Apparatus, system, and method for enhanced monitoring and searching of devices distributed over a network
A system for network monitoring and network traffic analysis includes a plurality of network devices and a management station. Each of the plurality of network devices is associated with corresponding ones of a plurality of ports. Each of the plurality of network devices is configured to determine network traffic analysis data associated with a characteristic of network data traversing each of the plurality of ports. The management station is configured to determine a ranking of the plurality of ports based on the network traffic analysis data in response to a search request implicating the characteristic, and is configured to display the plurality of ports based on the ranking.
1. A system for network monitoring and network traffic analysis, comprising:
a plurality of network devices, each of the plurality of network devices being associated with corresponding ones of a plurality of ports, each of the plurality of network devices being configured to determine network traffic analysis data associated with a characteristic of network data traversing each of the plurality of ports; and
a management station configured to determine a ranking of the plurality of ports based on the network traffic analysis data in response to a search request implicating the characteristic, and configured to display the plurality of ports based on the ranking.
2. The system of claim 1 , wherein the management station is configured to refresh the display of the plurality of ports upon a change in the ranking due to dynamic variations in the traffic analysis data.
3. The system of claim 1 , wherein the ranking of the plurality of ports is based on whether the network data traversing the each of the plurality of ports has the characteristic.
4. The system of claim 1 , wherein the ranking of the plurality of ports is based on a number of times that the characteristic has been detected in the network data over a time interval.
5. The system of claim 4 , wherein the characteristic is indicated based on an occurrence of a bit pattern in the network data.
6. The system of claim 4 , wherein the characteristic is indicated based on an occurrence of a pattern of variation in a data rate associated with the network data.
7. The system of claim 1 , wherein the each of the plurality of network devices is configured to determine the network traffic analysis data based on application of at least one of a signature-based rule and a behavioral rule to the network data.
8. The system of claim 1 , wherein:
the each of the plurality of network devices is configured to determine statistical data over each of a plurality of time intervals of a first time granularity based on the network data; and
the network traffic analysis data has a volume reduced from a volume of the statistical data; and
the each of the plurality of network devices is configured to determine the network traffic analysis data based on performance of a mathematical operation on the statistical data, wherein the network traffic analysis data is associated with each of a plurality of time intervals of a second time granularity, the first time granularity being finer than the second time granularity.
9. The system of claim 8 , wherein the mathematical operation includes at least one of a minimum, a maximum, and an average.
10. The system of claim 8 , wherein:
the network traffic analysis data includes a maximum of the statistical data over the each of the plurality of time intervals of the second time granularity; and
the characteristic of the network data is indicated by the maximum of the statistical data over at least one of the plurality of time intervals of the second time granularity substantially exceeding the average of the statistical data over the at least one of the plurality of time intervals of the second time granularity.
11. The system of claim 1 , wherein the each of the plurality of network devices is configured to determine the network traffic analysis data based on performance of a mathematical operation on at least one of statistics and rule-based information associated with the network data, wherein the mathematical operation includes at least one of a convolution, a moving average, a sum of squares, a linear filtering operation, and a nonlinear filtering operation.
12. The system of claim 11 , wherein the ranking of the plurality of ports is based on a result of the mathematical operation on the network data.
13. The system of claim 1 , wherein each of the plurality of network devices is configured to generate an alert indication associated with the corresponding ones of the plurality of ports based on detection of the characteristic in the network data traversing the corresponding ones of the plurality of ports by the each of the plurality of network devices.
14. The system of claim 13 , wherein the ranking of the plurality of ports is based on whether the alert indication is present for the each of the plurality of ports.