Systems and methods for determining flow and path analytics of an application of a network using sampled packet inspection
Systems and methods are disclosed herein for monitoring health of each switch of a plurality of switches on a network by selectively mirroring packets transmitted by each switch of the plurality of switches. In some embodiments, control circuitry generates a plurality of mirroring parameters, each mirroring parameter comprising an instruction to mirror a respective type of packet. The control circuitry transmits the plurality of mirroring parameters to each switch of the plurality of switches on the network, and receives, from a switch, a packet that was mirrored by the switch according to a mirroring parameter of the plurality of mirroring parameters. The control circuitry determines the respective type of the packet, executes an analysis of contents of the packet based on the respective type of the packet, and determines a health of the switch based on results of the analysis.
1. A method, comprising:
generating a mirroring parameter;
transmitting the mirroring parameter to each switch of a plurality of switches on a network;
receiving, from a switch of the plurality of switches, a packet mirrored by the switch based on the mirroring parameter;
determining a type of the packet;
analyzing contents of the packet based on the type of the packet;
identifying, based on the contents of the packet, a certificate corresponding to data flow of the packet; and
determining, based on the certificate, a security hash key length and an identity of a service providing the data flow.
2. The method of claim 1 , further comprising:
determining a version of a cypher key of the certificate;
comparing the version to a current version;
in response to determining that the version and the current version do not match, determining that the cypher key is outdated; and
logging the determination that the cypher key is outdated.
3. The method of claim 1 , wherein analyzing contents of the packet comprises:
extracting authentication data from the packet;
determining a user identity associated with an end device that caused the packet to be encountered by the switch; and
logging the user identity.
4. The method of claim 1 , further comprising:
transmitting an access control list (ACL) to the switch.
5. The method of claim 1 , wherein receiving the packet comprises receiving the packet using a sampled flow (SFlow) protocol.
6. The method of claim 1 , further comprising:
mirroring the packet based at least in part on whether the packet comprises data matching a predetermined pattern at a predetermined location.
7. The method of claim 1 , wherein the packet is a secure socket layer (SSL) packet or a transport layer security (TLS) packet.
8. A system, comprising:
communications circuitry; and
control circuitry configured to:
generate a mirroring parameter;
transmit the mirroring parameter to each switch of a plurality of switches on a network;
receive, from a switch of the plurality of switches, a packet mirrored by the switch based on the mirroring parameter;
determine a type of the packet;
analyze contents of the packet based on the type of the packet;
identify, based on the contents of the packet, a certificate corresponding to data flow of the packet; and
determine, based on the certificate, a security hash key length and an identity of a service providing the data flow.
9. The system of claim 8 , wherein the control circuitry is configured to:
determine a version of a cypher key of the certificate;
compare the version to a current version;
in response to determining that the version and the current version do not match, determine that the cypher key is outdated; and
log the determination that the cypher key is outdated.
10. The system of claim 8 , wherein to analyze the contents of the packet, the control circuitry is further configured to:
extract authentication data from the packet;
determine a user identity associated with an end device that caused the packet to be encountered by the switch; and
log the user identity.
11. The system of claim 8 , where the control circuitry is further configured to transmit an access control list (ACL) to the switch.
12. The system of claim 8 , wherein to receive the packet, the control circuitry is further configured to receive the packet using a sampled flow (SFlow) protocol.
13. The system of claim 8 , wherein the control circuitry is configured to mirror the packet based at least in part on whether the packet comprises data matching a predetermined pattern at a predetermined location.
14. The system of claim 8 , wherein the packet is a secure socket layer (SSL) packet or a transport layer security (TLS) packet.
15. A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:
generating a mirroring parameter;
transmitting the mirroring parameter to each switch of a plurality of switches on a network;
receiving, from a switch of the plurality of switches, a packet mirrored by the switch based on the mirroring parameter;
determining a type of the packet;
analyzing contents of the packet based on the type of the packet;
identifying, based on the contents of the packet, a certificate corresponding to data flow of the packet; and
determining, based on the certificate, a security hash key length and an identity of a service providing the data flow.
16. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
determining a version of a cypher key of the certificate;
comparing the version to a current version;
in response to determining that the version and the current version do not match, determining that the cypher key is outdated; and
logging the determination that the cypher key is outdated.
17. The non-transitory computer-readable medium of claim 15 , wherein the analyzing contents of the packet comprises:
extracting authentication data from the packet;
determining a user identity associated with an end device that caused the packet to be encountered by the switch; and
logging the user identity.
18. The non-transitory computer-readable medium of claim 15 , wherein the receiving the packet comprises receiving the packet using a sampled flow (SFlow) protocol.
19. The non-transitory computer-readable medium of claim 15 , wherein the packet is mirrored by the switch based at least in part on whether the packet contains data matching a predetermined pattern at a predetermined location.
20. The non-transitory computer-readable medium of claim 15 , wherein the packet is a secure socket layer (SSL) packet or a transport layer security (TLS) packet.