Dynamic collection of network metrics for predictive analytics

Patent metadata

Field	Value
Publication number	US-9654361-B2
Application number	US-201414276563-A
Country	US
Kind code	B2
Filing date	May 13, 2014
Priority date	May 13, 2014
Publication date	May 16, 2017
Grant date	May 16, 2017

Abstract

In one embodiment, data is received at a device regarding a network-monitoring process in which one or more nodes in a network export network metrics to one or more collector nodes. A change to the network-monitoring process is determined based on the received data. The device also adjusts the network-monitoring process to implement the determined change.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a device, data regarding a network-monitoring process in which one or more nodes in a network monitor traffic flows flowing through the one or more nodes and export traffic records to one or more collector nodes that include network metrics for the monitored traffic flows;
determining that the gathering of the network metrics and exporting of the traffic records by the network-monitoring process has an adverse effect on the network based on the received data, wherein the adverse effect comprises user traffic in the network being impacted by the network-monitoring process;
determining a change to the network-monitoring process based on the received data and on the adverse effect;
dynamically adjusting, by the device, the network-monitoring process to implement the determined change;
detecting a traffic pattern anomaly in the network;
identifying one or more metrics regarding the anomaly to monitor; and
instructing a particular node to export the one or more metrics via traffic records.

2. The method as in claim 1 , wherein adjusting the network-monitoring process further comprises:
instructing a particular node to stop exporting traffic records.

3. The method as in claim 1 , wherein adjusting the network-monitoring process further comprises:
instructing a particular node to export fewer traffic records.

4. The method as in claim 1 , wherein adjusting the network-monitoring process further comprises:
instructing a particular node to export traffic records less frequently.

5. The method as in claim 1 , wherein adjusting the network-monitoring process further comprises:
instructing a particular node to aggregate metrics prior to exporting the aggregated metrics via exported traffic records.

6. The method as in claim 1 , wherein adjusting the network-monitoring process further comprises:
instructing a particular node to stop collecting network metrics.

7. The method as in claim 1 , wherein the adverse effect corresponds to at least one of: increased traffic along a particular network link, redundant collection of network metrics from two or more nodes, or a decrease in performance for a particular application.

8. The method as in claim 1 , wherein the traffic pattern anomaly corresponds to a change in at least one of: an average utilization of a path, a number of active applications, a rate of new traffic flows, or a duration of a traffic flow.

9. The method as in claim 1 , wherein the one or more metrics regarding the anomaly are identified based on a mapping between network anomalies and metrics to monitor.

10. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and adapted to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive data regarding a network-monitoring process in which one or more nodes in the network monitor traffic flows flowing through the one or more nodes and export traffic records to one or more collector nodes that include network metrics for the monitored traffic flows;
determine that the gathering of the network metrics and exporting of the traffic records by the network-monitoring process has an adverse effect on the network based on the received data, wherein the adverse effect comprises user traffic in the network being impacted by the network-monitoring process;
determine a change to the network-monitoring process based on the received data and on the adverse effect;
dynamically adjust the network-monitoring process to implement the determined change;
detect a traffic pattern anomaly in the network;
identify one or more metrics regarding the anomaly to monitor; and
instruct a particular node to export the one or more metrics.

11. The apparatus as in claim 10 , wherein the process when executed is further operable to:
instruct a particular node to stop exporting traffic records.

12. The apparatus as in claim 10 , wherein the process when executed is further operable to:
instruct a particular node to export fewer traffic records.

13. The apparatus as in claim 10 , wherein the process when executed is further operable to:
instruct a particular node to export traffic records less frequently.

14. The apparatus as in claim 10 , wherein the process when executed is further operable to:
instruct a particular node to aggregate metrics prior to exporting the aggregated metrics via exported traffic records.

15. The apparatus as in claim 10 , wherein the process when executed is further operable to:
instruct a particular node to stop collecting network metrics.

16. The apparatus as in claim 10 , wherein the adverse effect corresponds to at least one of: increased traffic along a particular network link, redundant collection of network metrics from two or more nodes, or a decrease in performance for a particular application.

17. The apparatus as in claim 10 , wherein the traffic pattern anomaly corresponds to a change in at least one of: an average utilization of a path, a number of active applications, a rate of new traffic flows, or a duration of a traffic flow.

18. The apparatus as in claim 10 , wherein the one or more metrics regarding the anomaly are identified based on a mapping between network anomalies and metrics to monitor.

19. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:
receive data regarding a network-monitoring process in which one or more nodes in the network monitor traffic flows flowing through the one or more nodes and export traffic records to one or more collector nodes that include network metrics for the monitored traffic flows;
determine that the gathering of the network metrics and exporting of the traffic records by the network-monitoring process has an adverse effect on the network based on the received data, wherein the adverse effect comprises user traffic in the network being impacted by the network-monitoring process;
determine a change to the network-monitoring process based on the received data and on the adverse effect;
dynamically adjust the network-monitoring process to implement the determined change;
detect a traffic pattern anomaly in the network;
identify one or more metrics regarding the anomaly to monitor; and
instruct a particular node to export the one or more metrics.

Assignees

• Cisco Tech Inc

Inventors

• Vasseur Jean-Philippe
• Dasgupta Sukrit

Classifications

• H04L41/149

  for prediction of maintenance · CPC title

• H04L41/147

  for predicting network behaviour · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L41/5009

  Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title