# US 10,768,970 B2 · System and method of flow source discovery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,768,970 B2 - Document ID: US10768970B2 - Status: Granted - Kind: B2 - Application number: 16/234,402 - Filed: 2018-12-27 - Published: 2019-07-04 - Granted: 2020-09-08 - Earliest claimed: 2017-12-29 - Assignees: Virtual Instruments Corporation - Applicants: Virtual Instruments Corporation - Inventors: Nicholas York; Rosanna Lee; Vishal Neema; Xiaohong Pan - Web page: https://patentgrep.com/patent/US10768970B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5027: {the resource being a machine, e.g. CPUs, Servers, Terminals} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - H04L 41/0233: Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA] - H04L 41/06: Management of faults, events, alarms or notifications - H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies} - H04L 41/0681: Configuration of triggering conditions - H04L 41/0686: Additional information in the notification, e.g. enhancement of specific meta-data - H04L 41/0896: Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities (flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76) - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/026: using flow identification - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 43/103: with adaptive polling, i.e. dynamically adapting the polling rate - H04L 43/12: Network monitoring probes - H04L 43/16: Threshold monitoring - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2483: involving identification of individual flows - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F 2209/508: Monitor - H04L 43/091: Measuring contribution of individual network components to actual service level - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An example method comprises receiving flow packets from network traffic analyzing platforms, for each particular flow packet: identify the particular flow packet as belonging to one of at least two flow packet types based on a format, if the particular flow packet is sFlow, determine if the particular flow packet is an sFlow sample, counter record, or a third packet type, if the particular flow packet is the sFlow sample or counter record, identify a flow source of the particular flow packet and at least one metric, and update a flow source data structure else ignore the particular flow packet, and if the particular flow packet is a second flow packet type: if the particular flow packet is of a format that matches a template, identify the flow source, and update the flow source data structure to include the identified flow source and the at least one metric. ## Claims ### Claim 1 A system comprising: one or more processors; memory containing instructions configured to control the one or more processors to: receive a period of time for flow source discovery of an enterprise network; receive a plurality of flow packets from network traffic analyzing platforms, the network traffic analyzing platforms being in communication with the enterprise network, the plurality of flow packets indicating network traffic into and out of flow sources of the enterprise network, at least one flow source of the flow sources of the enterprise network being a router of switch fabric integrated within the enterprise network; for each particular flow packet of the plurality of flow packets: identify the particular flow packet of the plurality of flow packets as belonging to one of at least two flow packet types based at least in part on a format of the particular flow packet; if the particular flow packet is an sFlow flow packet, determine if the particular flow packet is an sFlow sample, an sFlow counter record, or a third sFlow packet type; if the particular flow packet is the sFlow sample or the sFlow counter record, identify a flow source of the particular flow packet and at least one metric of the network traffic data, the flow source being one of a plurality of flow sources of the enterprise network, and update a flow source data structure to include the identified flow source and the at least one metric of the network traffic data; if the particular flow packet is the third sFlow packet type, ignore the particular flow packet; and if the particular flow packet is a second flow packet type, the second flow packet type being different from an sFlow flow packet type: if the particular flow packet is of a format that matches one of a plurality of template records stored in a template datastore, identify the flow source associated with the particular flow packet and the at least one metric of the network traffic data, and update the flow source data structure to include the identified flow source and the at least one metric of the network traffic data; and if the format of the particular flow packet does not match one of the plurality of template records, ignore the flow particular packet; and after termination of the period of time, output the flow source data structure, the flow source data structure combining information from the sFlow flow packets and information from the flow packets of the second flow packet type, the flow source data structure indicating a plurality of flow sources including the identified flow sources as well as a plurality of attributes of the network traffic data based on the at least one metric of the network traffic data of the plurality of flow packets, the flow source data structure enabling an operator of the enterprise network to control and monitor network traffic of the enterprise network. ### Claim 2 (depends on 1) The system of claim 1 further comprising: wherein the metrics of the network traffic data including at least one of a source entity of the enterprise network, a destination entity of the enterprise network, the source entity being one of a plurality of entities of the enterprise network and the destination entity of the enterprise being one of the plurality of entities of the enterprise network. ### Claim 3 (depends on 1) The system of claim 1 further comprising, wherein the metrics of the network traffic data including at least one of a type of flow source, read speed total byte count, incoming byte count, outgoing byte count, incoming bit rate, outgoing bit rate, and total packet rate. ### Claim 4 (depends on 2) The system of claim 2 the memory containing instructions further configured to control the one or more processors to: identifying a first flow packet of one of at least two packet types, the first flow packet indicating a first flow source, a first value of a first metric of the network traffic data and a first value of a second metric of the network traffic data; identifying a second flow packet of one of at least two packet types, the second flow packet indicating a second flow source, the first value of the first metric of the network traffic data, and the first value of the second metric of the network traffic data; and determining that the first flow packet and the second flow packet represent duplicate network traffic. ### Claim 5 (depends on 4) The system of claim 4 further comprising, wherein the first flow packet and the second flow packet are of different packet types. ### Claim 6 (depends on 4) The system of claim 4 further comprising, wherein the first flow packet and the second flow packet are of the same packet type. ### Claim 7 (depends on 1) The system of claim 1 further comprising, wherein the flow source data structure is a table. ### Claim 8 (depends on 1) The system of claim 1 further comprising, wherein the flow source data structure is a chart. ### Claim 9 (depends on 1) The system of claim 1 further comprising wherein the second flow packet type is a Netflow packet. ### Claim 10 (depends on 1) The system of claim 1 further comprising: wherein the second flow packet type is a Jflow packet. ### Claim 11 (depends on 1) The system of claim 1 further comprising: wherein the period of time is 7 days. ### Claim 12 A method comprising: receiving a period of time for flow source discovery of an enterprise network; receiving a plurality of flow packets from network traffic analyzing platforms, the network traffic analyzing platforms being in communication with the enterprise network, the plurality of flow packets indicating network traffic into and out of flow sources of the enterprise network, at least one flow source of the flow sources of the enterprise network being a router of switch fabric integrated within the enterprise network; for each particular flow packet of the plurality of flow packets: identify the particular flow packet of the plurality of flow packets as belonging to one of at least two flow packet types based at least in part on a format of the particular flow packet; if the particular flow packet is an sFlow flow packet, determine if the particular flow packet is an sFlow sample, an sFlow counter record, or a third sFlow packet type; if the particular flow packet is the sFlow sample or the sFlow counter record, identify a flow source of the particular flow packet and at least one metric of the network traffic data, the flow source being one of a plurality of flow sources of the enterprise network, and update a flow source data structure to include the identified flow source and the at least one metric of the network traffic data; if the particular flow packet is the third sFlow packet type, ignore the particular flow packet; and if the particular flow packet is a second flow packet type, the second flow packet type being different from an sFlow flow packet type: if the particular flow packet is of a format that matches one of a plurality of template records stored in a template datastore, identify the flow source associated with the particular flow packet and the at least one metric of the network traffic data, and update the flow source data structure to include the identified flow source and the at least one metric of the network traffic data; and if the format of the particular flow packet does not match one of the plurality of template records, ignore the flow particular packet; and after termination of the period of time, output the flow source data structure, the flow source data structure combining information from the sFlow flow packets and information from the flow packets of the second flow packet type, the flow source data structure indicating a plurality of flow sources including the identified flow sources as well as a plurality of attributes of the network traffic data based on the at least one metric of the network traffic data of the plurality of flow packets, the flow source data structure enabling an operator of the enterprise network to control and monitor network traffic of the enterprise network. ### Claim 13 (depends on 12) The method of claim 12 further comprising wherein the metrics of the network traffic data including at least one of a source entity of the enterprise network, a destination entity of the enterprise network, the source entity being one of a plurality of entities of the enterprise network and the destination entity of the enterprise being one of the plurality of entities of the enterprise network. ### Claim 14 (depends on 12) The method of claim 12 further comprising, wherein the metrics of the network traffic data including at least one of a type of flow source, read speed total byte count, incoming byte count, outgoing byte count, incoming bit rate, outgoing bit rate, and total packet rate. ### Claim 15 (depends on 13) The method of claim 13 the memory containing instructions further configured to control the one or more processors to: identifying a first flow packet of one of at least two packet types, the first flow packet indicating a first flow source, a first value of a first metric of the network traffic data and a first value of a second metric of the network traffic data; identifying a second flow packet of one of at least two packet types, the second flow packet indicating a second flow source, the first value of the first metric of the network traffic data, and the first value of the second metric of the network traffic data; and determining that the first flow packet and the second flow packet represent duplicate network traffic. ### Claim 16 (depends on 15) The method of claim 15 further comprising, wherein the first flow packet and the second flow packet are of different packet types. ### Claim 17 (depends on 15) The method of claim 15 further comprising, wherein the first flow packet and the second flow packet are of the same packet type. ### Claim 18 (depends on 12) The method of claim 12 further comprising wherein the second flow packet type is a Netflow packet. ### Claim 19 (depends on 12) The method of claim 12 further comprising wherein the second flow packet type is a Jflow packet. ### Claim 20 A computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code executable by a computing system to cause the computing system to perform: receiving a period of time for flow source discovery of an enterprise network; receiving a plurality of flow packets from network traffic analyzing platforms, the network traffic analyzing platforms being in communication with the enterprise network, the plurality of flow packets indicating network traffic into and out of flow sources of the enterprise network, at least one flow source of the flow sources of the enterprise network being a router of switch fabric integrated within the enterprise network; for each particular flow packet of the plurality of flow packets: identify the particular flow packet of the plurality of flow packets as belonging to one of at least two flow packet types based at least in part on a format of the particular flow packet; if the particular flow packet is an sFlow flow packet, determine if the particular flow packet is an sFlow sample, an sFlow counter record, or a third sFlow packet type; if the particular flow packet is the sFlow sample or the sFlow counter record, identify a flow source of the particular flow packet and at least one metric of the network traffic data, the flow source being one of a plurality of flow sources of the enterprise network, and update a flow source data structure to include the identified flow source and the at least one metric of the network traffic data; if the particular flow packet is the third sFlow packet type, ignore the particular flow packet; and if the particular flow packet is a second flow packet type, the second flow packet type being different from an sFlow flow packet type: if the particular flow packet is of a format that matches one of a plurality of template records stored in a template datastore, identify the flow source associated with the particular flow packet and the at least one metric of the network traffic data, and update the flow source data structure to include the identified flow source and the at least one metric of the network traffic data; and if the format of the particular flow packet does not match one of the plurality of template records, ignore the flow particular packet; and after termination of the period of time, output the flow source data structure, the flow source data structure combining information from the sFlow flow packets and information from the flow packets of the second flow packet type, the flow source data structure indicating a plurality of flow sources including the identified flow sources as well as a plurality of attributes of the network traffic data based on the at least one metric of the network traffic data of the plurality of flow packets, the flow source data structure enabling an operator of the enterprise network to control and monitor network traffic of the enterprise network.