SYSTEMS FOR AND METHODS OF MODELLING, ANALYSIS AND MANAGEMENT OF DATA NETWORKS
Systems for and methods of modelling, analyzing and managing data networks are provided. In an embodiment, a plurality of network device interfaces are configured to collect state information for a plurality of network devices. A computer-implemented model of the network comprises a data structure, which may be graph-based. The data structure comprises a plurality of snapshots of the network, each snapshot representing the network at a particular point in time, and the data structure comprises a representation of possible data flow and data packet processing within the network. The data structure contains normalized representations of the network devices corresponding to the location. The normalized representation for each device contains a set of packet processing rules. A user-interface is configured to receive queries from a user that request verification of network policies and predictions of network behavior. The user-interface is configured to display responses to the queries that are obtained using the data structure.
1 . A network verification computer system for a network that includes a plurality of network devices having network interfaces that are connected to each other through data communication links, the computer system comprising a processor that is programmed to:
generate a user-interface configured to receive queries from a user that are input using the input device, and request verification of network policies and predictions of network behavior, and
process the queries using a graph data structure that stores information about the network in a plurality of forwarding nodes and forwarding edges to generate query results that are displayed to the user, wherein
each of the forwarding nodes represents a set of packets to be processed at one of a plurality of network locations, the network locations including first and second network locations that are within a same one of the network devices, and
the plurality of forwarding nodes include a first forwarding node representing a first set of packets to be processed at the first network location, a second forwarding node representing the first set of packets to be processed at the second network location, a third forwarding node representing a second set of packets to be processed at the first network location, and a fourth forwarding node representing the second set of packets to be processed at the second network location, and each of the first, second, third, and fourth forwarding nodes is associated with attributes of the same one of the network devices.
2 . The network verification computer system of claim 1 , wherein
each of the forwarding edges represents packet processing rules of one of the forwarding nodes.
3 . The network verification computer system of claim 1 , wherein
the processor processes one of the queries that includes a traffic criteria and a location criteria, to generate a query result that includes one or more sets of packets that meet the traffic criteria and one or more network devices that meet the location criteria.
4 . The network verification computer system of claim 3 , wherein
in the graph data structure, each of the forwarding nodes is associated with attributes of one of the network devices, and
the processor examines the forwarding nodes and forwarding edges of the graph data structure to find the sets of packets that meet the traffic criteria and examines the attributes of the network devices to find the network devices that meet the location criteria.
5 . The network verification computer system of claim 1 , wherein the graph data structure stores information about the network at a first point in time in a first set of forwarding nodes and forwarding edges and stores information about the network at a second point in time that is different from the first point in time in a second set of forwarding nodes and forwarding edges.
6 . The network verification computer system of claim 1 , wherein the graph data structure is generated based on state information of the network devices.
7 . The network verification computer system of claim 6 , wherein the network devices are virtual network devices and the state information of the virtual network devices is collected from a controller of a software-defined network.
8 . The network verification computer system of claim 7 , wherein the processor is further programmed to:
obtain modifications to packet processing rules of the network devices;
generate a graph data structure that stores information about a hypothetical network that includes the network devices with modified packet processing rules; and
verify, using the graph data structure, whether or not the modifications comply with the network policies.
9 . The network verification computer system of claim 8 , wherein the processor is further programmed to:
upon verifying that the modifications comply with the network policies, send the modifications to the network devices for adoption by the network devices.
10 . A computer-implemented method of verifying a network that includes a plurality of network devices having network interfaces that are connected to each other through data communication links, said method comprising:
generating a user-interface configured to receive queries from a user that are input using the input device, and request verification of network policies and predictions of network behavior, and
processing the queries using a graph data structure that stores information about the network in a plurality of forwarding nodes and forwarding edges to generate query results that are displayed to the user, wherein
each of the forwarding nodes represents a set of packets to be processed at one of a plurality of network locations, the network locations including first and second network locations that are within a same one of the network devices, and
the plurality of forwarding nodes include a first forwarding node representing a first set of packets to be processed at the first network location, a second forwarding node representing the first set of packets to be processed at the second network location, a third forwarding node representing a second set of packets to be processed at the first network location, and a fourth forwarding node representing the second set of packets to be processed at the second network location, and each of the first, second, third, and fourth forwarding nodes is associated with attributes of the same one of the network devices.
11 . The method of claim 10 , wherein
each of the forwarding edges represents packet processing rules of one of the forwarding nodes.
12 . The method of claim 10 , wherein
one of the queries includes a traffic criteria and a location criteria, and
the processing of said one of the queries generates a query result that includes one or more sets of packets that meet the traffic criteria and one or more network devices that meet the location criteria.
13 . The method of claim 12 , wherein
in the graph data structure, each of the forwarding nodes is associated with attributes of one of the network devices, and
during the processing of said one of the queries, the forwarding nodes and forwarding edges of the graph data structure are examined to find the sets of packets that meet the traffic criteria and the attributes of the network devices are examined to find the network devices that meet the location criteria.
14 . The method of claim 10 , wherein the graph data structure stores information about the network at a first point in time in a first set of forwarding nodes and forwarding edges and stores information about the network at a second point in time that is different from the first point in time in a second set of forwarding nodes and forwarding edges.
15 . The method of claim 10 , wherein the graph data structure is generated based on state information of the network devices.
16 . The method of claim 15 , wherein the network devices are virtual network devices and the state information of the virtual network devices is collected from a controller of a software-defined network.
17 . The method of claim 16 , further comprising:
obtaining modifications to packet processing rules of the network devices;
generating a graph data structure that stores information about a hypothetical network that includes the network devices with modified packet processing rules; and
verifying, using the graph data structure, whether or not the modifications comply with the network policies.
18 . The method of claim 17 , further comprising:
upon verifying that the modifications comply with the network policies, sending the modifications to the network devices for adoption by the network devices.
19 . A non-transitory computer readable medium comprising instructions to be executed on a processor of a network verification computer system to carry out a method of verifying a network that includes a plurality of network devices having network interfaces that are connected to each other through data communication links, said method comprising:
generating a user-interface configured to receive queries from a user that are input using the input device, and request verification of network policies and predictions of network behavior, and
processing the queries using a graph data structure that stores information about the network in a plurality of forwarding nodes and forwarding edges to generate query results that are displayed to the user, wherein
each of the forwarding nodes represents a set of packets to be processed at one of a plurality of network locations, the network locations including first and second network locations that are within a same one of the network devices, and
the plurality of forwarding nodes include a first forwarding node representing a first set of packets to be processed at the first network location, a second forwarding node representing the first set of packets to be processed at the second network location, a third forwarding node representing a second set of packets to be processed at the first network location, and a fourth forwarding node representing the second set of packets to be processed at the second network location, and each of the first, second, third, and fourth forwarding nodes is associated with attributes of the same one of the network devices.
20 . The non-transitory computer readable medium of claim 19 , wherein the method further comprises:
obtaining modifications to packet processing rules of the network devices;
generating a graph data structure that stores information about a hypothetical network that includes the network devices with modified packet processing rules; and
verifying, using the graph data structure, whether or not the modifications comply with the network policies.