System and method of flow source discovery

A method comprising:

• receiving a period of time for flow source discovery of an enterprise network;
• receiving a plurality of flow packets from network traffic analyzing platforms, the network traffic analyzing platforms being in communication with the enterprise network, the plurality of flow packets indicating network traffic into and out of flow sources of the enterprise network, at least one flow source of the flow sources of the enterprise network being a router of switch fabric integrated within the enterprise network;
• for each particular flow packet of the plurality of flow packets:
• identify the particular flow packet of the plurality of flow packets as belonging to one of at least two flow packet types based at least in part on a format of the particular flow packet;
• if the particular flow packet is an sFlow flow packet, determine if the particular flow packet is an sFlow sample, an sFlow counter record, or a third sFlow packet type;
• if the particular flow packet is the sFlow sample or the sFlow counter record, identify a flow source of the particular flow packet and at least one metric of the network traffic data, the flow source being one of a plurality of flow sources of the enterprise network, and update a flow source data structure to include the identified flow source and the at least one metric of the network traffic data;
• if the particular flow packet is the third sFlow packet type, ignore the particular flow packet;
• and
• if the particular flow packet is a second flow packet type, the second flow packet type being different from an sFlow flow packet type:
• if the particular flow packet is of a format that matches one of a plurality of template records stored in a template datastore, identify the flow source associated with the particular flow packet and the at least one metric of the network traffic data, and update the flow source data structure to include the identified flow source and the at least one metric of the network traffic data;
• and
• if the format of the particular flow packet does not match one of the plurality of template records, ignore the flow particular packet;
• and
• after termination of the period of time, output the flow source data structure, the flow source data structure combining information from the sFlow flow packets and information from the flow packets of the second flow packet type, the flow source data structure indicating a plurality of flow sources including the identified flow sources as well as a plurality of attributes of the network traffic data based on the at least one metric of the network traffic data of the plurality of flow packets, the flow source data structure enabling an operator of the enterprise network to control and monitor network traffic of the enterprise network.

A computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code executable by a computing system to cause the computing system to perform:

• receiving a period of time for flow source discovery of an enterprise network;
• receiving a plurality of flow packets from network traffic analyzing platforms, the network traffic analyzing platforms being in communication with the enterprise network, the plurality of flow packets indicating network traffic into and out of flow sources of the enterprise network, at least one flow source of the flow sources of the enterprise network being a router of switch fabric integrated within the enterprise network;
• for each particular flow packet of the plurality of flow packets:
• identify the particular flow packet of the plurality of flow packets as belonging to one of at least two flow packet types based at least in part on a format of the particular flow packet;
• if the particular flow packet is an sFlow flow packet, determine if the particular flow packet is an sFlow sample, an sFlow counter record, or a third sFlow packet type;
• if the particular flow packet is the sFlow sample or the sFlow counter record, identify a flow source of the particular flow packet and at least one metric of the network traffic data, the flow source being one of a plurality of flow sources of the enterprise network, and update a flow source data structure to include the identified flow source and the at least one metric of the network traffic data;
• if the particular flow packet is the third sFlow packet type, ignore the particular flow packet;
• and
• if the particular flow packet is a second flow packet type, the second flow packet type being different from an sFlow flow packet type:
• if the particular flow packet is of a format that matches one of a plurality of template records stored in a template datastore, identify the flow source associated with the particular flow packet and the at least one metric of the network traffic data, and update the flow source data structure to include the identified flow source and the at least one metric of the network traffic data;
• and
• if the format of the particular flow packet does not match one of the plurality of template records, ignore the flow particular packet;
• and
• after termination of the period of time, output the flow source data structure, the flow source data structure combining information from the sFlow flow packets and information from the flow packets of the second flow packet type, the flow source data structure indicating a plurality of flow sources including the identified flow sources as well as a plurality of attributes of the network traffic data based on the at least one metric of the network traffic data of the plurality of flow packets, the flow source data structure enabling an operator of the enterprise network to control and monitor network traffic of the enterprise network.