High availability of collectors of traffic reported by network sensors

Patent metadata

Field	Value
Publication number	US-2016359704-A1
Application number	US-201615171807-A
Country	US
Kind code	A1
Filing date	Jun 2, 2016
Priority date	Jun 5, 2015
Publication date	Dec 8, 2016
Grant date	—

Abstract

Systems, methods, and computer-readable media for collector high availability. In some embodiments, a system receives, from a first collector device, a first data report generated by a capturing agent deployed on a host system in a network. The system can also receive, from a second collector device, a second data report generated by the capturing agent deployed on the host system. The first and second data reports can include traffic data captured at the host system by the capturing agent during a period of time. The system can determine that the first data report and the second data report are both associated with the capturing agent, and identify duplicate data contained in the first data report and the second data report. The system can then deduplicate the first and second data reports to yield a deduplicated data report.

First claim

What is claimed is:

1 . A method comprising:
receiving, by a system and via a first collector device, a first data report generated by a capturing agent deployed on a host system in a network, the first data report comprising traffic data captured at the host system by the capturing agent; receiving, by the system and via a second collector device, a second data report generated by the capturing agent deployed on the host system, the second data report comprising traffic data captured at the host system by the capturing agent; determining, by the system, that the first data report and the second data report are both associated with the capturing agent; in response to determining that the first and second data reports are both associated with the capturing agent, identifying, by the system, duplicate data contained in the first data report and the second data report; and deduplicating, by the system, the first and second data reports to yield a deduplicated data report.

2 . The method of claim 1 , the method further comprising sending the deduplicated data report to at least one device in the network, the first and second data reports comprising:
a respective timestamp; a respective agent identifier which uniquely identifies the capturing agent from other capturing agents in the network; and a flow identifier which identifies one or more traffic flows captured by the capturing agent.

3 . The method of claim 1 , wherein identifying duplicate data comprises determining that the second data report is a copy of the first data report, and wherein deduplicating the first and second data reports comprises discarding a first one of the first and second data reports and keeping a second one of the first and second data reports.

4 . The method of claim 1 , wherein the capturing agent is configured to capture a set of data comprising at least one of usage data and traffic data at the host, and report the set of data to both the first and second collector devices.

5 . The method of claim 1 , wherein identifying duplicate data comprises determining that at least a first portion of content of the first data report is a duplicate of a second portion of content of the second data report, wherein the duplicate comprises same traffic data captured during a same period of time by the capturing agent, and wherein deduplicating the first and second data reports comprises:
selecting a first one of the first data report or the second data report to yield a selected data report; and filtering a respective one of the first portion of content or the second portion of content from the selected data report to yield the deduplicated data report.

6 . The method of claim 1 , wherein the capturing agent resides in one of a hypervisor on the host or a virtual machine on the hypervisor, the traffic data being associated with the one of the hypervisor or the virtual machine.

7 . The method of claim 1 , wherein identifying duplicate data comprises determining that at least a first portion of content of the first data report is a duplicate of a second portion of content of the second data report, wherein the duplicate comprises same traffic data captured during a same period of time by the capturing agent, and wherein deduplicating the first and second data reports comprises:
merging contents of the first data report and the second data report to yield a merged data report; and filtering one of the first portion of content or the second portion of content from the merged data report to yield the deduplicated data report.

8 . The method of claim 1 , wherein the capturing agent comprises at least one of a process, a kernel module, or a software driver.

9 . The method of claim 1 , wherein the first collector device and the second collector device are both assigned to a flow associated with the traffic data based on a hash value generated by applying a hash function to a flow identifier associated with the flow.

10 . The method of claim 1 , wherein the traffic data comprises one or more timestamps, one or more traffic identifiers, and an agent identifier that uniquely identifies the capturing agent in the network, the method further comprising:
determining that the first data report is associated with the first period of time based on a first respective timestamp; determining that the second data report is associated with the second period of time based on a second respective timestamp; and determining, based on the agent identifier associated with the capturing agent, that the first and second data reports were both generated by the capturing agent.

11 . A system comprising:
one or more processors; and one or more computer-readable storage devices having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, from a first collector device, a first data report generated by a capturing agent deployed on a host system in a network, the first data report comprising traffic data captured at the host system by the capturing agent during a period of time;
receiving, from a second collector device, a second data report generated by the capturing agent deployed on the host system, the second data report comprising traffic data captured at the host system by the capturing agent during the period of time;
determining that the first data report and the second data report are both associated with the capturing agent;
in response to determining that the first and second data reports are both associated with the capturing agent, identifying duplicate data contained in the first data report and the second data report; and
deduplicating the first and second data reports to yield a deduplicated data report.

12 . The system of claim 11 , the one or more computer-readable storage devices storing additional instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising sending the deduplicated data report to at least one device in the network, the first and second data reports comprising:
a respective timestamp associated with the period of time; a respective agent identifier which uniquely identifies the capturing agent from other capturing agents in the network; and a flow identifier which identifies one or more traffic flows captured by the capturing agent.

13 . The system of claim 11 , wherein identifying duplicate data comprises determining that the second data report is a copy of the first data report, and wherein deduplicating the first and second data reports comprises discarding a first one of the first and second data reports and keeping a second one of the first and second data reports.

14 . The system of claim 11 , wherein the host comprises a server, and wherein the capturing agent resides in a hypervisor on the server.

15 . The system of claim 11 , wherein identifying duplicate data comprises determining that at least a first portion of content of the first data report is a duplicate of a second portion of content of the second data report, wherein the duplicate comprises same traffic data captured during a same period of time by the capturing agent, and wherein deduplicating the first and second data reports comprises:
selecting a first one of the first data report or the second data report to yield a selected data report; and filtering a respective one of the first portion of content or the second portion of content from the selected data report to yield the deduplicated data report.

16 . A computer-readable stor

Assignees

• Cisco Tech Inc

Inventors

• Gandham Shashidhar
• Prasad Rohit Chandra
• Singh Abhishek Ranjan
• Yadav Navindra
• Deen Khawar
• Malhotra Varun Sagar

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04W72/54

  based on quality criteria · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L63/16

  Implementing security features at a particular protocol layer · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title