Network flow stitching using middle box flow stitching

Patent metadata

Field	Value
Publication number	US-10574575-B2
Application number	US-201815966561-A
Country	US
Kind code	B2
Filing date	Apr 30, 2018
Priority date	Jan 25, 2018
Publication date	Feb 25, 2020
Grant date	Feb 25, 2020

Abstract

Systems, methods, and computer-readable media for flow stitching network traffic flow segments at a middlebox in a network environment. In some embodiments, a method can include collecting flow records of traffic flow segments at a middlebox in a network environment including one or more transaction identifiers assigned to the traffic flow segments. The traffic flow segments can correspond to one or more traffic flows passing through the middlebox and flow directions of the traffic flow segments with respect to the middlebox can be identified using the flow records. The traffic flow segments can be stitched together based on the one or more transaction identifiers and the flow directions of the traffic flow segments to form a stitched traffic flow of the one or more traffic flows passing through the middlebox. The stitched traffic flow can be incorporated as part of network traffic data for the network environment.

First claim

What is claimed is:

1. A method comprising:
collecting flow records of traffic flow segments at a middlebox in a network environment corresponding to one or more traffic flows passing through the middlebox, the flow records including one or more transaction identifiers assigned to the traffic flow segments;
identifying flow directions of the traffic flow segments in the network environment with respect to the middlebox using the flow records;
maintaining a hash table including entries for each of the traffic flow segments at the middlebox, wherein each entry includes a transaction identifier of the one or more transaction identifiers assigned to the traffic flow segment;
grouping together the entries in the hash table of traffic flow segments having shared transaction identifiers of the one or more transaction identifiers;
stitching together the traffic flow segments to form a stitched traffic flow of the one or more traffic flows passing through the middlebox in the network environment based on the entries of the traffic flow segments grouped together according to the shared transaction identifiers and the flow directions of the traffic flow segments in the network environment with respect to the middlebox; and
incorporating the stitched traffic flow as part of network traffic data for the network environment.

2. The method of claim 1 , wherein the one or more traffic flows pass through the middlebox directly between a client and a server.

3. The method of claim 1 , wherein the one or more traffic flows pass through the middlebox to another middlebox in the network environment.

4. The method of claim 1 , wherein the flow records are collected from the middlebox as the middlebox exports the flow records using an Internet Protocol Flow Information Export protocol.

5. The method of claim 1 , wherein the flow records include sources and destinations of the traffic flow segments at the middlebox, and the sources and the destinations of the traffic flow segments are used to stitch together the traffic flow segments to form the stitched traffic flow at the middlebox.

6. The method of claim 5 , wherein the sources and the destinations of the traffic flow segments are used to identify the flow directions of the traffic flow segments in the network environment with respect to the middlebox.

7. The method of claim 1 , further comprising: identifying whether the stitched traffic flow forms a complete flow from the one or more traffic flows for a transaction between two entities in a network environment; and if it is determined that the stitched traffic flow forms the complete flow for the transaction between the two entities in a network environment, then pushing traffic flow data for the stitched traffic flow to a network traffic monitoring system remote from the middlebox to incorporate the stitched traffic flow as part of the network traffic data for the network environment.

8. The method of claim 7 , wherein the two entities include a client and a server.

9. The method of claim 8 , wherein the complete flow of the transaction between the client and the server includes a request sent from the client to the middlebox and included as part of the traffic flow segments at the middlebox, the request sent from the middlebox to the server and included as part of the traffic flow segments at the middlebox, a response to the request sent from the server to the middlebox and included as part of the traffic flow segments at the middlebox, and the response to the request sent from the middlebox to the client and included as part of the traffic flow segments at the middlebox.

10. The method of claim 1 ,
wherein each hash table entry includes a source and a destination of data in a corresponding traffic flow segment of the hash table entry, the method further comprising
using the hash table of the traffic flow segments at the middlebox to form the stitched traffic flow at the middlebox in the network environment based on sources and destinations of the traffic flow segments included in the entries of the traffic flow segments in the hash table.

11. The method of claim 10 , further comprising identifying the flow directions of the traffic flow segments in the network environment using the hash table.

12. The method of claim 11 , further comprising identifying the flow directions of the traffic flow segments in the network environment based on the sources and destinations of the traffic flow segments included in the entries of the traffic flow segments in the hash table.

13. The method of claim 1 , wherein the stitched traffic flow is used to create an application dependency mapping as part of the network traffic data for the network environment.

14. The method of claim 1 , wherein the stitched traffic flow is used to create a policy for the middlebox.

15. A system comprising:
one or more processors; and at least one non-transitory computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
collecting flow records of traffic flow segments at a middlebox in a network environment corresponding to one or more traffic flows passing between a client and a server directly through the middlebox, the flow records including one or more transaction identifiers assigned to the traffic flow segments;
identifying flow directions of the traffic flow segments in the network environment with respect to the middlebox using the flow records;
maintaining a hash table including entries for each of the traffic flow segments at the middlebox, wherein each entry includes a transaction identifier of the one or more transaction identifiers assigned to the traffic flow segment;
grouping together the entries in the hash table of traffic flow segments having shared transaction identifiers of the one or more transaction identifiers;
stitching together the traffic flow segments to form a stitched traffic flow of the one or more traffic flows passing through the middlebox in the network environment based on the entries of the traffic flow segments grouped together according to the shared transaction identifiers and the flow directions of the traffic flow segments in the network environment with respect to the middlebox; and
incorporating the stitched traffic flow as part of network traffic data for the network environment.

16. The system of claim 15 , wherein the flow records include sources and destinations of the traffic flow segments at the middlebox, and the sources and the destinations of the traffic flow segments are used to stitch together the traffic flow segments to form the stitched traffic flow at the middlebox.

17. The system of claim 15 , wherein the traffic flow segments includes a request sent from the client to the middlebox and included as part of the traffic flow segments at the middlebox, the request sent from the middlebox to the server and included as part of the traffic flow segments at the middlebox, a response to the request sent from the server to the middlebox and included as part of the traffic flow segments at the middlebox, and the response to the request sent from the middlebox to the client and included as part of the traffic flow segments at the middlebox.

18. The system of claim 17 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising: determining if the response to the request is sent directly from the server to the client through the middlebox; and ge

Assignees

• Cisco Tech Inc

Inventors

• Rao Supreeth
• Yadav Navindra
• Arumugam Umamaheswaran
• Watts Micheal
• Gandham Shashi
• Malleshaiah Prasannakumar Jobigenahally
• Nguyen Duy
• Vu Hai
• Patwardhan Tapan Shrikrishna
• Ma Aiyesha
• Zou Xuan
• Prabakaran Jothi Prakash

Classifications

• H04L45/38

  Flow based routing · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L47/2483

  involving identification of individual flows · CPC title

• H04L43/10

  Active monitoring, e.g. heartbeat, ping or trace-route · CPC title

• H04L41/082

  the condition being updates or upgrades of network functionality · CPC title