Mechanism for identifying differences between network snapshots

Patent metadata

Field	Value
Publication number	US-11924240-B2
Application number	US-202017105409-A
Country	US
Kind code	B2
Filing date	Nov 25, 2020
Priority date	Jan 25, 2018
Publication date	Mar 5, 2024
Grant date	Mar 5, 2024

Abstract

Aspects of the subject technology relate to a system configured to receive a set of network snapshot segments from an output stream of a stream processing service, compile the set of network snapshot segments from the set of messages into a first network snapshot and a second network snapshot, and compare the first network snapshot and the second network snapshot to identify a difference between the first network snapshot and the second network snapshot.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
receiving a set of messages associated with an output stream of a stream processing service, wherein each message in the set of messages includes a network snapshot segment;
identifying an offset for a first network snapshot segment;
based on the offset, determining if the first network snapshot segment is a first segment of a first network snapshot;
in response to the first network snapshot segment not being the first segment of the first network snapshot, requesting additional messages based on the offset;
receiving the additional messages including an additional network snapshot segment;
compiling, from the set of messages and the additional network snapshot segment, a first network snapshot;
identifying a difference between the first network snapshot and a second network snapshot;
providing the difference to a consumer system.

2. The method of claim 1 , wherein the difference is identified based at least on metadata contained in the set of messages.

3. The method of claim 1 , further comprising: compiling the second network snapshot.

4. The method of claim 3 , wherein the first network snapshot corresponds to a state of a network during a first time period and the second network snapshot corresponds to the state of the network during a second time period.

5. The method of claim 1 , wherein the difference between the first network snapshot and the second network snapshot indicates a change in a state of a network.

6. The method of claim 1 , further comprising:
receiving filtering criteria for the first network snapshot and the second network snapshot; and
filtering the first network snapshot and the second network snapshot or the difference based on the filtering criteria.

7. The method of claim 6 , wherein the filtering criteria comprises a list of IP addresses associated with the consumer system.

8. A system comprising:
at least one processor; and
at least one memory storing instructions, which when executed by the at least one processor, cause the system to:
receive a set of messages associated with an output stream of a stream processing service, wherein each message in the set of messages includes a network snapshot segment;
identify an offset for a first network snapshot segment;
based on the offset, determine if the first network snapshot segment is a first segment of a first network snapshot;
in response to the first network snapshot segment not being the first segment of the first network snapshot, request additional messages based on the offset;
receive the additional messages including an additional network snapshot segment;
compile, from the set of messages and the additional network snapshot segment, a first network snapshot;
identify a difference between the first network snapshot and a second network snapshot;
provide the difference to a consumer system.

9. The system of claim 8 , wherein the difference is identified based at least on metadata contained in the set of messages.

10. The system of claim 8 , further comprising instructions which when executed cause the system to compile the second network snapshot.

11. The system of claim 10 , wherein the first network snapshot corresponds to a state of a network during a first time period and the second network snapshot corresponds to the state of the network during a second time period.

12. The system of claim 8 , wherein the difference between the first network snapshot and the second network snapshot indicates a change in a state of a network.

13. The system of claim 8 , further comprising instructions which when executed cause the system to:
receive filtering criteria for the first network snapshot and the second network snapshot; and
filter the first network snapshot and the second network snapshot or the difference based on the filtering criteria.

14. The system of claim 13 , wherein the filtering criteria comprises a list of IP addresses associated with a consumer system.

15. At least one non-transitory computer readable medium storing instructions, which when executed by at least one processor, cause the at least one processor to:
receive a set of messages associated with an output stream of a stream processing service, wherein each message in the set of messages includes a network snapshot segment;
identify an offset for a first network snapshot segment;
based on the offset, determine if the first network snapshot segment is a first segment of a first network snapshot;
in response to the first network snapshot segment not being the first segment of the first network snapshot, request additional messages based on the offset;
receive the additional messages including an additional network snapshot segment;
compile, from the set of messages and the additional network snapshot segment, a first network snapshot;
identify a difference between the first network snapshot and a second network snapshot;
provide the difference to a consumer system.

16. The at least one non-transitory computer readable medium of claim 15 , wherein the difference is identified based at least on metadata contained in the set of messages.

17. The at least one non-transitory computer readable medium of claim 15 , further comprising instructions which when executed cause the at least one processor to compile the second network snapshot.

18. The at least one non-transitory computer readable medium of claim 17 , wherein the first network snapshot corresponds to a state of a network during a first time period and the second network snapshot corresponds to the state of the network during a second time period.

19. The at least one non-transitory computer readable medium of claim 15 , wherein the difference between the first network snapshot and the second network snapshot indicates a change in a state of a network.

20. The at least one non-transitory computer readable medium of claim 15 , further comprising instructions which when executed cause the at least one processor to:
receive filtering criteria for the first network snapshot and the second network snapshot; and
filter the first network snapshot and the second network snapshot or the difference based on the filtering criteria.

Assignees

• Cisco Tech Inc

Inventors

• Gandham Shashi
• Yadav Navindra
• Radhakrishnan Janardhanan
• Nguyen Hoang-Nam
• Mahindra Umesh Paul
• Gupta Sunil
• Vallem Praneeth
• Rao Supreeth
• Purandare Darshan Shrinath
• Zou Xuan
• Beshay Joseph Daniel
• Prabakaran Jothi Prakash

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L41/0886

  Fully automatic configuration · CPC title

• H04L41/145 Primary

  involving simulating, designing, planning or modelling of a network · CPC title