Analytics for a distributed network

Patent metadata

Field	Value
Publication number	US-2017091204-A1
Application number	US-201514958466-A
Country	US
Kind code	A1
Filing date	Dec 3, 2015
Priority date	Sep 30, 2015
Publication date	Mar 30, 2017
Grant date	—

Abstract

One example method includes receiving, by a central analytics system, a query for traffic flow data associated with a geographically distributed network of network devices, outputting, by the central analytics system, the query to a plurality of analytics pods, wherein each of the plurality of analytics pods is coupled to a storage unit of a network device within the geographically distributed network, and, responsive to outputting the query, receiving, by the central analytics system and from the plurality of analytics pods, results of the query, wherein the results include at least the traffic flow data from the plurality of analytics pods based on the query.

First claim

1 . A method comprising:
receiving, by a central analytics system, a query for traffic flow data associated with a geographically distributed network of network devices; outputting, by the central analytics system, the query to a plurality of analytics pods, wherein each of the plurality of analytics pods is coupled to a storage unit of a network device within the geographically distributed network; and responsive to outputting the query, receiving, by the central analytics system and from the plurality of analytics pods, results of the query, wherein the results include at least the traffic flow data from the plurality of analytics pods based on the query.

2 . The method of claim 1 , further comprising:
determining, by the central analytics system, a subset of analytics pods of the plurality of analytics pods that receive the query, wherein outputting the query to the plurality of analytics pods comprises outputting, by the central analytics system, the query to the subset of analytics pods, wherein receiving the results from the plurality of analytics pods comprises receiving, by the central analytics system, the results from the subset of analytics pods, the results including at least the traffic flow data from the subset of analytics pods based on the query, and wherein the method further comprises aggregating, by the central analytics system, the results to generate an aggregated response to the query.

3 . The method of claim 2 , wherein determining the subset of analytics pods that receive the query comprises:
determining, by the central analytics system, topology information based on a topology of the distributed network of network devices; and determining, by the central analytics system, the subset of analytics pods that receive the query based at least on the topology information.

4 . The method of claim 3 , wherein determining the subset of analytics pods that receive the query further comprises:
determining, by the central analytics system, route information associated with the distributed network of network devices; and determining, by the central analytics system, the subset of analytics pods that receive the query further based on the route information.

5 . The method of claim 3 ,
wherein the subset of analytics pods are arranged in one or more hierarchical arrangements based on the topology of the distributed network, and wherein the subset of analytics pods comprise at least one parent analytics pod in the one or more hierarchical arrangements, the at least one parent analytics pod being associated with one or more child analytics pods in the one or more hierarchical arrangements.

6 . The method of claim 1 ,
wherein the query comprises a query for first and second portions of the traffic flow data associated with respective first and second data flows of a plurality of data flows in the distributed network, and wherein receiving the results of the query comprises receiving, by the central analytics system and from the plurality of analytics pods, the first and second portions of the traffic flow data associated with the respective first and second data flows.

7 . The method of claim 6 ,
wherein the first portion of the traffic flow data associated with the first data flow comprises one or more of a number of packets associated with the first data flow, a number of bytes associated with the first data flow, a time of capturing a first packet for the first data flow, or a time of capturing a most recent packet for the first data flow, and wherein the second portion of the traffic flow data associated with the second data flow comprises one or more of a number of packets associated with the second data flow, a number of bytes associated with the second data flow, a time of capturing a first packet for the second data flow, or a time of capturing a most recent packet for the second data flow.

8 . The method of claim 1 , wherein receiving the results of the query comprises:
receiving, by the central analytics system and from a first analytics pod of the plurality of analytics pods, a first portion of the traffic flow data; receiving, by the central analytics system and from a second analytics pod of the plurality of analytics pods, a second portion of the traffic flow data; and aggregating, by the central analytics system, the first and second portions of the traffic flow data.

9 . The method of claim 1 , wherein the query received by the central analytics system specifies at least one of a source Internet Protocol (IP) address, a source port, a destination IP address, and a destination port associated with the traffic flow data.

10 . The method of claim 1 , wherein the query received by the central analytics system specifies a time-based criterion associated with the traffic flow data.

11 . A central analytics system, comprising:
at least one processor, wherein the at least one processor is configured to:
receive a query for traffic flow data associated with a geographically distributed network of network devices;
output the query to a plurality of analytics pods, wherein each of the plurality of analytics pods is coupled to a storage unit of a network device within the geographically distributed network; and
responsive to outputting the query, receive, from the plurality of analytics pods, results of the query, wherein the results include at least the traffic flow data from the plurality of analytics pods based on the query.

12 . The central analytics system of claim 11 ,
wherein the at least one processor is further configured to determine a subset of analytics pods of the plurality of analytics pods that receive the query, wherein the at least one processor is configured to output the query to the plurality of analytics pods at least by outputting the query to the subset of analytics pods, wherein the at least one processor is configured that receive the results from the plurality of analytics pods at least by receiving the results from the subset of analytics pods, the results including at least the traffic flow data from the subset of analytics pods based on the query, and wherein the at least one processor is further configured to aggregate the results to generate an aggregated response to the query.

13 . The central analytics system of claim 12 , wherein the at least one processor is configured to determine the subset of analytics pods that receive the query at least by determining topology information based on a topology of the distributed network of network devices, and determining the subset of analytics pods that receive the query based at least on the topology information.

14 . The central analytics system of claim 13 , wherein the at least one processor is further configured to determine the subset of analytics pods that receive the query at least by determining route information associated with the distributed network of network devices, and determining the subset of analytics pods that receive the query further based on the route information.

15 . The central analytics system of claim 13 ,
wherein the subset of analytics pods are arranged in one or more hierarchical arrangements based on the topology of the distributed network, and wherein the subset of analytics pods comprise at least one parent analytics pod in the one or more hierarchical arrangements, the at least one parent analytics pod being associated with one or more child analytics pods in the one or more hierarchical arrangements.

16 . The central analytics system of claim 11 ,
wherein the query comprises a query for first and second portions of the

Assignees

• Juniper Networks Inc

Inventors

• Minwalla Nosherwan
• Boddu Jayabharat
• Sindhu Pradeep

Classifications

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L43/026

  using flow identification · CPC title

• G06F16/29

  Geographical information databases · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L43/062

  related to network traffic · CPC title