Layer-2 path discovery of active probe connection monitoring
In one implementation, a device may obtain telemetry data from Layer-2 network devices on a test path trace of a computing network. The device may generate, based on the telemetry data, a correlation of the Layer-2 network devices with Layer-3 path trace data. The device may determine, based on the correlation, a Layer-2 path for the test path trace on the computing network. The device may integrate the Layer-2 path with the Layer-3 path trace data to generate an enriched path trace to identify a root cause of a performance degradation in the computing network.
1 . A method, comprising:
obtaining, by a device, telemetry data from Layer-2 network devices on a test path trace of a computing network;
generating, by the device and based on the telemetry data, a correlation of the Layer-2 network devices with Layer-3 path trace data;
determining, by the device and based on the correlation, a Layer-2 path for the test path trace on the computing network;
integrating, by the device, the Layer-2 path with the Layer-3 path trace data to generate an enriched path trace to identify a root cause of a performance degradation in the computing network;
identifying, based on the enriched path trace, one or more Layer-2 devices that are not covered by an active probe test; and
suggesting a location for a subsequent active probe test to cover the one or more Layer-2 devices that are not covered by the active probe test.
2 . The method as in claim 1 , wherein the telemetry data includes a graph of topology neighbors in the computing network based on Layer-2 discovery protocols.
3 . The method as in claim 1 , wherein the telemetry data includes a set of media access control addresses authenticating on the Layer-2 network devices.
4 . The method as in claim 1 , wherein the telemetry data is learned by the Layer-2 network devices by monitoring address resolution protocol and dynamic host configuration protocol traffic.
5 . The method as in claim 4 , wherein the telemetry data includes media access control address and internet protocol address tuples for endpoints in the computing network.
6 . The method as in claim 1 , wherein generating the correlation includes:
identifying a set of Layer-2 hops in the Layer-2 path based on a media access control address of each of the Layer-2 network devices; and
identifying a particular Layer-2 network device with a dataplane internet protocol address equal to a first Layer-3 hop of the test path trace.
7 . The method as in claim 6 , wherein determining the Layer-2 path includes:
identifying, based on a topology dataset, Layer-2 neighbors of the particular Layer-2 network device that match Layer-2 hops in the set of Layer-2 hops; and
appending matching Layer-2 neighbors to a model of the Layer-2 path until all Layer-2 hops in the set of Layer-2 hops have been appended to the Layer-2 path or until no match is found.
8 . The method as in claim 1 , further comprising:
identifying the root cause of the performance degradation by detecting a pattern in a time series of performance metrics for the enriched path trace that correlate with an active network test failure.
9 . The method as in claim 1 , further comprising:
providing the enriched path trace to a user via a user interface to identify the root cause of the performance degradation in the computing network.
10 . An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
obtain telemetry data from Layer-2 network devices on a test path trace of a computing network;
generate, based on the telemetry data, a correlation of the Layer-2 network devices with Layer-3 path trace data;
determine, based on the correlation, a Layer-2 path for the test path trace on the computing network;
integrate the Layer-2 path with the Layer-3 path trace data to generate an enriched path trace to identify a root cause of a performance degradation in the computing network,
identify, based on the enriched path trace, one or more Layer-2 devices that are not covered by an active probe test; and
suggest a location for a subsequent active probe test to cover the one or more Layer-2 devices that are not covered by the active probe test.
11 . The apparatus as in claim 10 , wherein the telemetry data includes a graph of topology neighbors in the computing network based on Layer-2 discovery protocols.
12 . The apparatus as in claim 10 , wherein the telemetry data includes a set of media access control addresses authenticating on the Layer-2 network devices.
13 . The apparatus as in claim 10 , wherein the telemetry data is learned by the Layer-2 network devices by monitoring address resolution protocol and dynamic host configuration protocol traffic.
14 . The apparatus as in claim 13 , wherein the telemetry data includes media access control address and internet protocol address tuples for endpoints in the computing network.
15 . The apparatus as in claim 10 , wherein the process is further configured to:
identify a set of Layer-2 hops in the Layer-2 path based on a media access control address of each of the Layer-2 network devices; and
identify a particular Layer-2 network device with a dataplane internet protocol address equal to a first Layer-3 hop of the test path trace.
16 . The apparatus as in claim 15 , wherein the process is further configured to:
identify, based on a topology dataset, Layer-2 neighbors of the particular Layer-2 network device that match Layer-2 hops in the set of Layer-2 hops; and
append matching Layer-2 neighbors to a model of the Layer-2 path until all Layer-2 hops in the set of Layer-2 hops have been appended to the Layer-2 path or until no match is found.
17 . The apparatus as in claim 10 , wherein the process is further configured to:
identify the root cause of the performance degradation by detecting a pattern in a time series of performance metrics for the enriched path trace that correlate with an active network test failure.
18 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
obtaining telemetry data from Layer-2 network devices on a test path trace of a computing network;
generating, based on the telemetry data, a correlation of the Layer-2 network devices with Layer-3 path trace data;
determining, based on the correlation, a Layer-2 path for the test path trace on the computing network;
integrating the Layer-2 path with the Layer-3 path trace data to generate an enriched path trace to identify a root cause of a performance degradation in the computing network,
identifying, based on the enriched path trace, one or more Layer-2 devices that are not covered by an active probe test; and
suggesting a location for a subsequent active probe test to cover the one or more Layer-2 devices that are not covered by the active probe test.
19 . The method as in claim 1 , wherein identifying, based on the enriched path trace, the one or more Layer-2 devices that are not covered by the active probe test and suggesting the location for the subsequent active probe test to cover the one or more Layer-2 devices that are not covered by the active probe test comprises using an observability intelligence platform for identifying the one or more Layer-2 devices and suggesting the location.
20 . The apparatus as in claim 10 , wherein to identify, based on the enriched path trace, the one or more Layer-2 devices that are not covered by the active probe test and suggest the location for the subsequent active probe test to cover the one or more Layer-2 devices that are not covered by the active probe test comprises to use an observability intelligence platform to identify the one or more Layer-2 devices and suggest the location.