Discovery of middleboxes using traffic flow stitching

Patent metadata

Field	Value
Publication number	US-10798015-B2
Application number	US-201816011427-A
Country	US
Kind code	B2
Filing date	Jun 18, 2018
Priority date	Jan 25, 2018
Publication date	Oct 6, 2020
Grant date	Oct 6, 2020

Abstract

Systems, methods, and computer-readable media for flow stitching network traffic flow segments across middleboxes. A method can include collecting flow records of traffic flow segments at a first middlebox and a second middlebox in a network environment including one or more transaction identifiers assigned to the traffic flow segments. Sources and destinations of the traffic flow segments can be identified with respect to the first middlebox and the second middlebox. Corresponding subsets of the traffic flow segments can be stitched together to from a first stitched traffic flow at the first middlebox and a second stitched traffic flow at the second middlebox. The first and second stitched traffic flows can be stitched together to form a cross-middlebox stitched traffic flow across the first middlebox and the second middlebox. The cross-middlebox stitched traffic flow can be incorporated as part of network traffic data for the network environment.

First claim

What is claimed is:

1. A method comprising:
collecting flow records of traffic flow segments at both a first middlebox and a second middlebox in a network environment corresponding to one or more traffic flows passing through either or both the first middlebox and the second middlebox, the flow records including one or more transaction identifiers assigned to the traffic flows;
identifying sources and destinations of the traffic flow segments in the network environment with respect to either or both the first middlebox or the second middlebox using the flow records;
stitching together a subset of the traffic flow segments to form a first stitched traffic flow about the first middlebox in the network environment based on the one or more transaction identifiers assigned to the traffic flow segments and the sources and destinations of the traffic flow segments in the network environment with respect to the first middlebox;
stitching together another subset of the traffic flow segments to form a second stitched traffic flow about the second middlebox in the network environment based on the one or more transaction identifiers assigned to the traffic flow segments and the sources and destinations of the traffic flow segments in the network environment with respect to the second middlebox;
stitching together the first stitched traffic flow formed about the first middlebox and the second stitched traffic flow formed about the second middlebox based on directions of at least a portion of the first stitched traffic flow with respect to the first middlebox and the second middlebox and directions of at least a portion of the stitched traffic flow with respect to the first middlebox and the second middlebox to form a cross-middlebox stitched traffic flow across the first middlebox and the second middlebox; and
incorporating the cross-middlebox stitched traffic flow as part of network traffic data for the network environment.

2. The method of claim 1 , wherein the subset of the traffic flow segments and the another subset of the traffic flow segments share common traffic flow segments of the traffic flow segments.

3. The method of claim 2 , wherein the first stitched traffic flow and the second stitched traffic flow are stitched together to identify the cross-middlebox stitched traffic flow according to the common traffic flow segments of the traffic flow segments.

4. The method of claim 1 , wherein the first stitched traffic flow and the second stitched traffic flow are stitched together to identify the cross-middlebox stitched traffic flow based on the sources and the destinations of the traffic flow segments in the subset of the traffic flow segments and the another subset of the traffic flow segments.

5. The method of claim 1 , wherein the cross-middlebox stitched traffic flow forms a complete flow of the one or more traffic flows for a transaction between a client and a server in the network environment.

6. The method of claim 5 , wherein the complete flow of the transaction between the client and the server include a request originating at the client and a response to the request originating at the server.

7. The method of claim 6 , wherein the complete flow of the transaction between the client and the server includes a request sent from the client to the first middlebox and included as part of the traffic flow segments, the request sent from the first middlebox to the second middlebox and included as part of the traffic flow segments, the request sent from the second middlebox to the server and included as part of the traffic flow segments, the response to the request sent from the server to the second middlebox and included as part of the traffic flow segments, the response to the request sent from the second middlebox to the first middlebox and included as part of the traffic flow segments, and the response to the request sent from the first middlebox to the client and included as part of the traffic flow segments.

8. The method of claim 6 , further comprising generating the network traffic data to indicate that the complete flow of the transaction between the client and the server passes between the server and the client through multiple middleboxes.

9. The method of claim 1 , wherein the flow records are collected from the first middlebox and the second middlebox as the first middlebox and the second middlebox export the flow records using an Internet Protocol Flow Information Export protocol.

10. The method of claim 1 , further comprising:
maintaining a first hash table of the traffic flow segments at the first middlebox and a second hash table of the traffic flow segments at the second middlebox, the first and second hash tables each including an entry corresponding to each traffic flow segment of the traffic flow segments at either or both the first middlebox and the second middlebox, each entry including a source and a destination of data in a corresponding traffic flow segment of the entry and a transaction identification associated with the corresponding traffic flow segment; and
using the first hash table and the second hash table of the traffic flow segments to form the cross-middlebox stitched traffic flow across the first middlebox and the second middlebox in the network environment based on the one or more transaction identifiers assigned to the traffic flow segments and the sources and destinations, as indicated by entries in the hash table.

11. The method of claim 10 , further comprising:
grouping entries of the hash table based on the traffic flow segments in the entries and the one or more transaction identifications associated with the traffic flow segments in the entries to form grouped entries of the hash table; and
forming the cross-middlebox stitched traffic flow based on the grouped entries of the hash table.

12. The method of claim 1 , further comprising:
identifying flow directions of the traffic flow segments in the network environment with respect to either or both the first middlebox and the second middlebox using the sources and destinations of the traffic flow segments in the network environment; and
stitching together one or a combination of the first stitched traffic flow, the second stitched traffic flow, and the cross-middlebox stitched traffic flow using the flow directions of the traffic flow segments in the network environment.

13. The method of claim 1 , wherein the cross-middlebox stitched traffic flow is used to create an application dependency mapping as part of the network traffic data for the network environment.

14. The method of claim 1 , wherein the cross-middlebox stitched traffic flow is used to create a policy for either or both the first middlebox and the second middlebox.

15. A system comprising:
one or more processors; and
at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
collecting flow records of traffic flow segments at both a first middlebox and a second middlebox in a network environment corresponding to one or more traffic flows passing through either or both the first middlebox and the second middlebox, the flow records including one or more transaction identifiers assigned to the traffic flows;
identifying sources and destinations of the traffic flow segments in the network environment with respect to either or both the first middlebox or the second middlebox using the flow records;
stitching together a subset of the traffic flow segments to form a first stitched traffic flow about the first middlebox in the

Assignees

• Cisco Tech Inc

Inventors

• Rao Supreeth
• Yadav Navindra
• Arumugam Umamaheswaran
• Watts Michael
• Gandham Shashi
• Nguyen Duy
• Vu Hai
• Malleshaiah Prasannakumar Jobigenahally
• Ma Aiyesha
• Zhu Kai
• Purandare Darshan Shrinath
• Prabakaran Jothi Prakash

Classifications

• H04L47/41 Primary

  by acting on aggregated flows or links · CPC title

• H04L43/026 Primary

  using flow identification · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L67/01

  Protocols · CPC title

• H04L45/38

  Flow based routing · CPC title