Workload identification for network flows in hybrid environments with non-unique IP addresses

A system comprising:

• one or more processors;
• and a non-transitory computer-readable medium storing instructions that, when executed, cause the one or more processors to perform a method for identifying workloads in a networking environment based on a flow record from an observation point, the method comprising:
• receiving network data from one or more endpoints in the networking environment, wherein the network data comprises topology data and routing data;
• determining, based on the network data, a plurality of administrative domains within the networking environment, wherein each of the plurality of administrative domains comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique;
• generating, based on the network data, observation point mapping information that maps each observation point within the networking environment to one of the plurality of administrative domains, wherein each observation point within the networking environment comprises an endpoint capable of observing a flow record;
• generating, based on the network data, a plurality of lookup tables, wherein each of the plurality of lookup tables is associated with one of the plurality of administrative domains, and wherein each of the plurality of lookup tables maps IP addresses to administrative domains;
• generating, based on the network data, a workload identification table that maps combinations of IP addresses and administrative domains to workloads;
• receiving the flow record from the observation point, wherein the observation point comprises an endpoint at which the flow record was observed, and wherein the flow record comprises a source IP address, a destination IP address, and an observation point;
• and
• identifying a source workload and a destination workload of the flow record using the observation point mapping information, a lookup table of the plurality of lookup tables, and the workload identification table by:
• using the observation point mapping information to determine an administrative domain that is mapped to the observation point;
• selecting, using the administrative domain, the lookup table of the plurality of lookup tables, wherein the lookup table is associated with the administrative domain;
• using the lookup table to determine a source administrative domain that is mapped to the source IP address and a destination administrative domain that is mapped to the destination IP address;
• using the workload identification table to identify a source workload that is mapped to a combination of the source IP address and the source administrative domain;
• and
• using the workload identification table to identify a destination workload that is mapped to a combination of the destination IP address and the destination administrative domain.

A non-transitory computer-readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for identifying workloads in a networking environment based on a flow record from an observation point, the method comprising:

• receiving network data from one or more endpoints in the networking environment, wherein the network data comprises topology data and routing data;
• determining, based on the network data, a plurality of administrative domains within the networking environment, wherein each of the plurality of administrative domains comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique;
• generating, based on the network data, observation point mapping information that maps each observation point within the networking environment to one of the plurality of administrative domains;
• generating, based on the network data, a plurality of lookup tables, wherein each of the plurality of lookup tables is associated with one of the plurality of administrative domains, and wherein each of the plurality of lookup tables maps IP addresses to administrative domains;
• generating, based on the network data, a workload identification table that maps combinations of IP addresses and administrative domains to workloads, wherein each observation point within the networking environment comprises an endpoint capable of observing a flow record;
• receiving the flow record from the observation point, wherein the observation point comprises an endpoint at which the flow record was observed, and wherein the flow record comprises a source IP address, a destination IP address, and an observation point;
• and
• identifying a source workload and a destination workload of the flow record using the observation point mapping information, a lookup table of the plurality of lookup tables, and the workload identification table by:
• using the observation point mapping information to determine an administrative domain that is mapped to the observation point;
• selecting, using the administrative domain, the lookup table of the plurality of lookup tables, wherein the lookup table is associated with the administrative domain;
• using the lookup table to determine a source administrative domain that is mapped to the source IP address and a destination administrative domain that is mapped to the destination IP address;
• using the workload identification table to identify a source workload that is mapped to a combination of the source IP address and the source administrative domain;
• and
• using the workload identification table to identify a destination workload that is mapped to a combination of the destination IP address and the destination administrative domain.