Automatically determining locations of network monitors in a communication network
View Patent ↗Automatically identifying a location of a network monitor within a network topology is described. A location of a network monitor within a network topology (which can, and often does, change structure, constituent devices, or both) is determined by monitoring transmissions passing through the network link to which the network monitor is connected. The network monitor uses locally unique device identifiers present in a network transmission to identify the devices or ports most commonly communicating with each other.
1. A computer implemented method for identifying a location of a network monitor within a network comprising a plurality of devices, the method comprising:
receiving address information from a plurality of switches in the network, the address information describing which of the plurality of devices are connected to each of the plurality of switches;
determining, based on the address information, a graph of a network topology comprising the plurality of devices interconnected through the plurality of switches and over a plurality of communication paths, the graph not including the location of the network monitor;
receiving, using the network monitor, a first transmission between a source device and a destination device, of the plurality of devices, through a first communication path of the plurality of communication paths, wherein the network monitor is coupled to the first communication path;
based on the first transmission, determining an identifier of the source device and an identifier of the destination device;
determining, using the identifiers of the source device and the destination device, and the graph of the network topology, at least one candidate location of the network monitor in the network between the source device and the destination device, the at least one candidate location comprising the first communication path; and
associating the network monitor with the at least one candidate location.
2. The method of claim 1 , wherein determining the graph of the network topology comprises:
identifying a first switch and a second switch of the network, the first switch maintaining a first list of devices connected to the first switch and the second switch maintaining a second list of devices connected to the second switch;
determining a connection relationship between the first switch and the second switch; and
combining the first list of devices connected to the first switch and the second list of devices connected to the second switch based on the determined connection relationship between the first switch and the second switch.
3. The method of claim 1 , wherein determining the at least one candidate location of the network monitor comprises:
using the identifier of the source device and the graph of the network topology, identifying at least one communication path between the source device and a switch that could have transmitted the first transmission from the source device;
using the identifier of the destination device and the graph of the network topology, identifying at least one communication path between the destination device and the switch that could have transmitted the first transmission to the destination device; and
identifying as the at least one candidate location of the network monitor the at least one communication path in the graph between the source device and the switch and the at least one communication path in the graph between the destination device and the switch.
4. The method of claim 3 , further comprising:
receiving, using the network monitor, a second transmission from the source device to a different destination device;
using an identifier of the different destination device and the graph of the network topology, identifying at least one additional communication path between the different destination device and the switch that could have transmitted the second transmission to the different destination device; and
updating the candidate locations to include only communication paths that could have transmitted both the first transmission and the second transmission.
5. The method of claim 1 , further comprising:
receiving, using the network monitor, a second transmission between the source device and the destination device through a second communication path of the plurality; and
using the second transmission and the first transmission to identify a location of the network monitor in the network between the source device and the destination device that includes the first communication path and the second communication path.
6. A computer program product stored on a non-transitory computer-readable medium that includes instructions that, when loaded into memory, cause a processor to:
receive address information from a plurality of switches in a network comprising a plurality of devices, the address information describing which of the plurality of devices are connected to each of the plurality of switches;
determine, based on the address information, a graph of a network topology comprising the plurality of devices interconnected through the plurality of switches and over a plurality of communication paths, the graph not including a location of the network monitor;
receive, using the network monitor, a first transmission between a source device and a destination device, of the plurality of devices, through a first communication path of the plurality of communication paths, wherein the network monitor is coupled to the first communication path;
based on the first transmission, determine an identifier of the source device and an identifier of the destination device;
determine, using the identifiers of the source device and the destination device, and the graph of the network topology, at least one candidate location of the network monitor in the network between the source device and the destination device, the at least one candidate location comprising the first communication path; and
associate the network monitor with the at least one candidate location.
7. The computer program product of claim 6 , wherein to determine the graph of the network topology, the processor to:
identify a first switch and a second switch of the network, the first switch maintaining a first list of devices connected to the first switch and the second switch maintaining a second list of devices connected to the second switch;
determine a connection relationship between the first switch and the second switch; and
combine the first list of devices connected to the first switch and the second list of devices connected to the second switch based on the determined connection relationship between the first switch and the second switch.
8. The computer program product of claim 6 , wherein to determine the at least one candidate location of the network monitor, the processor to:
use the identifier of the source device and the graph of the network topology, identifying at least one communication path between the source device and a switch that could have transmitted the first transmission from the source device;
use the identifier of the destination device and the graph of the network topology, identifying at least one communication path between the destination device and the switch that could have transmitted the first transmission to the destination device; and
identify as the at least one candidate location of the network monitor the at least one communication path in the graph between the source device and the switch and the at least one communication path in the graph between the destination device and the switch.
9. The computer program product of claim 8 , wherein the instructions further cause the processor to:
receive, using the network monitor, a second transmission from the source device to a different destination device;
use an identifier of the different destination device and the graph of the network topology, identifying at least one additional communication path between the different destination device and the switch that could have transmitted the second transmission to the different destination device; and
update the candidate locations to include only communication paths that could have transmitted both the first transmission and the second transmission.
10. The computer program product of claim 6 , wherein the instructions further cause the processor to:
receive, using the network monitor, a second transmission between the source device and the destination device through a second communication path of the plurality; and
use the second transmission and the first transmission to identify a location of the network monitor in the network between the source device and the destination device that includes the first communication path and the second communication path.
11. A system for identifying a location of a network monitor within a network comprising a plurality of devices, the system comprising:
memory; and
one or more processors to:
receive address information from a plurality of switches in the network, the address information describing which of the plurality of devices are connected to each of the plurality of switches;
determine, based on the address information, a graph of a network topology comprising the plurality of devices interconnected through the plurality of switches and over a plurality of communication paths, the graph not including the location of the network monitor;
receive, using the network monitor, a first transmission between a source device and a destination device, of the plurality of devices, through a first communication path of the plurality of communication paths, wherein the network monitor is coupled to the first communication path;
based on the first transmission, determine an identifier of the source device and an identifier of the destination device;
determine, using the identifiers of the source device and the destination device, and the graph of the network topology, at least one candidate location of the network monitor in the network between the source device and the destination device, the at least one candidate location comprising the first communication path; and
associate the network monitor with the at least one candidate location.
12. The system of claim 11 , wherein to determine the graph of the network topology, the one or more processors to:
identify a first switch and a second switch of the network, the first switch maintaining a first list of devices connected to the first switch and the second switch maintaining a second list of devices connected to the second switch;
determine a connection relationship between the first switch and the second switch; and
combine the first list of devices connected to the first switch and the second list of devices connected to the second switch based on the determined connection relationship between the first switch and the second switch.
13. The system of claim 11 , wherein to determine the at least one candidate location of the network monitor, the one or more processors to:
use the identifier of the source device and the graph of the network topology, identifying at least one communication path between the source device and a switch that could have transmitted the first transmission from the source device;
use the identifier of the destination device and the graph of the network topology, identifying at least one communication path between the destination device and the switch that could have transmitted the first transmission to the destination device; and
identifying as the at least one candidate location of the network monitor the at least one communication path in the graph between the source device and the switch and the at least one communication path in the graph between the destination device and the switch.
14. The system of claim 11 , the one or more processors further to:
receive, using the network monitor, a second transmission from the source device to a different destination device;
use an identifier of the different destination device and the graph of the network topology, identifying at least one additional communication path between the different destination device and the switch that could have transmitted the second transmission to the different destination device; and
update the candidate locations to include only communication paths that could have transmitted both the first transmission and the second transmission.
15. The system of claim 11 , the one or more processors further to:
receive, using the network monitor, a second transmission between the source device and the destination device through a second communication path of the plurality; and
use the second transmission and the first transmission to identify a location of the network monitor in the network between the source device and the destination device that includes the first communication path and the second communication path.