Bypass detection analysis of network traffic to determine transceiving of network traffic via peer networks
Embodiments generally disclosed herein include a computer-implemented method for monitoring and correlating network traffic data associated with a primary network that is in communication with a plurality of secondary networks. The method generates a network traffic data set by monitoring network traffic between the primary network and the plurality of secondary networks. The method also determines a mapping of network connectivity by monitoring inter-network routing information between the primary network and the plurality of secondary networks. In addition, the method generates a traffic measurement data set by monitoring network utilization statistics between the primary network and the plurality of secondary networks. With the collected data sets, the method then calculates a relational network mapping between the primary network and the plurality of secondary networks by correlating the network traffic data set, the mapping of network connectivity, and the traffic measurement data set.
1. A system comprising:
a primary network comprising a plurality of network devices selected from a group consisting of: switches, routers, servers, and gateways; wherein the primary network is connected to a plurality of secondary networks, and wherein the secondary networks comprise both customer networks and peer networks; and
a network correlator module stored as instructions in memory and executable by one or more of said network devices, the network correlator module configured to
perform bypass detection analysis of the secondary networks by determining which customer networks directly connected to the primary network indirectly transceive network traffic with the primary network via one or more peer networks;
identify a first set of origin or destination Autonomous System Numbers (ASNs) associated with customer network transmissions across the primary network; and
when at least one ASN of a peer network appears in a path between an ASN associated with the at least one customer network and an ASN associated with the primary network, identifying the at least one customer network as the bypass opportunity.
2. A system as recited in claim 1 , wherein the network correlator module is further configured to:
identify a second set of ingress or egress ASNs associated with secondary networks directly connected to the primary network;
compare the first set with the second set; and
when an ASN in the first set and second set overlaps, identifying a bypass opportunity when the overlapping ASN has one or more other ASNs in the transmission path between the origin or destination ASN and the ASN of the primary network.
3. A system as recited in claim 2 further comprising:
a network flow module configured to generate a network traffic data set by monitoring network traffic between the primary network and the plurality of secondary networks;
a network connectivity module configured to determine a mapping of network connectivity by monitoring inter-network routing information between the primary network and the plurality of secondary networks; and
wherein the network correlator module is further configured to calculate a relational network mapping between the primary network and the plurality of secondary networks by correlating the network traffic data set and the mapping of network connectivity.
4. A system as recited in claim 3 further comprising:
a graphical user interface; and
wherein the network correlator module is further configured to render, in the graphical user interface, a graphical display of:
the relational network mapping between the primary network and the plurality of secondary networks; and
at least one of a customer network and a peer network associated with the identified bypass opportunity.
5. A system as recited in claim 1 further comprising:
a network flow module configured to generate a network traffic data set by monitoring network traffic between the primary network and the plurality of secondary networks;
a network connectivity module configured to determine a mapping of network connectivity by monitoring inter-network routing information between the primary network and the plurality of secondary networks; and
wherein the network correlator module is further configured to calculate a relational network mapping between the primary network and the plurality of secondary networks by correlating the network traffic data set and the mapping of network connectivity.
6. A system as recited in claim 1 further comprising:
a graphical user interface; and
wherein the network correlator module is further configured to render, in the graphical user interface, a graphical display of:
the relational network mapping between the primary network and the plurality of secondary networks; and
at least one of a customer network and a peer network associated with the identified bypass opportunity.
7. A method for performing bypass detection analysis in a primary network connected to a plurality of secondary networks, wherein the secondary networks comprise both customer networks and peer networks, the method comprising:
receiving, at a network correlator of the primary network, connectivity information regarding connections to at least one ingress device of the primary network and at least one egress device of the primary network;
aggregating the connectivity information;
using the aggregated connectivity information to determine at least one customer network directly connected to the primary network that indirectly transceives network traffic with the primary network via at least one peer network;
identifying the at least one customer network as a bypass opportunity, wherein identifying the at least one customer network as a bypass opportunity comprises identifying a first set of origin or destination Autonomous System Numbers (ASNs) associated with transmissions of the at least one customer network across the primary network; and when at least one ASN of a peer network appears in a path between an ASN associated with the at least one customer network and an ASN associated with the primary network, identifying the at least one customer network as the bypass opportunity; and
displaying the bypass opportunity in a user interface.
8. The method of claim 7 , wherein displaying the bypass opportunity comprises displaying an identification of the at least one customer network and the at least one peer network.
9. A system for performing bypass detection analysis in a primary network connected to a plurality of secondary networks, wherein the secondary networks comprise both customer networks and peer networks, the system comprising:
at least one processor;
memory, operatively connected to the at least one processor and containing instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising:
receiving, at a network correlator of the primary network, connectivity information regarding connections to at least one ingress device of the primary network and at least one egress device of the primary network;
aggregating the connectivity information;
using the aggregated connectivity information to determine at least one customer network directly connected to the primary network that indirectly transceives network traffic with the primary network via at least one peer network;
identifying the at least one customer network as a bypass opportunity, wherein identifying the at least one customer network as a bypass opportunity comprises identifying a first set of origin or destination Autonomous System Numbers (ASNs) associated with transmissions of the at least one customer network across the primary network; and when at least one ASN of a peer network appears in a path between an ASN associated with the at least one customer network and an ASN associated with the primary network, identifying the at least one customer network as the bypass opportunity; and
displaying the bypass opportunity in a user interface.
10. The system of claim 9 , wherein displaying the bypass opportunity comprises displaying an identification of the at least one customer network and the at least one peer network.