Network enumeration at a network visibility node

Patent metadata

Field	Value
Publication number	US-2018205611-A1
Application number	US-201715406500-A
Country	US
Kind code	A1
Filing date	Jan 13, 2017
Priority date	Jan 13, 2017
Publication date	Jul 19, 2018
Grant date	—

Abstract

Techniques are disclosed for identifying entities (e.g. users, devices, applications, etc.) connected to a computer network. Operations in accordance with the disclosed techniques can be performed at one or more network visibility nodes that operate as part of a visibility fabric, for example for monitoring traffic on the network. In certain embodiments, packets associated with the traffic are received at a network visibility node communicatively coupled to the network that is operable to enable visibility across the network. The network visibility node processes the packets to identify entities connected to the network and generates network enumeration data based on the processing. In some embodiments, the network enumeration data is accessible via a service to subscribers of the service.

First claim

What is claimed is:

1 . A method comprising:
receiving, at network visibility node communicatively coupled to a computer network, a plurality of packets associated with network traffic on the computer network, the network traffic sent and/or received by a plurality of entities associated with the computer network; processing, by the network visibility node, the received packets to identify the plurality of entities associated with the computer network based on data included in the received packets; generating and storing, by the network visibility node, network enumeration data indicative of the identified plurality of entities associated with the computer network; and enabling access, by the network visibility node, to the network enumeration data as a service to subscribers of the service.

2 . The method of claim 1 , wherein the network visibility node operates out-of-band with the computer network.

3 . The method of claim 1 , wherein the plurality of entities include any one or more of a device, a user, or an application.

4 . The method of claim 1 , wherein the subscribers of the service include any one or more of a device, a user, an application, or another service.

5 . The method of claim 1 , wherein the network visibility node is communicatively coupled to the computer network via a network tap or a packet mirroring port.

6 . The method of claim 1 , wherein the network visibility node is part of a visibility fabric, wherein the visibility fabric is communicatively coupled to at least one network tool, and wherein the visibility fabric is operable to enable visibility across the computer network by routing network traffic information to the at least one network tool, the network traffic information including any of:
at least some of the received plurality of packets; or metadata extracted from at least some of the received plurality of packets.

7 . The method of claim 1 , further comprising:
detecting a change in the identified plurality of entities communicatively coupled to the computer network.

8 . The method of claim 7 , wherein the detected change includes any of:
a change in configuration of a previously identified entity; removal of a previously identified entity from the computer network; or addition of a newly identified entity to the computer network.

9 . The method of claim 7 , further comprising:
generating a notification in response to detecting a change in the identified plurality of entities; and transmitting the notification to a subscriber of the service.

10 . The method of claim 7 , further comprising:
updating the network enumeration data based on the detected change in response to detecting the change in the identified plurality of entities.

11 . The method of claim 7 , further comprising:
causing application of a network traffic rule in the computer network in response to the detected change in the identified plurality of entities.

12 . The method of claim 1 , wherein the service is accessible via an application program interface (API).

13 . The method of claim 1 , wherein enabling access to the network enumeration data includes publishing the enumeration data for access by the subscribers of the service.

14 . The method of claim 1 , wherein the network enumeration data is accessible to the subscriber via the service as any one or more of:
a spreadsheet; a data object; an event; or a log.

15 . The method of claim 1 , wherein the network enumeration data includes a listing of entity identifiers associated with the identified plurality of entities.

16 . The method of claim 1 , wherein the network enumeration data includes a visual representation of relationships between at least some of the identified plurality of entities.

17 . The method of claim 1 , wherein processing the plurality of packets to identify the plurality of entities includes determining an entity type or entity role for at least one of the identified plurality of entities.

18 . The method of claim 1 , wherein processing the plurality of packet to identify the plurality of entities includes determining relationships between two or more of the identified plurality of entities.

19 . The method of claim 1 , wherein a particular entity of the plurality of entities is identify based on an analysis of any of a packet identifier, a source identifier, a destination identifier, a protocol identifier, or other metadata included in the received packets.

20 . The method of claim 1 , further comprising:
forwarding network traffic information to a network tool communicatively coupled to the network visibility node for processing, the network traffic information including any of:
at least some of the received plurality of packets; or
metadata extracted from at least some of the received plurality of packets;
wherein the network monitoring tool is the subscriber of the service and is operable to access the network enumeration data via the service for use in the processing of the network traffic information.

21 . A system comprising:
a processing unit; a network port configured to communicatively couple the processing unit to a computer network; and a memory unit having instructions stored thereon, that when executed by the processing unit cause the system to:
receive, via the network port, a plurality of packets associated with network traffic over the computer network;
process the received packets to identify a plurality of entities communicatively coupled to the computer network based on data included in the received packets;
generate network enumeration data based on the identified plurality of entities communicatively coupled to the computer network; and
enable access to the network enumeration data as a service.

22 . A network visibility node comprising:
a network port through which to communicate with a computer network; an instrument port through which to communicate with an external network monitoring tool; and a processing unit communicatively coupled to the network port, the processing unit configured to:
receive, via the network port, a plurality of packets associated with network traffic over the computer network;
process the received packets to identify a plurality of entities communicatively coupled to the computer network based on data included in the received packets;
generate network enumeration data based on the identified plurality of entities communicatively coupled to the computer network; and
enable access to the network enumeration data as a service.

Assignees

• Gigamon Inc

Inventors

• Gibson Simon H
• Merchant Shehzad

Classifications

• H04L43/12

  Network monitoring probes · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L67/26

  Electricity · mapped topic

• H04L41/12 Primary

  Discovery or management of network topologies · CPC title

• H04L67/535 Primary

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title