Systems and methods for monitoring network traffic
Systems and methods for monitoring network traffic. A server may receive data packets originated from a first remote computer system, the data packets having a destination of a second remote computer system. The server may determine a user of the first computer system and, based thereon, identify network traffic monitoring tools configured to connect to the server through respective distinct network addresses. The server may determine a routing path for the packets including a sequence of network addresses including the respective distinct addresses of the identified network traffic monitoring tools and a second network address corresponding to the second computer system. The second network address may be ordered after the respective distinct addresses of the identified network traffic monitoring tools in the sequence. The server may send, according to the routing path, the packets to the identified network traffic monitoring tools and the second computer system.
1. A method comprising:
performing by a server system:
receiving one or more data packets originated from a first remote computer system, the data packets having a final destination of a second remote computer system;
determining, based on the packets, an identifier of an entity associated with the first remote computer system,
based on the identifier of the entity, identifying a plurality of network traffic monitoring tools to be applied to the packets, wherein the network traffic monitoring tools are configured to connect to the server system through respective distinct Internet Protocol (IP) addresses;
determining a routing path for the packets, wherein the routing path is based on the tools to be applied to the packets and comprises an ordered sequence of IP addresses including the respective distinct IP addresses of the identified network traffic monitoring tools, a plurality of IP addresses of the server system, and an IP address corresponding to the second remote computer system, wherein the IP addresses of the server system are interleaved with the IP addresses of the identified network traffic monitoring tools in the ordered sequence, and wherein the IP address of the second remote computer system is ordered after the interleaved IP addresses of the identified network traffic monitoring tools and the server system in the ordered sequence; and
sending the packets, according to the ordered sequence of IP addresses of the routing path, to the identified network traffic monitoring tools, and subsequently to the second remote computer system.
2. The method of claim 1 , further comprising:
translating a first network address of the first remote computer system to a a different network address that represents the entity in the server system.
3. The method of claim 1 , wherein sending the packets to the second remote computer system further comprises providing to the second remote computer system an indication of a source network address of the packets, wherein the source network address is a particular network address of the server system.
4. The method of claim 1 , wherein the server system is a physical machine or a virtual machine.
5. The method of claim 1 , wherein a particular network traffic monitoring tool is configured to execute on a physical machine or on a virtual machine.
6. A network traffic monitoring system, comprising:
at least one server computer programmed to perform operations including:
receiving one or more data packets originated from a first remote computer system, the data packets having a final destination of a second remote computer system;
determining, based on the packets, an identifier of an entity associated with the first remote computer system,
based on the identifier of the entity, identifying a plurality of network traffic monitoring tools to be applied to the packets, wherein the network traffic monitoring tools are configured to connect to the server computer through respective distinct Internet Protocol (IP) addresses;
determining a routing path for the packets, wherein the routing path is based on the tools to be applied to the packets and comprises an ordered sequence of IP addresses including the respective distinct IP addresses of the identified network traffic monitoring tools, a plurality of IP addresses of the server computer, and an IP address corresponding to the second remote computer system, wherein the IP addresses of the server computer are interleaved with the IP addresses of the identified network traffic monitoring tools in the ordered sequence, and wherein the IP address of the second remote computer system is ordered after the interleaved IP addresses of the identified network traffic monitoring tools and the server computer in the ordered sequence; and
sending the packets, according to the ordered sequence of IP addresses of the routing path, to the identified network traffic monitoring tools, and subsequently to the second remote computer system.
7. The system of claim 6 , wherein the operations further include:
translating a first network address of the first remote computer system to a a different network address that represents the entity in the server computer.
8. The system of claim 6 , wherein sending the packets to the second remote computer system further comprises providing to the second remote computer system an indication of a source network address of the packets, wherein the source network address is a particular network address of the server computer.
9. The system of claim 6 , wherein the server computer is a physical machine or a virtual machine.
10. The system of claim 6 , wherein a particular network traffic monitoring tool is configured to execute on a physical machine or on a virtual machine.
11. A computer storage medium having instructions stored thereon that, when executed by data processing apparatus of at least one server computer, cause the data processing apparatus to perform operations including:
receiving one or more data packets originated from a first remote computer system, the data packets having a final destination of a second remote computer system;
determining, based on the packets, an identifier of an entity associated with the first remote computer system,
based on the identifier of the entity, identifying a plurality of network traffic monitoring tools to be applied to the packets, wherein the network traffic monitoring tools are configured to connect to the server computer through respective distinct Internet Protocol (IP) addresses;
determining a routing path for the packets, wherein the routing path is based on the tools to be applied to the packets and comprises an ordered sequence of IP addresses including the respective distinct IP addresses of the identified network traffic monitoring tools, a plurality of IP addresses of the server computer, and an IP address corresponding to the second remote computer system, wherein the IP addresses of the server computer are interleaved with the IP addresses of the identified network traffic monitoring tools in the ordered sequence, and wherein the IP address of the second remote computer system is ordered after the interleaved IP addresses of the identified network traffic monitoring tools and the server computer in the ordered sequence; and
sending the packets, according to the ordered sequence of IP addresses of the routing path, to the identified network traffic monitoring tools, and subsequently to the second remote computer system.
12. The computer storage medium of claim 11 , wherein the operations further include:
translating a first network address of the first remote computer system to a different network address that represents the entity in the server computer.
13. The computer storage medium of claim 11 , wherein sending the packets to the second remote computer system further comprises providing to the second remote computer system an indication of a source network address of the packets, wherein the source network address is a particular network address of the server computer.
14. The computer storage medium of claim 11 , wherein the server computer is a physical machine or a virtual machine.
15. The computer storage medium of claim 11 , wherein a particular network traffic monitoring tool is configured to execute on a physical machine or on a virtual machine.