Granted Patent B2

US 12,388,731 · App. 17/654,141 · Granted Aug 12, 2025

Inventors: David Anthony Hughes (Los Altos Hills, CA); Pawan Kumar Singh (Los Altos, CA)

Assignee: Hewlett Packard Enterprise Development LP

H04L43/062G06F16/22G06F16/248G06F16/284H04L43/026H04L43/045H04L43/067

Abstract

Claims (45)

1. A network information collector, comprising:

a processor; and

a memory including instructions that, when executed by the processor, cause the network information collector to:

periodically receive, from a plurality of network appliances connected in a communication network, a respective plurality of accumulating maps, wherein:

each accumulating map includes entries organized hierarchically according to a set of flow attributes, and

each entry represents one or more flows in a flow table of a respective network appliance of the plurality of network appliances;

aggregate each of the received respective plurality of accumulating maps into a global accumulating map; and

remove, from the global accumulating map, entries according to a lowest number of bytes eviction policy that evicts an entry having a lowest number of bytes among entries of the global accumulating map, wherein the entry having the lowest number of bytes is the entry that includes a first network metric of a bytes received count that is lowest of any entry in the global accumulating map.

2. The network information collector of claim 1 , wherein the instructions further cause the network information collector to forward information from the global accumulating map to a network administrator via a graphical user interface such that the network administrator can generate a report based on the forwarded information and a search query.

3. The network information collector of claim 1 , wherein the accumulating maps are periodically received after a pre-determined time interval.

4. The network information collector of claim 3 , wherein each successive accumulating map received from a network appliance includes entries for flows during the pre-determined time interval.

5. The network information collector of claim 1 , wherein entries removed from the global accumulating map are recorded in an eviction log.

6. The network information collector of claim 1 , wherein a first attribute of the set of flow attributes is related to and more specific than a second attribute of the set of flow attributes.

7. A method, comprising:

receiving, at a network information collector and from a plurality of network appliances, a plurality of respective accumulating maps,

wherein:

each accumulating map includes entries organized hierarchically according to a set of flow attributes,

a first attribute of the set of flow attributes is related to and more specific than a second attribute of the set of flow attributes, and

each entry represents one or more flows in a flow table of a respective network appliance of the plurality of network appliances;

aggregating, at the network information collector, each of the received plurality of respective accumulating maps into a global accumulating map, wherein the aggregating comprises:

for each entry of each received accumulating map, identifying a corresponding entry of the global accumulating map;

updating each identified corresponding entry to incorporate information from the respective received accumulating map entry; and

removing entries according to a lowest number of bytes eviction policy that evicts an entry having a lowest number of bytes among entries of the global accumulating map, wherein the entry having the lowest number of bytes is the entry that includes a first network metric of a bytes received count that is lowest of any entry in the global accumulating map.

8. The method of claim 7 , wherein each successive accumulating map received from a network appliance includes entries for flows during a pre-determined time interval.

9. The method of claim 7 , wherein entries removed from the global accumulating map are recorded in an eviction log.

10. The method of claim 7 , wherein each entry includes a network metric extracted from associated flows.

11. The method of claim 7 , wherein the network appliances are connected in a communication network and each network appliance gathers information on flows passing through itself.

12. The method of claim 7 , further comprising forwarding information from the global accumulating map to a network administrator via a graphical user interface such that the network administrator can generate a report based on the forwarded information and a search query.

13. A system, comprising:

a plurality of network appliances each comprising a respective processor and a memory including instructions that, when executed by the respective processor, cause each respective network appliance of the plurality of network appliances to:

insert details of a plurality flows into a flow table;

generate one or more entries according to a set of flow attributes of the plurality of flows, wherein each of the one or more entries may be associated with one or more of the plurality of flows;

insert the one or more entries into an accumulating map such that the entries are organized hierarchically according to a set of related flow attributes,

wherein a first attribute of the set of flow attributes is related to and more specific than a second attribute of the set of flow attributes; and

periodically transmit the accumulating map to a network information collector; and

the network information collector comprising a processor and a memory including instructions that, when executed by the processor, cause the network information collector to:

receive an accumulating map from a network appliance;

aggregate the received accumulating map into a global accumulating map;

remove, from the global accumulating map, entries according to,

a lowest number of bytes eviction policy that evicts an entry having a lowest number of bytes among entries of the global accumulating map, wherein the entry having the lowest number of bytes is the entry that includes a first network metric of a bytes received count that is lowest of any entry in the global accumulating map; and

forward information from the global accumulating map to a network administrator via a graphical user interface such that the network administrator can generate a report based on the forwarded information and a search query.

14. The system of claim 13 , wherein each entry includes a network metric extracted from associated flows.

15. The system of claim 14 , wherein upon removing an entry, the network metric of the removed entry is combined with a network metric of another entry associated with the removed entry.

16. The system of claim 13 , wherein each successive accumulating map received from a network appliance includes entries for flows during a pre-determined time interval.

17. The system of claim 13 , wherein entries removed from the global accumulating map are recorded in an eviction log.

Assignments (2)

Continuity (3)

References Cited (400)