Systems and methods for determining entry points for mapping a network
The present approach relates to determining suitable entry points for initiating discovery and mapping of an enterprise service. For example, one or more tables may be utilized that include information regarding connections and/or communication between configuration items (CIs) of the enterprise service. From the tables, a graph may be created with nodes of the graph representing an internet protocol (IP) address and a port associated with the CIs, and edges of the graph representing the connections and/or communication between the CIs. The graph may be traversed according to outbound edges starting from a node with zero or few outbound edges. The nodes that are unreachable, or untraversed, may be flagged as suitable entry point candidates. In some embodiments, the flagged suitable entry point candidates may be reconciled with already known entry points included in the one or more tables.
1. A method, comprising:
graphing ports of a network as graph nodes with associated edges corresponding to communication between the ports based at least in part on previously obtained network traffic information;
traversing the graph nodes via the associated edges and recording traversed nodes and unreachable nodes;
flagging unreachable nodes as entry points; and
starting discovery of aspects of the network at one of the entry points.
2. The method of claim 1 , comprising:
accessing one or more tables and retrieving the ports of the network from the one or more tables.
3. The method of claim 2 , wherein the one or more tables comprises information regarding active transmission control protocol (TCP) connections between the ports of the network.
4. The method of claim 2 , wherein the one or more tables comprises information regarding communication between the ports of the network.
5. The method of claim 1 , comprising:
evaluating the graph nodes based on a number of incoming edges associated with each graph node of the graph nodes and identifying a first graph node with a fewest amount of incoming edges.
6. The method of claim 5 , wherein traversing the graph nodes comprises traversing the graph nodes starting from the first graph node.
7. The method of claim 1 , wherein the graphed ports of the network are hypertext transfer protocol (http) ports or hypertext transfer protocol secure (https) ports.
8. The method of claim 1 , comprising:
generating a table of the entry points;
accessing one or more other tables listing alternative entry points;
comparing the table of the entry points against the listing of alternative entry points; and
removing the entry points of the table that have corresponding matches in the listing of alternative entry points.
9. The method of claim 8 , wherein the listing of alternative entry points comprises information regarding virtual internet protocols (VIPs) of one or more load balancers of the network.
10. The method of claim 1 , wherein discovering the aspects of the network comprises discovering, via a probe, configuration items (CIs) of the network based on connections between the CIs.
11. The method of claim 10 , comprising:
creating a service map of the CIs and the connections between the CIs based on the entry points.
12. A system, comprising:
a non-transitory memory; and
one or more hardware processors configured to read instructions from the non-transitory memory to perform operations comprising:
generating a graph of nodes and edges, wherein the nodes are associated with ports of a network and the edges are associated with communication between the ports based at least in part on previously obtained network traffic information;
traversing the graph via the edges starting from a first node of the nodes;
identifying the nodes that are unreachable from the first node as entry point candidates of the network; and
starting discovery of configuration items of the network at one of the identified entry point candidates.
13. The system of claim 12 , comprising:
accessing one or more tables, wherein the one or more tables comprises information regarding communications and/or connections between the ports of the network, and wherein the graph is based at least in part on the information of the one or more tables.
14. The system of 1 , wherein discovering the configuration items of the network comprises probing the network starting at one of the entry point candidates.
15. The system of claim 12 , wherein the first node has a least amount of incoming edges relative to other nodes of the nodes.
16. A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions, configured to:
access one or more tables, wherein the one or more tables comprises information regarding ports of a network and interconnections of the ports;
graph the ports as nodes and the interconnections as edges between the nodes;
traverse the graph starting from a first node associated with a first port;
determine one or more entry points of the network based on the traversed graph;
discover, via a probe, the network starting at the entry points.
17. The machine-readable medium of claim 16 , wherein the one or more entry points are reconciled with a table comprising information regarding one or more load balancers.
18. The machine-readable medium of claim 16 , wherein the one or more entry points are determined based on which of the nodes of the traversed graph were reachable from the first node.
19. The machine-readable medium of claim 16 , comprising machine readable instructions configured to sort the ports according to an amount of incoming communication paths of each port.
20. The machine readable medium of claim 16 , wherein the graphed ports of the network are hypertext transfer protocol (http) ports or hypertext transfer protocol secure (https) ports.