Correlating network traffic that crosses opaque endpoints

1. A method for monitoring network traffic using one or more network monitoring computers, comprising:

monitoring two or more network segments that are coupled by one or more bridge devices, wherein the one or more bridge devices modify network traffic passed from one network segment to another network segment;

determining one or more flows in one or more network segments based on network traffic associated with the one or more network segments;

determining one or more other flows in one or more other network segments based on other network traffic associated with the one or more other network segments;

providing a correlation score for two or more flows that are in different network segments based on one or more of a correlation model, a characteristic of the one or more flows, or another characteristic of the one or more other flows;

modifying one or more timing characteristics associated with the one or more flows in the one or more network segments;

determining the one or more other flows in the one or more other network segments based on the one or more timing characteristics;

updating the correlation score for the two or more flows based on the timing characteristics;

determining two or more related flows based on a value of the correlation score of the two or more related flows, wherein the two or more related flows are located in different network segments; and

providing a report that includes information about the two or more related flows.

2. The method of claim 1 , wherein modifying the network traffic further comprises:

obscuring one or more characteristics of the network traffic passed between network segments, wherein the one or more characteristics of the network traffic includes one or more of source tuple information, destination tuple information, sequence numbers, protocol header fields, or payload content.

3. The method of claim 1 , further comprising:

modifying the network traffic associated with the one or more flows in the one or more network segments to include fingerprint information, wherein the fingerprint information is passed by the one or more bridge devices from the one or more network segments to the one or more other network segments;

determining the one or more other flows in the one or more other network segments based on the fingerprint information; and

updating the correlation score for the two or more flows based on the fingerprint information.

4. The method of claim 1 , further comprising:

determining one or more transactions associated with the one or more flows in the one or more network segments based on one or more characteristics of the one or more flows, wherein information associated with the one or more transactions is included in network traffic in the one or more network segments and other network traffic is included in the one or more other network segments;

determining the one or more other flows in the one or more other network segments based on the one or more transactions; and

updating the correlation score for the two or more flows based on the one or more transactions.

5. The method of claim 1 , further comprising:

determining one or more control flows in the one or more network segments based on one or more characteristics of the one or more control flows;

determining one or more content flows in the one or more other network segments based on one or more characteristics of the one or more content flows; and

updating the correlation score for the one or more control flows and the one or more content flows.

6. The method of claim 1 , further comprises:

progressively updating information associated with one or more characteristics of the one or more flows based on monitoring the network traffic in the one or more network segments;

progressively updating other information associated with one or more other characteristics of the one or more other flows based on monitoring other network traffic in the one or more other network segments; and

updating the correlation score based on the updated information and the updated other information.

7. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more networking monitoring computers perform the method comprising:

monitoring two or more network segments that are coupled by one or more bridge devices, wherein the one or more bridge devices modify network traffic passed from one network segment to another network segment;

determining one or more flows in one or more network segments based on network traffic associated with the one or more network segments;

determining one or more other flows in one or more other network segments based on other network traffic associated with the one or more other network segments;

providing a correlation score for two or more flows that are in different network segments based on one or more of a correlation model, a characteristic of the one or more flows, or another characteristic of the one or more other flows;

modifying one or more timing characteristics associated with the one or more flows in the one or more network segments;

determining the one or more other flows in the one or more other network segments based on the one or more timing characteristics;

updating the correlation score for the two or more flows based on the timing characteristics;

determining two or more related flows based on a value of the correlation score of the two or more related flows, wherein the two or more related flows are located in different network segments; and

providing a report that includes information about the two or more related flows.

8. The processor readable non-transitory storage media of claim 7 , wherein modifying the network traffic further comprises:

obscuring one or more characteristics of the network traffic passed between network segments, wherein the one or more characteristics of the network traffic includes one or more of source tuple information, destination tuple information, sequence numbers, protocol header fields, or payload content.

9. The processor readable non-transitory storage media of claim 7 , further comprising:

modifying the network traffic associated with the one or more flows in the one or more network segments to include fingerprint information, wherein the fingerprint information is passed by the one or more bridge devices from the one or more network segments to the one or more other network segments;

determining the one or more other flows in the one or more other network segments based on the fingerprint information; and

updating the correlation score for the two or more flows based on the fingerprint information.

10. The processor readable non-transitory storage media of claim 7 , further comprising:

determining one or more transactions associated with the one or more flows in the one or more network segments based on one or more characteristics of the one or more flows, wherein information associated with the one or more transactions is included in network traffic in the one or more network segments and other network traffic is included in the one or more other network segments;

determining the one or more other flows in the one or more other network segments based on the one or more transactions; and

updating the correlation score for the two or more flows based on the one or more transactions.

11. The processor readable non-transitory storage media of claim 7 , further comprising:

determining one or more control flows in the one or more network segments based on one or more characteristics of the one or more control flows;

determining one or more content flows in the one or more other network segments based on one or more characteristics of the one or more content flows; and

updating the correlation score for the one or more control flows and the one or more content flows.

12. The processor readable non-transitory storage media of claim 7 , further comprises:

progressively updating information associated with one or more characteristics of the one or more flows based on monitoring the network traffic in the one or more network segments;

progressively updating other information associated with one or more other characteristics of the one or more other flows based on monitoring other network traffic in the one or more other network segments; and

updating the correlation score based on the updated information and the updated other information.

13. A system for monitoring network traffic in a network, comprising:

one or more network monitoring computers (NMCs), wherein each of the one or more NMCs comprises:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

monitoring two or more network segments that are coupled by one or more bridge devices, wherein the one or more bridge devices modify network traffic passed from one network segment to another network segment;

determining one or more flows in one or more network segments based on network traffic associated with the one or more network segments;

determining one or more other flows in one or more other network segments based on other network traffic associated with the one or more other network segments;

providing a correlation score for two or more flows that are in different network segments based on one or more of a correlation model, a characteristic of the one or more flows, or another characteristic of the one or more other flows;

modifying one or more timing characteristics associated with the one or more flows in the one or more network segments;

determining the one or more other flows in the one or more other network segments based on the one or more timing characteristics;

updating the correlation score for the two or more flows based on the timing characteristics;

determining two or more related flows based on a value of the correlation score of the two or more related flows, wherein the two or more related flows are located in different network segments; and

providing a report that includes information about the two or more related flows; and

one or more client computers, wherein each of the one or more client computers comprises:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing a portion of the network traffic associated with the one or more flows.

14. The system of claim 13 , wherein modifying the network traffic further comprises:

obscuring one or more characteristics of the network traffic passed between network segments, wherein the one or more characteristics of the network traffic includes one or more of source tuple information, destination tuple information, sequence numbers, protocol header fields, or payload content.

15. The system of claim 13 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

modifying the network traffic associated with the one or more flows in the one or more network segments to include fingerprint information, wherein the fingerprint information is passed by the one or more bridge devices from the one or more network segments to the one or more other network segments;

determining the one or more other flows in the one or more other network segments based on the fingerprint information; and

updating the correlation score for the two or more flows based on the fingerprint information.

16. The system of claim 13 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

determining one or more transactions associated with the one or more flows in the one or more network segments based on one or more characteristics of the one or more flows, wherein information associated with the one or more transactions is included in network traffic in the one or more network segments and other network traffic is included in the one or more other network segments;

determining the one or more other flows in the one or more other network segments based on the one or more transactions; and

updating the correlation score for the two or more flows based on the one or more transactions.

17. The system of claim 13 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

determining one or more control flows in the one or more network segments based on one or more characteristics of the one or more control flows;

determining one or more content flows in the one or more other network segments based on one or more characteristics of the one or more content flows; and

updating the correlation score for the one or more control flows and the one or more content flows.

18. The system of claim 13 , wherein the one or more NMC processors execute instructions that perform actions, further comprising:

progressively updating information associated with one or more characteristics of the one or more flows based on monitoring the network traffic in the one or more network segments;

progressively updating other information associated with one or more other characteristics of the one or more other flows based on monitoring other network traffic in the one or more other network segments; and

updating the correlation score based on the updated information and the updated other information.

19. A network monitoring computer (NMC) for monitoring network traffic between one or more computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

monitoring two or more network segments that are coupled by one or more bridge devices, wherein the one or more bridge devices modify network traffic passed from one network segment to another network segment;

determining one or more flows in one or more network segments based on network traffic associated with the one or more network segments;

determining one or more other flows in one or more other network segments based on other network traffic associated with the one or more other network segments;

providing a correlation score for two or more flows that are in different network segments based on one or more of a correlation model, a characteristic of the one or more flows, or another characteristic of the one or more other flows;

modifying one or more timing characteristics associated with the one or more flows in the one or more network segments;

determining the one or more other flows in the one or more other network segments based on the one or more timing characteristics;

updating the correlation score for the two or more flows based on the timing characteristics;

determining two or more related flows based on a value of the correlation score of the two or more related flows, wherein the two or more related flows are located in different network segments; and

providing a report that includes information about the two or more related flows.

20. The NMC of claim 19 , wherein modifying the network traffic further comprises:

obscuring one or more characteristics of the network traffic passed between network segments, wherein the one or more characteristics of the network traffic includes one or more of source tuple information, destination tuple information, sequence numbers, protocol header fields, or payload content.

21. The NMC of claim 19 , wherein the one or more processors execute instructions that perform actions, further comprising:

modifying the network traffic associated with the one or more flows in the one or more network segments to include fingerprint information, wherein the fingerprint information is passed by the one or more bridge devices from the one or more network segments to the one or more other network segments;

determining the one or more other flows in the one or more other network segments based on the fingerprint information; and

updating the correlation score for the two or more flows based on the fingerprint information.

22. The NMC of claim 19 , wherein the one or more processors execute instructions that perform actions, further comprising:

determining one or more transactions associated with the one or more flows in the one or more network segments based on one or more characteristics of the one or more flows, wherein information associated with the one or more transactions is included in network traffic in the one or more network segments and other network traffic is included in the one or more other network segments;

determining the one or more other flows in the one or more other network segments based on the one or more transactions; and

updating the correlation score for the two or more flows based on the one or more transactions.

23. The NMC of claim 19 , wherein the one or more processors execute instructions that perform actions, further comprising:

determining one or more control flows in the one or more network segments based on one or more characteristics of the one or more control flows;

determining one or more content flows in the one or more other network segments based on one or more characteristics of the one or more content flows; and

updating the correlation score for the one or more control flows and the one or more content flows.

24. The NMC of claim 19 , wherein the one or more processors execute instructions that perform actions, further comprising:

progressively updating information associated with one or more characteristics of the one or more flows based on monitoring the network traffic in the one or more network segments;

progressively updating other information associated with one or more other characteristics of the one or more other flows based on monitoring other network traffic in the one or more other network segments; and

updating the correlation score based on the updated information and the updated other information.