Method and apparatus for generating a network topology representation based on inspection of application messages at a network device
A method is disclosed for generating a network topology representation based on inspection of application messages at a network device. According to one aspect, a network device receives a request packet, routes the packet to the destination, and extracts and stores correlation information from a copy of the request packet. When the network device receives a response packet, it examines the contents of a copy of the response packet using context-based correlation rules and matches the response packet with the appropriate stored request packet correlation information. It analyzes recorded correlation information to determine application-to-application mapping and calculate application response times. Another embodiment inserts custom headers that contain information used to match a response packet with a request packet into request packets.
1. A method of generating a network topology representation based on inspection of application messages at a network device, the method comprising the computer-implemented steps of:
receiving a request packet at the network device from a request application;
associating request packet correlation information with a request application message in the request packet at the network device;
storing the request packet correlation information;
routing the request packet to a request packet destination;
receiving a response packet at the network device from a response application responding to the request application message;
associating response packet correlation information with a response application message in the response packet at the network device;
correlating the response packet correlation information for the response application message with the stored request packet correlation information for the request application message;
storing the response packet correlation information;
routing the response packet to a response packet destination;
analyzing the stored request packet correlation information and the stored response packet correlation information;
wherein the request application message and the response application message are messages exchanged in an application layer of the Open System Interconnection (OSI) Layer Model;
wherein the stored request packet correlation information identifies the request application at the application layer of the OSI Layer Model;
wherein the stored response packet correlation information identifies the response application at the application layer of the OSI Layer Model;
wherein the request packet and the response packet are Transport Control Protocol (TCP) packets;
wherein the analyzing step determines an application-to-application mapping at the application layer of the OSI Layer Model between the request application and the response application;
wherein the analyzing step calculates application response times and a response relevant metric;
wherein the application-to-application mapping, the application response times and the response relevant metric are published to outside applications;
wherein the method is performed by one or more processors.
2. A method as recited in claim 1 , further comprising: reporting an alarm if a given metric violates a predetermined threshold level.
3. A method as recited in claim 1 , wherein the correlating step uses content-based correlation rules to correlate application interactions.
4. A method as recited in claim 1 , wherein the stored request packet correlation information and the stored response packet correlation information that falls outside of a sliding window is discarded.
5. A method as recited in claim 1 , further comprising:
reporting an alarm if the response packet is not received for the request packet and/or violates a predetermined metric.
6. A non-transitory computer-readable volatile or non-volatile storage medium storing one or more sequences of instructions for generating a network topology representation based on inspection of application messages at a network device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:
receiving a request packet at the network device from a request application;
associating request packet correlation information with a request application message in the request packet at the network device;
storing the request packet correlation information;
routing the request packet to a request packet destination;
receiving a response packet at the network device from a response application responding to the request application message;
associating a response packet correlation information with a response application message in the response packet at the network device;
correlating the response packet correlation information for the response application message with the stored request packet correlation information for the request application message;
storing the response packet correlation information;
routing the response packet to a response packet destination;
analyzing stored request packet correlation information and the stored response packet correlation information;
wherein the request application message and the response application message are messages exchanged in an application layer format of the Open System Interconnect (OSI) Layer Model;
wherein the stored request packet correlation information identifies the request application at the application layer of the OSI Layer Model;
wherein the stored response packet correlation information identifies the response application at the application layer of the OSI Layer Model;
wherein the analyzing step determines an application-to-application mapping at the application layer of the OSI Layer Model between the request application and the response application;
wherein the analyzing step calculates application response times and/or any other relevant metric;
wherein the application-to-application mapping, the application response times and the response relevant metric are published to outside applications.
7. A non-transitory computer-readable storage medium as recited in claim 6 , further storing instructions, which when executed by the one or more processors, cause the one or more processors to perform: reporting an alarm if a given metric violates a predetermined threshold level.
8. A non-transitory computer-readable storage medium as recited in claim 6 , wherein the instructions for correlating the response packet correlation information use content-based correlation rules to correlate application interactions.
9. A non-transitory computer-readable storage medium as recited in claim 6 , wherein the stored request correlation information and the stored response correlation information that fails outside a sliding window is discarded.
10. A non-transitory computer-readable storage medium as recited in claim 6 , further storing instructions, which when executed by the one or more processors, cause the one or more processors to perform: reporting an alarm if the response packet is not received for the request packet and/or violates a predetermined metric.
11. An apparatus for generating a network topology representation based on inspection of application messages at a network device, comprising:
one or more processors;
means for receiving a request packet at the network device from a request application;
means for associating request packet correlation information with a request application message in the request packet at the network device;
means for storing the request packet correlation information;
means for routing the request packet to a request packet destination;
means for receiving a response packet at the network device from a response application responding to the request application message;
means for associating response packet correlation information with a response application message in the response packet at the network device;
means for correlating the response packet correlation information for the response application message with the stored request packet correlation information for the request application message;
means for storing the response packet correlation information; and
means for routing the response packet to a response packet destination;
wherein the request packet and the response packet are Transport Control Protocol (TCP) packets;
means for analyzing the stored request packet correlation information and the stored response packet correlation information;
wherein the request application message and the response application message are messages exchanged in an application layer format of the Open System Interconnect (OSI) Layer Model;
wherein the stored request packet correlation information identifies the request application at the application layer of the OSI Layer Model;
wherein the stored response packet correlation information identifies the response application at the application layer of the OSI Layer Model;
wherein the analyzing means determines application-to-application mapping at the application layer of the OSI Layer Model;
wherein the analyzing means calculates application response times and a response relevant metric;
wherein the application-to-application mapping, the application response times and the response relevant metric are published to outside applications.
12. An apparatus as recited in claim 11 , further comprising:
means for reporting an alarm if a given metric violates a predetermined threshold level.
13. An apparatus as recited in claim 11 , wherein the correlating means uses content-based correlation rules to correlate application interactions.
14. An apparatus as recited in claim 11 , wherein the stored request packet correlation information and the stored response packet correlation information that fails outside of a sliding window is discarded.
15. An apparatus as recited in claim 11 , further comprising:
means for reporting an alarm if a response packet is not received for a request packet and/or violates a predetermined metric.