System for monitoring and managing datacenters

Patent metadata

Field	Value
Publication number	US-10142353-B2
Application number	US-201615134100-A
Country	US
Kind code	B2
Filing date	Apr 20, 2016
Priority date	Jun 5, 2015
Publication date	Nov 27, 2018
Grant date	Nov 27, 2018

Abstract

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

First claim

The invention claimed is:

1. A system within a datacenter, comprising:
two or more sensors configured to:
capture a packet;
describe the packet in a packet log;
send the packet log to a collector;

the collector being configured to:
receive the packet logs from the two or more sensors;
determine that the packet logs describe a connection between two endpoints in a datacenter;
describe the connection in a flow log; and

an analytics module configured to:
determine a status of the datacenter, using any connections in the flow log;
detect an attack that originated from within the datacenter from at least the determined status of the datacenter; and
modify, in response to the detected attack, a security policy of the datacenter.

2. The system of claim 1 , wherein one of the two or more sensors is installed on a hypervisor.

3. The system of claim 2 , wherein one of the two or more sensors is installed on a virtual machine.

4. The system of claim 1 , wherein one of the two or more sensors is installed on a switch.

5. The system of claim 1 , wherein access to the datacenter is limited by a firewall.

6. The system of claim 1 , wherein the analytics module is further configured to: present a report describing flows in the datacenter.

7. A method executed within a datacenter, comprising:
receiving, a first packet log from a first sensor and a second packet log from a second sensor, the first packet log and the second packet log describing packets that are captured by the respective sensors;
determining that the first packet log and the second packet log describes a connection between two endpoints in a datacenter;
describing any connections within the first packet log and the second packet log in a flow log; and
sending the flow log to an analytics module determining a status of the datacenter, using any connections in the flow log;
detect an attack that originated from within the datacenter from at least the determined status of the datacenter; and
modify, in response to the detected attack, a security policy of the datacenter.

8. The method of claim 7 , wherein the first sensor is installed on a hypervisor.

9. The method of claim 8 , wherein access to the datacenter is limited by a firewall.

10. The method of claim 7 , wherein the first sensor is installed on a switch.

11. The method of claim 7 , wherein the first sensor is installed on a virtual machine.

12. A non-transitory computer-readable medium having computer readable instructions stored thereon that, when executed by a processor of a computer, cause the computer to:
receive, from a collector, a flow log describing a connection between two endpoints in a datacenter; and
determine a status of a datacenter, using the flow log, using any connections in the flow log;
detect an attack that originated from within the datacenter from at least the determined status of the datacenter; and
modify, in response to the detected attack, a security policy of the datacenter.

13. The non-transitory computer-readable medium of claim 12 , wherein the instructions further cause the computer to:
present a report describing flows in the datacenter.

14. The non-transitory computer-readable medium of claim 12 , wherein the instructions further cause the computer to:
configure a sensor to send a packet log to the collector.

Assignees

• Cisco Tech Inc

Inventors

• Yadav Navindra
• Singh Abhishek Ranjan
• Gandham Shashidhar
• Scheib Ellen Christine
• Madani Omid
• Parandehgheibi Ali
• Pang Jackson Ngoc Ki
• Jeyakumar Vimalkumar
• Watts Michael Standish
• Nguyen Hoang Viet
• Deen Khawar
• Prasad Rohit Chandra
• Gupta Sunil Kumar
• Rao Supreeth Hosur Nagesh
• Gupta Anubhav
• Kulshreshtha Ashutosh
• Spadaro Roberto Fernando
• Vu Hai Trong
• Malhotra Varun Sagar
• Chang Shih-Chun
• Viswanathan Bharathwaj Sankara
• Rachita Agasthy Fnu
• Barlow Duane Thomas

Classifications

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L43/04 Primary

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/062

  related to network traffic · CPC title