Discovery and mapping of containerized software applications

Patent metadata

Field	Value
Publication number	US-10944654-B2
Application number	US-201816001537-A
Country	US
Kind code	B2
Filing date	Jun 6, 2018
Priority date	Jun 6, 2018
Publication date	Mar 9, 2021
Grant date	Mar 9, 2021

Abstract

An example system includes a database disposed within a remote network management platform that manages a managed network, where one or more worker nodes are configured to execute containerized software applications on behalf of the managed network. The system also includes a computing device configured to request and receive configuration data identifying the applications; access traffic data generated by packet detection modules disposed amongst the one or more worker nodes and configured to (i) monitor network traffic between the applications and (ii) generate and store the traffic data which is indicative of the monitored network traffic; parse the traffic data for one or more patterns indicative of communicative relationships between the applications; based on the one or more patterns being present in the traffic data, generate mappings between the applications that have communicative relationships therebetween; and store, in the database, the configuration data and the mappings.

First claim

What is claimed is:

1. A computing system comprising:
a database disposed within a remote network management platform that manages a managed network, wherein the managed network obtains service from a computing cluster that includes a master node and a plurality of worker nodes configured to execute a plurality of containerized software applications in pods on behalf of the managed network, and wherein the master node is configured to manage distribution of the pods across the plurality of worker nodes; and
a computing device disposed within the remote network management platform and configured to:
request and receive, from packet detection modules disposed amongst the plurality of worker nodes, traffic data generated by the packet detection modules, wherein the packet detection modules are configured to (i) monitor network traffic between the plurality of containerized software applications and (ii) generate and store the traffic data, wherein the traffic data is indicative of the monitored network traffic;
receive, from the master node, configuration data identifying the plurality of containerized software applications, wherein the configuration data includes a list of addresses assigned to the plurality of containerized software applications at a point in time, and wherein the configuration data identifies a first containerized software application and a second containerized software application in the plurality of containerized software applications;
parse the traffic data for one or more patterns indicative of a communicative relationship between the first containerized software application and the second containerized software application at a particular time by:
identifying, in the traffic data, a first address and a second address, wherein the first address and the second address correspond to addresses assigned to different containerized software applications of the plurality of containerized software applications;
identifying, based on the traffic data, a timestamp corresponding to a communication between the first address and the second address; and
determining, based on the configuration data, that the first address was assigned to the first containerized software application and the second address was assigned to the second containerized software application at a time indicated by the timestamp;

generate, based on the one or more patterns being present in the traffic data, a mapping between the first containerized software application and the second containerized software application; and
store the mapping in the database.

2. The computing system of claim 1 , wherein each pod is configured to execute therein one or more of the plurality of containerized software applications and wherein the master node is configured to manage distribution of the pods across the plurality of worker nodes by:
receiving an indication of a desired number of pods for each containerized software application of the plurality of containerized software applications;
providing instructions to the plurality of worker nodes to initiate execution of the desired number of pods for each containerized software application across the plurality of worker nodes;
determining that one or more pods of the desired number of pods have terminated; and
providing instructions to at least one of the plurality of worker nodes to replace the one or more pods that have terminated with one or more replacement pods to maintain the desired number of pods for each containerized software application, wherein the configuration data identifying the plurality of containerized software applications indicates the one or more pods that have terminated and the one or more replacement pods, and wherein the traffic data indicates monitored network traffic related to the one or more pods that have terminated and the one or more replacement pods.

3. The computing system of claim 1 , wherein the computing device is configured to:
generate a definition of a graph that represents the plurality of containerized software applications as nodes and communicative relationships including the communicative relationship therebetween as links; and
store, in the database, the definition of the graph.

4. The computing system of claim 3 , wherein the computing device is configured to:
provide, to a client device associated with the managed network, a representation of a graphical user interface that displays the graph in accordance with the stored definition.

5. The computing system of claim 1 , wherein the monitored network traffic comprises network traffic between the plurality of containerized software applications and one or more computing devices external to the computing cluster.

6. The computing system of claim 1 , wherein the packet detection modules are configured to generate and store the traffic data indicative of the monitored network traffic by:
identifying, within the monitored network traffic, Transmission Control Protocol (TCP) SYN packets exchanged between containerized software applications of the plurality of containerized software applications, wherein a TCP SYN packet indicates initiation of a new network connection; and
storing traffic data indicative of the TCP SYN packets exchanged between the containerized software applications.

7. The computing system of claim 1 , wherein the computing device is configured to periodically repeat (i) the requesting and receiving of traffic data and (ii) the receiving of the configuration data to monitor a distribution of the plurality of containerized software applications across the plurality of worker nodes over time.

8. The computing system of claim 7 , wherein the configuration data and mappings including the mapping corresponding thereto are timestamped, and wherein the computing device is configured to store the configuration data and the mappings by:
storing a timestamp associated with the configuration data and the mappings corresponding thereto to represent the distribution of the containerized software applications across the plurality of worker nodes over time.

9. The computing system of claim 1 , wherein the computing device is configured to parse the traffic data for the one or more patterns by:
determining that the first containerized software application identified by the configuration data transmitted one or more packets of a given type to the second containerized software application identified by the configuration data.

10. The computing system of claim 1 , wherein the first containerized software application is executed by a first worker node of the plurality of worker nodes and the second containerized software application is executed by a second worker node of the plurality of worker nodes, and wherein the first worker node is different from the second worker node.

11. The computing system of claim 1 , wherein the first containerized software application and the second containerized software application are each executed by a first worker node of the plurality of worker nodes.

12. The computing system of claim 1 , wherein the computing cluster is disposed within one or more of (i) the remote network management platform, (ii) the managed network, or (iii) a third-party computing system different from the remote network management platform and the managed network.

13. The computing system of claim 1 , wherein the configuration data identifying the plurality of containerized software applications comprises a group of one or more of (i) an indication of a pod in which a particular software application is being executed, (ii) an indication of a container within a pod in which the particular software application is being executed

Assignees

• Servicenow Inc

Inventors

• Rimar Yuval
• Rosh Haviv
• Garty Asaf
• Badyan Daniel

Classifications

• G06F2009/45591

  Monitoring or debugging support · CPC title

• H04L43/026

  using flow identification · CPC title

• H04L43/062

  related to network traffic · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title