System and method of detecting packet loss in a distributed sensor-collector architecture

Patent metadata

Field	Value
Publication number	US-2016359698-A1
Application number	US-201615171618-A
Country	US
Kind code	A1
Filing date	Jun 2, 2016
Priority date	Jun 5, 2015
Publication date	Dec 8, 2016
Grant date	—

Abstract

A method includes analyzing, via a first capturing agent, packets processed in a first environment associated with a first host to yield first data. The method includes analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, collecting the first data and the second data at a collector to yield aggregated data, transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis. Based on the analysis, the method includes identifying first packet loss at the first environment and second packet loss at the second environment.

First claim

What is claimed is:

1 . A method comprising:
analyzing, via a first capturing agent, packets processed by a first environment associated with a first host to yield first data; analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, wherein the first capturing agent is deployed in a first layer of a network and the second capturing agent is deployed in a second layer of the network, the first layer and the second layer respectively comprising one of a physical layer, a hypervisor layer, or a virtual machine layer; collecting the first data and the second data at a collector to yield aggregated data; transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis; and based on the analysis, identifying first packet loss at the first environment and second packet loss at the second environment.

2 . The method of claim 1 , wherein a packet flow occurs through the first environment and the second environment.

3 . The method of claim 1 , wherein the identifying of the first packet loss at the first environment and the second packet loss at the second environment is performed by comparing packets captured and reported by the first capturing agent and the second capturing agent.

4 . The method of claim 3 , wherein the comparing of the packets captured and reported by the first capturing agent and the second capturing agent is performed on one of a per flow, per link and per host basis.

5 . The method of claim 3 , wherein the comparing of the packets captured and reported by the first capturing agent and the second capturing agent is performed is performed during a specific time window.

6 . The method of claim 5 , wherein the specific time window is extendable beyond a completion of a task.

7 . The method of claim 6 , wherein an amount of time the specific time window is extended is based on how much over a threshold a packet loss is during the specific time window.

8 . A system comprising:
a processor; and a computer-readable storage medium storing instructions which, when executed by the processor, cause the processor to perform operations comprising:
analyzing, via a first capturing agent, packets processed by a first environment associated with a first host to yield first data;
analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, wherein the first capturing agent is deployed in a first layer of a network and the second capturing agent is deployed in a second layer of the network, the first layer and the second layer respectively comprising one of a physical layer, a hypervisor layer, or a virtual machine layer;
collecting the first data and the second data at a collector to yield aggregated data;
transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis; and
based on the analysis, identifying first packet loss at the first environment and second packet loss at the second environment.

9 . The system of claim 8 , wherein a packet flow occurs through the first environment and the second environment.

10 . The system of claim 9 , wherein the identifying of the first packet loss at the first environment and the second packet loss at the second environment is performed by comparing packets captured and reported by the first capturing agent and the second capturing agent.

11 . The system of claim 10 , wherein the comparing of the packets captured and reported by the first capturing agent and the second capturing agent is performed on one of a per flow, per link and per host basis.

12 . The system of claim 10 , wherein the comparing of the packets captured and reported by the first capturing agent and the second capturing agent is performed is performed during a specific time window.

13 . The system of claim 12 , wherein the specific time window is extendable beyond a completion of a task.

14 . The system of claim 13 , wherein an amount of time the specific time window is extended is based on how much over a threshold a packet loss is during the specific time window.

15 . A computer-readable storage device that stores instructions which, when executed by a processor, cause the processor to perform further operations comprising:
analyzing, via a first capturing agent, packets processed by a first environment associated with a first host to yield first data; analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, wherein the first capturing agent is deployed in a first layer of a network and the second capturing agent is deployed in a second layer of the network, the first layer and the second layer respectively comprising one of a physical layer, a hypervisor layer, or a virtual machine layer; collecting the first data and the second data at a collector to yield aggregated data; transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis; and based on the analysis, identifying first packet loss at the first environment and second packet loss at the second environment.

16 . The computer-readable storage device of claim 15 , wherein a packet flow occurs through the first environment and the second environment.

17 . The computer-readable storage device of claim 15 , wherein the identifying of the first packet loss at the first environment and the second packet loss at the second environment is performed by comparing packets captured and reported by the first capturing agent and the second capturing agent.

18 . The computer-readable storage device of claim 17 , wherein the comparing of the packets captured and reported by the first capturing agent and the second capturing agent is performed on one of a per flow, per link and per host basis.

19 . The computer-readable storage device of claim 17 , wherein the comparing of the packets captured and reported by the first capturing agent and the second capturing agent is performed is performed during a specific time window.

20 . The computer-readable storage device of claim 19 , wherein the specific time window is extendable beyond a completion of a task.

Assignees

• Cisco Tech Inc

Inventors

• Deen Khawar
• Yadav Navindra
• Gupta Anubhav
• Gandham Shashidhar
• Prasad Rohit Chandra
• Singh Abhishek Ranjan
• Chang Shih-Chun

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04W72/54

  based on quality criteria · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04W84/18

  Self-organising networks, e.g. ad-hoc networks or sensor networks · CPC title