Techniques for determining network topologies

1. A method, comprising:

monitoring, by a monitoring device in a communication network, messages exchanged between at least a first node, a second node, and a third node;

determining, based on time stamp data associated with each message, one or more latency distributions of paired response times between the first node, the second node, and the third node, the one or more latency distributions include at least a first latency distribution corresponding to response times between the first node and the second node, a second latency distribution corresponding to response times between the first node and the third node, and a third latency distribution corresponding to response times between the second node and the third node;

determining a node topology consistent with the first latency distribution, the second latency distribution, and the third latency distribution;

generating a graph of the node topology showing one or more communication links between one or more of the first node, the second node, or the third node; and

annotating each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the first latency distribution, the second latency distribution, or the third latency distribution.

2. The method of claim 1 , wherein determining the node topology further comprises:

comparing an aggregated latency distribution of the first latency distribution and the second latency distribution to the third latency distribution to determine a position in the node topology for each of the first node, the second node, and the third node.

3. The method of claim 2 , further comprising:

determining the second node is disposed between the first node and the second node in the node topology when the aggregated latency distribution substantially matches the third latency distribution.

4. The method of claim 1 , wherein the monitoring device includes a plurality of distributed monitoring modules operable by one or more of the first node, the second node, and the third node.

5. The method of claim 4 , further comprising:

receiving, by the monitoring device, the time stamp data associated with each message from the plurality of monitoring modules.

6. The method of claim 1 , further comprising:

determine, by the monitoring device, the time stamp data associated with each message based on a unique message identifier, and

wherein, determining the one or more latency distributions, further comprises determining, based on the time stamp data associated with each message and the unique identifier associated with each message, the one or more latency distributions of paired response times for the messages exchanged between the first node, the second node, and the third node.

7. The method of claim 6 , wherein the unique message identifier includes at least one of a packet header, a sequence number, an acknowledgement number, a type, or a size of the message.

8. The method of claim 1 , wherein the first latency distribution represents a first paired response time distribution for the messages exchanged between the first node and the second node, the second latency distribution represents a second paired response time distribution for the messages exchanged between the first node and the third node, and the third latency distribution represents a third paired response time distribution for the messages exchanged between the second node and the third node.

9. The method of claim 1 , further comprising:

determining at least one of the average response time or the median response time for each latency distribution, including the first latency distribution, the second latency distribution, and the third latency distribution, and

wherein, determining the node topology further comprises determining the node topology consistent with the at least one of the average response time or the median response time for each latency distribution.

10. The method of claim 1 , wherein determining the node topology, further comprises:

identifying one or more outlier response times in each latency distribution, including the first latency distribution, the second latency distribution, and the third latency distribution;

removing the one or more outlier response times from each latency distribution; and

generating the at least one of the median response time or the mean response time for each latency distribution after removing the one or more outlier response times.

11. The method of claim 1 , wherein at least one of the first node, the second node, or the third node includes one of a virtual machine, a hypervisor, a switch, or a router.

12. A monitoring device, comprising:

one or more network interfaces to communicate within a communication network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to:

monitor messages exchanged in the communication network between at least a first node, a second node, and a third node;

determine, based on time stamp data associated with each message, one or more latency distributions of paired response times between the first node, the second node, and the third node, the one or more latency distributions include at least a first latency distribution corresponding to response times between the first node and the second node, a second latency distribution corresponding to response times between the first node and the third node, and a third latency distribution corresponding to response times between the second node and the third node;

determine a node topology consistent with the first latency distribution, the second latency distribution, and the third latency distribution;

generate a graph of the node topology showing one or more communication links between one or more of the first node, the second node, or the third node; and

annotate each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the first latency distribution, the second latency distribution, or the third latency distribution.

13. The monitoring device of claim 12 , wherein the process, when executed to determine the node topology, is further operable to:

compare an aggregated latency distribution of the first latency distribution and the second latency distribution to the third latency distribution to determine a position in the node topology for each of the first node, the second node, and the third node.

14. The monitoring device of claim 13 , wherein the process, when executed, is further operable to:

determine the second node is disposed between the first node and the second node in the node topology when the aggregated latency distribution substantially matches the third latency distribution.

15. The monitoring device of claim 12 , further comprising:

a plurality of distributed monitoring modules operable by one or more of the first node, the second node, and the third node, and

wherein, the process, when executed, is further operable to receive the time stamp data associated with each message from the plurality of monitoring modules.

16. The monitoring device of claim 12 , wherein the process, when executed, is further operable to:

determine the time stamp data associated with each message based on a unique message identifier, and

wherein, the process to determine the one or more latency distributions, when executed, is further operable to determine, based on the time stamp data associated with each message and the unique identifier associated with each message, the one or more latency distributions of paired response times for the messages exchanged between the first node, the second node, and the third node.

17. The monitoring device of claim 16 , wherein the unique message identifier includes at least one of a packet header, a sequence number, an acknowledgement number, a type, or a size of the message.

18. The monitoring device of claim 12 , wherein the process, when executed, is further operable to:

determine at least one of the average response time or the median response time for each latency distribution, including the first latency distribution, the second latency distribution, and the third latency distribution, and

wherein, the process to determine the node topology, when executed, is further operable to determine the node topology consistent with at least one of the average response time or the median response time for each latency distribution.

19. The monitoring device of claim 12 , wherein the process to determine the node topology, when executed, is further operable to:

identify one or more outlier response times in each latency distribution, including the first latency distribution, the second latency distribution, and the third latency distribution;

remove the one or more outlier response times from each latency distribution; and

generate the at least one of the median response time or the mean response time for each latency distribution after removing the one or more outlier response times.

20. A tangible, non-transitory, computer-readable media having software encoded thereon, the software, when executed by a processor, operable to:

monitor messages exchanged in the communication network between at least a first node, a second node, and a third node;

determine, based on time stamp data associated with each message, one or more latency distributions of response times between the first node, the second node, and the third node based on time stamp data associated with each message, the one or more latency distributions include at least a first latency distribution corresponding to response times between the first node and the second node, a second latency distribution corresponding to response times between the first node and the third node, and a third latency distribution corresponding to response times between the second node and the third node;

determine a node topology consistent with the first latency distribution, the second latency distribution, and the third latency distribution;

generate a graph of the node topology showing one or more communication links between one or more of the first node, the second node, or the third node; and

annotate each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the first latency distribution, the second latency distribution, or the third latency distribution.