Monitoring based on client perspective
View Patent ↗According to one general aspect, a method may include establishing a network tap point near, in a network topology sense, an intranet/internet access point device. The network tap point may provide a substantially non-intrusive means of viewing network communication through the intranet/internet access point. The method may include monitoring, via the network tap point, at least partially encrypted network communication between a client computing device that is within the intranet and server computing device that is within the internet. The method may also include analyzing the monitored at least partially encrypted network communication to generate at least one set of metrics regarding the performance of the network communication between the client computing device and server computing device.
1. A method comprising:
establishing a network tap point near, in a network topology sense, an intranet/internet access point device, wherein the network tap point provides a substantially non-intrusive means of viewing network communication through the intranet/internet access point;
monitoring, by at least one processor, at least partially encrypted network communication between a client computing device that is within the intranet and server computing device that is within the internet using the network tap point, the monitoring including receiving a first portion of the monitored network communication that is between the client computing device and the intranet/internet access point and receiving a second portion of the network communication between the intranet/internet access point device and the server computing device;
decrypting, by the at least one processor, the first portion of the monitored network communication by employing a private encryption key of the intranet/internet access point device; and
analyzing, by the at least one processor, the monitored at least partially encrypted network communication to generate at least one set of metrics regarding the performance of the network communication between the client computing device and server computing device,
wherein the analyzing includes correlating network communications of the first decrypted portion of the monitored network communication with respective network communications of the second portion of the monitored network communication.
2. The method of claim 1 , wherein analyzing includes:
analyzing the monitored encrypted network communication to generate a first set of metrics regarding the performance of the network communication between the client computing device and the intranet/internet access point device; and
analyzing the monitored encrypted network communication to generate a second set of metrics regarding the performance of the network communication between the intranet/internet access point device and the server computing device.
3. The method of claim 1 , wherein establishing a network tap point includes providing a network tap point analyzing device with at least one encryption credential of the intranet/internet access point device.
4. The method of claim 1 , wherein analyzing includes:
not decrypting the second portion of the monitored network communication that is between the intranet/internet access point device and the server computing device.
5. The method of claim 1 , wherein analyzing includes:
decrypting, by employing a session encryption key of the intranet/internet access point device, the second portion of the monitored network communication that is between the intranet/internet access point device and the server computing device.
6. The method of claim 1 , wherein monitoring includes:
receiving, by the network tap point analyzing device and from a second network tap point, the second portion of the network communication between the intranet/internet access point device and the server computing device, wherein the second portion of the network communication is received in a format that is either un-encrypted or decryptable by the network tap point analyzing device.
7. The method of claim 6 , further comprising:
providing a second network tap device at the second network tap point with at least one of the security credentials of the server computing device, wherein the second network tap point is across at least a portion of the internet from the client computing device and near, in a network topology sense, the server computing device; and
wherein monitoring includes:
monitoring, via the second network tap device, the second portion of the network communication between the intranet/internet access point device and the server computing device,
decrypting the monitored second portion of the network communication, and
transmitting the decrypted second portion of the network communication to the network tap point analyzing device in a format that is either un-encrypted or decryptable by the network tap point analyzing device.
8. An apparatus comprising:
a network tap point configured to duplicate, in a non-intrusive manner, at least part of a network communication transmitted to and from an access point device that forms the boundary between a first network and a second network; and
a processor configured to:
monitor, via the network tap point, at least partially encrypted network communication that is between a client computing device that is within the first network and server computing device that is within the second network including receiving a first portion of the network communication that is between the client computing device and the access point device and receiving a second portion of the network communication that is between the server computing device and the access point device, and
analyze the monitored at least partially encrypted network communication to generate at least one set of metrics regarding the performance of the network communication between the client computing device and server computing device, the analyze including correlating network communications of the first portion of the monitored network communication with respective network communications of the second portion of the monitored network communication.
9. The apparatus of claim 8 , wherein the processor is configured to:
analyze the monitored encrypted network communication to generate a first set of metrics regarding the performance of the network communication between the client computing device and the access point device; and
analyzing the monitored encrypted network communication to generate a second set of metrics regarding the performance of the network communication between the access point device and the server computing device.
10. The apparatus of claim 8 , further comprising a memory configured to store at least one encryption credential of the access point device.
11. The apparatus of claim 8 , wherein the processor is configured to:
not decrypt the second portion of the monitored network communication that is between the access point device and the server computing device.
12. The apparatus of claim 8 , wherein the processor is configured to:
decrypt, by employing the private encryption key of the access point device, the second portion of the monitored network communication that is between the access point device and the server computing device.
13. The apparatus of claim 8 , wherein the processor is configured to:
receive, from a second network tap point, the second portion of the network communication between the access point device and the server computing device,
wherein the second portion of the network communication is received in a format that is either un-encrypted or decryptable by the apparatus.
14. A computer program product for managing a network, the computer program product being tangibly embodied on a non-transitory computer-readable medium and including executable code that, when executed, is configured to cause an apparatus to:
monitor, via a network tap point, at least partially encrypted network communication between a client computing device that is within a first network and server computing device that is within a second network including receiving a first portion of the network communication that is between the client computing device and an access point device and receiving a second portion of the network communication that is between the server computing device and the access point device;
decrypt, by employing a session encryption key of the access point device, a first portion of the monitored network communication that is between the client computing device and the access point device; and
analyze the monitored at least partially encrypted network communication to generate at least one set of metrics regarding the performance of the network communication between the client computing device and server computing device, the analyze including correlating network communications of the first portion of the monitored network communication with respective network communications of the second portion of the monitored network communication.
15. The computer program product of claim 14 , wherein the executable code is configured to, when executed, cause the apparatus to:
analyze the monitored network communication to generate a first set of metrics regarding the performance of the network communication between the client computing device and an access point device, wherein the access point device provides a boundary between the first network and the second network; and
analyze the monitored encrypted network communication to generate a second set of metrics regarding the performance of the network communication between the access point device and the server computing device.
16. The computer program product of claim 14 , wherein the executable code is configured to, when executed, cause the apparatus to:
decrypt, by employing a session encryption key of the access point device, the second portion of the monitored network communication that is between the access point device and the server computing device.