Automated passive discovery of applications
Embodiments are directed to monitoring communication over a network using a network monitoring device (NMD) to discover devices, roles, applications, and application dependencies present on the monitored networks. A NMD may monitor network packets that may be flowing on monitored networks. Using OSI L2-to-L3 data the NMD may determine the devices that may be on the monitored networks. Also, the NMD may determine the network protocols that may be in use on the monitored networks. Further, the NMD may reassemble monitored network packets into transactions based on knowledge regarding the network protocols are in use on the monitored networks. The NMD may perform various tests to determine the applications that may be running on the discovered devices. Some of the tests used by the NMD may examine OSI L4-L7 data that may be included in the transactions.
1. A method for monitoring communication over a network with a network device that is operative to perform actions, comprising:
passively monitoring a plurality of packets on the network, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model; and
discovering one or more other network devices on the network based on examining the L2-L3 data associated with the at least one or more other network device, wherein one or more determined roles for the one or more other network devices corresponds to a confidence score; and
discovering at least one application that is operating on the network based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet.
2. The method of claim 1 , further comprising, determining at least one correlation between at least one application and another application based on at least a comparison of a plurality of transactions that are associated with one or more flows of packets on the network.
3. The method of claim 1 , further comprising, determining at least one dependency between the at least one application and another application based on at least a comparison of a plurality of transactions that are associated with one or more network devices.
4. The method of claim 1 , wherein determining the one or more roles for the one or more other network devices is based on examining the L4-L7 data associated with the one or more other network device, and wherein the one or more roles include web server, database, router, switch, directory server, printer, or network attached storage.
5. The method of claim 1 , further comprising, generating at least one application profile that includes at least an identity of the at least one application.
6. The method of claim 1 , wherein discovering the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises at least one of:
employing at least one heuristic technique based on at least one known property of the at least one application; or
determining the at least one application based on an accumulation of L4-L7 data from a plurality of transactions.
7. A system arranged for monitoring communication over a network, comprising:
a server device, including:
a transceiver that is operative to communicate over the network;
a memory that is operative to store at least instructions; and
a processor device that is operative to execute instructions that enable actions, including:
passively monitoring a plurality of packets on the network, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model; and
discovering one or more other network devices on the network based on examining the L2-L3 data associated with the at least one or more other network device, wherein one or more determined roles for the one or more other network devices corresponds to a confidence score; and
discovering at least one application that is operating on the network based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet; and
a client device, comprising,
a transceiver that is operative to communicate over the network;
a memory that is operative to store at least instructions; and
a processor device that is operative to execute instructions that enable actions, including displaying at least a portion of at least one application profile that includes at least an identity of the at least one application.
8. The system of claim 7 , wherein the actions enabled by the server device's processor device further comprise determining at least one correlation between at least one application and another application based on at least a comparison of a plurality of transactions that are associated with one or more flows of packets on the network.
9. The system of claim 7 ,wherein the actions enabled by the server device's processor device further comprise determining at least one dependency between the at least one application and another application based on at least a comparison of a plurality of transactions that are associated with one or more network devices.
10. The system of claim 7 , wherein discovering the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises at least one of:
employing at least one heuristic technique based on at least one known property of the at least one application; or
determining the at least one application based on an accumulation of L4-L7 data from a plurality of transactions.
11. The system of claim 7 , wherein the actions enabled by the service device's processor device further comprise determining at least one operating system that is associated with the at least one other network device based on testing the at least portion of L4-L7 data included in the monitored packets.
12. A network device that is operative for monitoring communication over a network, comprising:
a transceiver that is operative to communicate over a network;
a memory that is operative to store at least instructions; and
a processor device that is operative to execute instructions that enable actions, including:
passively monitoring a plurality of packets on the network, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model; and
discovering one or more other network devices on the network based on examining the L2-L3 data associated with the at least one or more other network device, wherein one or more determined roles for the one or more other network devices corresponds to a confidence score; and
discovering at least one application that is operating on the network based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet.
13. The network device of claim 12 , wherein the actions enabled by the network device's processor device further comprise determining at least one correlation between at least one application and another application based on at least a comparison of a plurality of transactions that are associated with one or more flows of packets on the network.
14. The network device of claim 12 , wherein the actions enabled by the network device's processor device further comprise determining at least one dependency between the at least one application and another application based on at least a comparison of a plurality of transactions that are associated with one or more network devices.
15. The network device of claim 12 , wherein the actions enabled by the network device further comprise determining the one or more roles for the one or more other network devices based on examining the L4-L7 data associated with the one or more other network device, and wherein the one or more roles include web server, database, router, switch, directory server, printer, or network attached storage.
16. The network device of claim 12 , wherein the actions enabled by the network device's processor device further comprise generating at least one application profile that includes at least an identity of the at least one application.
17. The network device of claim 12 , wherein discovering the at least one application based on testing the L4-L7 data that is included in each transaction, further comprises at least one of:
employing at least one heuristic technique based on at least one known property of the at least one application; or
determining the at least one application based on an accumulation of L4-L7 data from a plurality of transactions.
18. A processor readable non-transitive storage media that includes instructions for monitoring communication over a network with a network device, wherein execution of the instructions by a processor device enables actions, comprising:
passively monitoring a plurality of packets on the network, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model; and
discovering one or more other network devices on the network based on examining the L2-L3 data associated with the at least one or more other network device, wherein one or more determined roles for the one or more other network devices corresponds to a confidence score; and
discovering at least one application that is operating on the network based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet.
19. The media of claim 18 , wherein the actions enabled by the network device's processor device further comprise determining at least one correlation between at least one application and another application based on at least a comparison of a plurality of transactions that are associated with one or more flows of packets on the network.
20. The media of claim 18 , wherein the actions enabled by the network device's processor device further comprise determining at least one dependency between the at least one application and another application based on at least a comparison of a plurality of transactions that are associated with one or more network devices.