, determining at least one role for the at least one other network device based on examining the L4-L7 data associated with the at least one other network device.
21. A processor readable non-transitive storage media that includes instructions for monitoring communication over a network with a network device, wherein execution of the instructions by a processor device enables actions, comprising:
passively monitoring a plurality of packets on the network and determining at least one other network device on the network and at least one network protocol based on at least data included in the monitored packets, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model;
determining a plurality of transactions by reassembling at least a portion of the plurality of monitored packets based on the at least one determined network protocol;
determining at least one application based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet; and
generating at least one application profile that includes at least an identity of the application and associating the application profile with the at least one other network device.
22. The media of claim 21 , further comprising, determining at least one operating system that is associated with the at least one other network device based on testing the at least portion of L4-L7 data included in the monitored packets.
23. The media of claim 21 , further comprising, determining at least one application dependency based on at least a comparison of a plurality of transactions that are associated with two or more separate network devices.
24. The media of claim 21 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, correlating two or more transactions that are on separate network flows based on L4-L7 data included in each transaction.
25. The media of claim 21 , further comprising, determining at least one role for the at least one other network device based on examining the L4-L7 data associated with the at least one other network device.
26. The media of claim 21 , wherein determining the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises, employing at least one heuristic technique based on at least one known property of the at least one application.