Systems and methods for determining flow and path analytics of an application of a network using sampled packet inspection

1. A method for monitoring a status of an application used by a network by selectively mirroring packets transmitted by each switch of a plurality of switches on the network, the method comprising:

generating, by a server, a plurality of stateless mirroring parameters, wherein each stateless mirroring parameter comprises an instruction to mirror a respective type of packet independent of packet flow;

transmitting, by the server over the network, the plurality of stateless mirroring parameters to each switch of the plurality of switches on the network;

receiving, by the server over the network, from a switch of the plurality of switches, a hyper text transfer protocol (HTTP) packet that was mirrored by the switch according to a stateless mirroring parameter of the plurality of stateless mirroring parameters and a mirroring command through a port analyzer at the switch;

executing, by the server, an analysis of contents of the HTTP packet;

identifying, based on the analysis, a uniform resource locator (URL) and an end service corresponding to the HTTP packet based on the URL;

determining, based at least in part on an association between the end service and the application used by the network, the application from which data is being requested; and

determining, by the server, the status of the application based on results of the analysis.

2. The method of claim 1 , wherein the executing the analysis comprises:

extracting, by the server, an HTTP header from the HTTP packet;

determining, by the server, a browser identified within the HTTP header; and

identifying, by the server, the application from which data is being requested by the HTTP packet based on the browser.

3. The method of claim 2 , wherein the determining comprises:

comparing extracted HTTP header data to known data relating to the browser;

comparing the extracted HTTP header data to a template that reflects the URL; and

determining that the extracted HTTP header data matches the template.

4. The method of claim 1 , wherein the receiving the HTTP packet comprises:

receiving, by the server over the network, the HTTP packet using a sampled flow (SFlow) protocol.

5. The method of claim 1 , wherein the HTTP packet comprises an ingress port and an egress port of a sampled packet.

6. The method of claim 1 , further comprising:

transmitting, by the server over the network, a configuration to each switch of the plurality of switches based on a periodic schedule.

7. The method of claim 1 , wherein the plurality of stateless minoring parameters is an access control list (ACL).

8. The method of claim 1 , where the instruction of each stateless minoring parameter of the plurality of stateless minoring parameters causes selective mirroring of one HTTP packet out of a fixed number of HTTP packets.

9. The method of claim 1 , where the instruction of each stateless minoring parameter of the plurality of stateless minoring parameters causes mirroring of packets based at least in part on whether the HTTP packet contains data matching a predetermined pattern at a predetermined location.

10. The method of claim 1 , wherein the port analyzer is an Encapsulated Remote Switched Port Analyzer (ERSPAN).

11. A system for monitoring a status of an application used by a network by selectively mirroring packets transmitted by each switch of a plurality of switches on the network, the system comprising:

communications circuitry; and

control circuitry configured to:

generate a plurality of stateless mirroring parameters, wherein each stateless mirroring parameter comprises an instruction to mirror a respective type of packet independent of packet flow;

transmit, using the communications circuitry over the network, the plurality of stateless mirroring parameters to each switch of the plurality of switches on the network;

receive, using the communications circuitry over the network, from a switch of the plurality of switches, a hyper text transfer protocol (HTTP) packet that was mirrored by the switch according to a stateless mirroring parameter of the plurality of stateless mirroring parameters and a mirroring command through a port analyzer at the switch;

execute an analysis of contents of the HTTP packet;

identify, based on the analysis, an end service corresponding to the HTTP packet;

determine, based at least in part on an association between the end service and the application used by the network, the application from which data is being requested; and

determine the status of the application based on results of the analysis.

12. The system of claim 11 , wherein to execute the analysis, the control circuitry is further configured to:

extract an HTTP header from the HTTP packet;

determine at least one of a browser and a uniform resource locator (URL) identified within the HTTP header; and

identify the application from which data is being requested by the HTTP packet based on the at least one of the browser and the URL.

13. The system of claim 11 , wherein to receive the HTTP packet, the control circuitry is further configured to:

receive, using the communications circuitry over the network, the HTTP packet using a sampled flow (SFlow) protocol.

14. The system of claim 11 , wherein the HTTP packet comprises an ingress port and an egress port of a sampled packet.

15. The system of claim 11 , where the instruction of each stateless minoring parameter of the plurality of stateless mirroring parameters causes selective mirroring of one HTTP packet out of a fixed number of HTTP packets.

16. The system of claim 11 , where the instruction of each stateless minoring parameter of the plurality of stateless minoring parameters causes mirroring of packets based at least in part on whether the HTTP packet contains data matching a predetermined pattern at a predetermined location.

17. The system of claim 11 , wherein the port analyzer is an Encapsulated Remote Switched Port Analyzer (ERSPAN).

18. A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:

generating a plurality of stateless mirroring parameters, wherein each stateless mirroring parameter comprises an instruction to mirror a respective type of packet;

transmitting, over a network, the plurality of stateless mirroring parameters to each switch of a plurality of switches on the network;

receiving, over the network, from a switch of the plurality of switches, a packet that was mirrored by the switch according to a stateless mirroring parameter of the plurality of stateless mirroring parameters;

determining the respective type of the packet;

executing an analysis of contents of the packet based on the respective type of the packet;

identifying, based on the analysis, an end service corresponding to the packet;

determining, based at least in part on an association between the end service and an application used by the network, the application, from which data is being requested;

and determining a status of the application based on results of the analysis.

19. The non-transitory computer-readable medium of claim 18 , wherein the packet is a hyper text transfer protocol (HTTP) packet, and wherein the executing the analysis comprises:

extracting an HTTP header from the packet;

determining at least one of a browser and a uniform resource locator (URL) identified within the HTTP header; and

identifying the application from which data is being requested by the packet based on the at least one of the browser and the URL.

20. The non-transitory computer-readable medium of claim 19 , wherein the determining comprises:

comparing extracted HTTP header data to known data relating to the browser;

comparing the extracted HTTP header data to a template that reflects the URL; and

determining that the extracted HTTP header data matches the template.

21. The non-transitory computer-readable medium of claim 18 , wherein the receiving the packet comprises:

receiving, over the network, the packet using a sampled flow (SFlow) protocol.