SYSTEM FOR MONITORING AND MANAGING DATACENTERS
An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.
1 . A system for monitoring network performance, the system comprising:
a plurality of sensors residing on nodes of a data center network, each sensor configured to monitor communications to or from its associated node,
wherein each sensor is configured to selectively capture network traffic data from the communications to or from the sensor's associated node and send the network traffic data to a collector,
wherein the selectively captured network traffic data includes information captured from packets relating to a network event,
wherein the collector aggregates the information captured from the packets relating to the network event and provides it to an analytics module, and
wherein the analytics module receives and analyzes the aggregated information received from the collector; and
a presentation module including a user interface that displays information resulting from the analysis of the aggregated information relating to the network event.
2 . The system of claim 1 , wherein the analytics module uses machine learning to analyze the network traffic data.
3 . The system of claim 1 , wherein the network traffic data further includes a representative sample of packets.
4 . The system of claim 1 , wherein the network traffic data further includes metadata describing the communications to or from a sensor's associated node.
5 . The system of claim 1 , wherein selectively capturing the network traffic data from the communications to or from the sensor's associated node is based on source address, source port, destination address, and destination port of the packets in the node network traffic.
6 . The system of claim 1 , wherein selectively capturing the network traffic data from the communications to or from the sensor's associated node is based on source address, source port, destination address, destination port, and protocol of the packets in the node network traffic.
7 . The system of claim 1 , wherein the captured packets relate to a network flow.
8 . A method for monitoring network performance, the method comprising:
at a plurality of sensors residing on nodes of a data center network, monitoring at each sensor communications to or from its associated node;
at one or more sensors, selectively capturing network traffic data from the communications to or from the sensor's associated node and sending the network traffic data to a collector, wherein the selectively captured network traffic data includes information captured from packets relating to a network event;
at the collector, aggregating the information captured from the packets relating to the network event and providing it to an analytics module;
at the analytics module, receiving and analyzing the aggregated information received from the collector; and
displaying information resulting from the analysis of the aggregated information relating to the network event.
9 . The method of claim 8 , wherein the analytics module uses machine learning to analyze the network traffic data.
10 . The method of claim 8 , wherein the network traffic data further includes a representative sample of packets.
11 . The method of claim 8 , wherein the network traffic data further includes metadata describing the communications to or from a sensor's associated node.
12 . The method of claim 8 , wherein selectively capturing the network traffic data from the communications to or from the sensor's associated node is based on source address, source port, destination address, and destination port of the packets in the node network traffic.
13 . The method of claim 8 , wherein selectively capturing the network traffic data from the communications to or from the sensor's associated node is based on source address, source port, destination address, destination port, and protocol of the packets in the node network traffic.
14 . The method of claim 8 , wherein the captured packets relate to a network flow.
15 . Non-transitory computer-readable media containing instructions, which when executed by one or more processors on one or more hosts, cause the hosts to perform actions comprising:
at a plurality of sensors residing on nodes of a data center network, monitoring at each sensor communications to or from its associated node;
at one or more sensors, selectively capturing network traffic data from the communications to or from the sensor's associated node and sending the network traffic data to a collector, wherein the selectively captured network traffic data includes information captured from packets relating to a network event;
at the collector, aggregating the information captured from the packets relating to the network event and providing it to an analytics module;
at the analytics module, receiving and analyzing the aggregated information received from the collector; and
displaying information resulting from the analysis of the aggregated information relating to the network event.
16 . The computer-readable media of claim 15 , wherein the analytics module uses machine learning to analyze the network traffic data.
17 . The computer-readable media of claim 15 , wherein the network traffic data further includes a representative sample of packets.
18 . The computer-readable media of claim 15 , wherein the network traffic data further includes metadata describing the communications to or from a sensor's associated node.
19 . The computer-readable media of claim 15 , wherein selectively capturing the network traffic data from the communications to or from the sensor's associated node is based on source address, source port, destination address, and destination port of the packets in the node network traffic.
20 . The computer-readable media of claim 15 , wherein selectively capturing the network traffic data from the communications to or from the sensor's associated node is based on source address, source port, destination address, destination port, and protocol of the packets in the node network traffic.