Method and System for Annotating Network Flow Information

Abstract

A scalable flow monitoring solution takes in standard flow records exported from network devices such as routers, switches, firewalls, hubs, etc., and annotates the flow with additional information. This information is derived from a number of sources, including Border Gateway Protocol (BGP), Simple Network Management Protocol (SNMP), user configuration, and other, intelligent flow analysis. These annotations add information to the flow data, and can be used to perform value-added flow analysis. The annotated flow is then resent to a configurable set of destinations using standard flow formatting, e.g., Cisco System Inc.'s NetFlow, in one implementation. This allows the annotated flow to be processed and the enhanced information to be used by other flow analysis tools and existing flow analysis infrastructure.

Description

BACKGROUND OF THE INVENTION[0001]Host computers, including servers and client computers, are typically interconnected to form computer networks. A computer network, and more generally a communications network, is a group of devices or network entities that are interconnected by one or more segments of transmission media on which communications are exchanged between those network entities. The communications can be transmitted electrically, including wireless links, or optically. The computer networks typically further comprise separate network communications devices, such as routers, switches, bridges, and hubs, for transmitting and relaying the communications between the network entities through the network's mesh.[0002]Computer networks are typically classified by their size or by the type of entity that owns the network. Often, business organizations maintain large computer networks. These computer networks are referred to as enterprise networks. Enterprise networks are typically...

AI Technical Summary

Benefits of technology

The present invention is a method and device for processing network flow information by annotating the flow with additional information. This additional information can be derived from various sources such as Border Gateway Protocol (BGP) and Simple Network Management Protocol (SNMP). The annotated flow can then be sent to a configurable set of destinations using standard flow formatting. The invention provides real-time flow monitoring with scalability and intelligence, and allows for value-added flow analysis. It also allows for the reuse of existing flow monitoring infrastructure and reduces delays between data collection and analysis. The invention features a method for annotating flow records with information derived from BGP, SNMP, user configuration, and raw packet analysis. The annotated flow can be sent to a configurable set of destinations using standard flow formatting. Overall, the invention provides a solution for processing network flow information with additional information in real-time and improving the efficiency and accuracy of flow monitoring.

Problems solved by technology

The standard flow information that is available from network devices is limited, however.

These solutions do not provide real-time flow information, nor is their information made available using existing flow export methods.

Thus, these solutions are not nearly as scalable, and are much more restricted in the type of data they can provide.

It also means that accessing the data they provide requires writing custom software, rather than being able to reuse existing flow collection and analysis infrastructure.

Images