Bypass detection analysis of secondary network traffic
Embodiments generally disclosed herein include a computer-implemented method for monitoring and correlating network traffic data associated with a primary network that is in communication with a plurality of secondary networks. The method generates a network traffic data set by monitoring network traffic between the primary network and the plurality of secondary networks. The method also determines a mapping of network connectivity by monitoring inter-network routing information between the primary network and the plurality of secondary networks. In addition, the method generates a traffic measurement data set by monitoring network utilization statistics between the primary network and the plurality of secondary networks. With the collected data sets, the method then calculates a relational network mapping between the primary network and the plurality of secondary networks by correlating the network traffic data set, the mapping of network connectivity, and the traffic measurement data set.
1. A system comprising:
a primary network comprising a plurality of network devices selected from a group consisting of: switches, routers, servers, and gateways; wherein the primary network is connected to a plurality of secondary networks, and wherein the secondary networks comprise both customer networks and peer networks;
a network correlator module stored as instructions in memory and executable by one or more of said network devices, the network correlator module configured to perform bypass detection analysis of the secondary networks by determining which customer networks directly connected to the primary network indirectly transceive network traffic with the primary network via one or more peer networks;
a network flow module configured to generate a network traffic data set by monitoring network traffic between the primary network and the plurality of secondary networks; and
a network connectivity module configured to determine a mapping of network connectivity by monitoring inter-network routing information between the primary network and the plurality of secondary networks, wherein
the network correlator module is further configured to calculate a relational network mapping between the primary network and the plurality of secondary networks by correlating the network traffic data set and the mapping of network connectivity.
2. A system as recited in claim 1 , wherein the network correlator module is further configured to:
identify a first set of origin or destination Autonomous System Numbers (ASNs) associated with customer network transmissions across the primary network;
identify a second set of ingress or egress ASNs associated with secondary networks directly connected to the primary network;
compare the first set with the second set; and
when an ASN in the first set and second set overlaps, identifying a bypass opportunity when the overlapping ASN has one or more other ASNs in the transmission path between the origin or destination ASN and the ASN of the primary network.
3. A system as recited in claim 1 further comprising:
a graphical user interface; and
wherein the network correlator module is further configured to render, in the graphical user interface, a graphical display of:
the relational network mapping between the primary network and the plurality of secondary networks; and
at least one of a customer network and a peer network associated with the identified bypass opportunity.
4. A system as recited in claim 1 further comprising:
a network flow module configured to generate a network traffic data set by monitoring network traffic between the primary network and the plurality of secondary networks;
a network connectivity module configured to determine a mapping of network connectivity by monitoring inter-network routing information between the primary network and the plurality of secondary networks; and
wherein the network correlator module is further configured to calculate a relational network mapping between the primary network and the plurality of secondary networks by correlating the network traffic data set and the mapping of network connectivity.
5. A system as recited in claim 1 further comprising:
a graphical user interface; and
wherein the network correlator module is further configured to render, in the graphical user interface, a graphical display of:
the relational network mapping between the primary network and the plurality of secondary networks; and
at least one of a customer network and a peer network associated with the identified bypass opportunity.