Aggregating flows by endpoint category

A router comprising:

• a memory storage comprising instructions;
• and
• one or more processors in communication with the memory storage, wherein the one or more processors execute the instructions to perform:
• accessing a first data packet that indicates a first source identifier that identifies a first source endpoint and a first destination identifier that identifies a first destination endpoint;
• determining a first source category based on the first source identifier;
• determining a first destination category based on the first destination identifier;
• accessing a second data packet that indicates a second source identifier that identifies a second source endpoint and a second destination identifier that identifies a second destination endpoint, the second source identifier being different from the first source identifier;
• determining a second source category based on the second source identifier, the second source category being the same as the first source category;
• determining a second destination category based on the second destination identifier, the second destination category being the same as the first destination category;
• determining that the first data packet and the second data packet are part of a single category flow based on the determination that the second source category is the same as the first source category and the determination that the second destination category is the same as the first destination category;
• generating, based on the single category flow, an Internet protocol flow information export (IPFIX) message;
• and
• transmitting the generated IPFIX message over a network.

A non-transitory computer-readable medium storing computer instructions for preventing communications based on endpoint category, that when executed by one or more processors of a router, cause the one or more processors to perform steps of:

• accessing a first data packet that indicates a first source identifier that identifies a first source endpoint and a first destination identifier that identifies a first destination endpoint;
• determining a first source category based on the first source identifier;
• determining a first destination category based on the first destination identifier;
• accessing a second data packet that indicates a second source identifier that identifies a second source endpoint and a second destination identifier that identifies a second destination endpoint, the second source identifier being different from the first source identifier;
• determining a second source category based on the second source identifier, the second source category being the same as the first source category;
• determining a second destination category based on the second destination identifier, the second destination category being the same as the first destination category;
• and
• determining that the first data packet and the second data packet are part of a single category flow based on the determination that the second source category is the same as the first source category and the determination that the second destination category is the same as the first destination category;
• generating, based on the single category flow, an Internet protocol flow information export (IPFIX) message;
• and
• transmitting the generated IPFIX message over a network.