Agent networking in a containerized environment

Patent metadata

Field	Value
Publication number	US-11201955-B1
Application number	US-201916725836-A
Country	US
Kind code	B1
Filing date	Dec 23, 2019
Priority date	Dec 23, 2019
Publication date	Dec 14, 2021
Grant date	Dec 14, 2021

Abstract

A frame is received at an agent. The frame is analyzed to determine that the frame is associated with a first known pod. IP information is reported to a backend process. The backend process is configured to stitch the IP information with other IP information reported by one or more additional agents to identify a second pod.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
receive, at an agent pod registered on one or more network interfaces of a first virtual machine and configured to collect information associated with the first virtual machine and report it to an external server, a frame;
analyze the received frame, by the agent pod, to determine that the frame is associated with a first known pod, wherein the first known pod is an abstraction of a set of one or more containers deployed together on the same host; and
report a first set of IP information to a backend process executing on the external server, wherein the backend process is configured to stitch the reported first set of IP information received from the agent pod with other IP information reported by one or more additional agent pods registered on one or more network interfaces of a second virtual machine to identify a second pod, wherein the reported first set of IP information comprises information that includes either one of:
(1) a source IP address of the second pod, or
(2) a destination IP address of the second pod,
but does not include both of the source IP address of the second pod and the destination IP address of the second pod; and
wherein stitching the IP information includes matching a client connection with a server connection; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein the frame is encapsulated and wherein analyzing the frame includes de-encapsulating the frame.

3. The system of claim 1 wherein analyzing the frame includes determining whether an IP address included in the frame corresponds to an executing container.

4. The system of claim 1 wherein the agent is configured to determine an overlay network type at runtime.

5. The system of claim 1 wherein the agent is configured to join a namespace.

6. The system of claim 5 wherein the agent is further configured to collect network interface information associated with a container.

7. The system of claim 1 wherein the first pod and the second pod communicate with one another at an application level.

8. The system of claim 1 wherein statistical information associated with the connected client and server connections is associated with the connections.

9. The system of claim 1 wherein stitching the IP information includes determining a process identifier.

10. A method, comprising:
receiving, at an agent pod registered on one or more network interfaces of a first virtual machine and configured to collect information associated with the first virtual machine and report it to an external server, a frame;
analyzing the received frame, by the agent pod, to determine that the frame is associated with a first known pod, wherein the first known pod is an abstraction of a set of one or more containers deployed together on the same host; and
reporting a first set of IP information to a backend process executing on the external server, wherein the backend process is configured to stitch the reported first set of IP information received from the agent pod with other IP information reported by one or more additional agent pods registered on one or more network interfaces of a second virtual machine to identify a second pod, wherein the reported first set of IP information comprises information that includes either one of:
(1) a source IP address of the second pod, or
(2) a destination IP address of the second pod,

but does not include both of the source IP address of the second pod and the destination IP address of the second pod; and
wherein stitching the IP information includes matching a client connection with a server connection.

11. The method of claim 10 wherein the frame is encapsulated and wherein analyzing the frame includes de-encapsulating the frame.

12. The method of claim 10 wherein analyzing the frame includes determining whether an IP address included in the frame corresponds to an executing container.

13. The method of claim 10 wherein the agent is configured to determine an overlay network type at runtime.

14. The method of claim 10 wherein the agent is configured to join a namespace.

15. The method of claim 14 wherein the agent is further configured to collect network interface information associated with a container.

16. The method of claim 10 wherein the first pod and the second pod communicate with one another at an application level.

17. The method of claim 10 wherein statistical information associated with the connected client and server connections is associated with the connections.

18. The method of claim 10 wherein stitching the IP information includes determining a process identifier.

19. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving, at an agent pod registered on one or more network interfaces of a first virtual machine and configured to collect information associated with the first virtual machine and report it to an external server, a frame;
analyzing the received frame, by the agent pod, to determine that the frame is associated with a first known pod, wherein the first known pod is an abstraction of a set of one or more containers deployed together on the same host; and
reporting a first set of IP information to a backend process executing on the external server, wherein the backend process is configured to stitch the reported first set of IP information received from the agent pod with other IP information reported by one or more additional agent pods registered on one or more network interfaces of a second virtual machine to identify a second pod, wherein the reported first set of IP information comprises information that includes either one of:
(1) a source IP address of the second pod, or
(2) a destination IP address of the second pod,

but does not include both of the source IP address of the second pod and the destination IP address of the second pod; and
wherein stitching the IP information includes matching a client connection with a server connection.

20. The system of claim 1 wherein the IP information reported by the agent pod to the backend process comprises a source port of the first known pod, a destination port of the second pod, and a source IP address of the first known pod; and wherein the IP information reported by the agent pod to the backend process does include a destination IP address of the second pod.

21. The system of claim 1 wherein the IP information reported by the agent pod to the backend process comprises a source port of the second pod, a destination port of the first known pod, and a destination IP address of the first known pod; and wherein the IP information reported by the agent pod to the backend process does not include a source IP address of the second pod.

22. The system of claim 1 wherein the frame is received from a router pod.

Assignees

• Lacework Inc

Inventors

• Sachdeva Rakesh
• Kapoor Vikram

Classifications

• H04L67/01

  Protocols · CPC title

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L69/22 Primary

  Parsing or analysis of headers · CPC title

• H04L41/046 Primary

  comprising network management agents or mobile agents therefor · CPC title