# US 10,873,513 B2 · Workload identification for network flows in hybrid environments with non-unique IP addresses

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,513 B2
- Document ID: US10873513B2
- Status: Granted
- Kind: B2
- Application number: 15/946,737
- Filed: 2018-04-06
- Published: 2019-08-22
- Granted: 2020-12-22
- Earliest claimed: 2018-02-20
- Assignees: VMware, Inc.
- Applicants: Vmware, Inc.
- Inventors: Rohit Toshniwal; Abhijit Sharma; Gaurav Agarwal; Avinash Nigam; Gyan Sagar Sinha; Somil Bhandari
- Web page: https://patentgrep.com/patent/US10873513B2

## CPC

- H04L 41/122: of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 47/822: {Collecting or measuring resource availability data}
- H04L 47/829: {Topology based}
- H04L 61/256: NAT traversal
- H04L 61/5007: Internet protocol [IP] addresses
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Embodiments described herein generally involve identifying workloads in a networking environment based on a flow record from an observation point. In one embodiment, network data is received from one or more endpoints and used to determine a plurality of administrative domains. Each administrative domain comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique. The network data may be used to generate observation point mapping information that maps each observation point to an administrative domain, lookup tables associated with each of the plurality of administrative domains that map IP addresses to administrative domains, and a workload identification table that maps combinations of IP addresses and administrative domains to workloads. The flow record is received from the observation point and a source and destination workload of the flow record are identified using the observation point mapping information, applicable lookup table, and workload identification table.

## Claims

### Claim 1

A method for identifying workloads in a networking environment based on a flow record from an observation point, the method comprising:
receiving network data from one or more endpoints in the networking environment, wherein the network data comprises topology data and routing data;
determining, based on the network data, a plurality of administrative domains within the networking environment, wherein each of the plurality of administrative domains comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique;
generating, based on the network data, observation point mapping information that maps each observation point within the networking environment to one of the plurality of administrative domains, wherein each observation point within the networking environment comprises an endpoint capable of observing a flow record;
generating, based on the network data, a plurality of lookup tables, wherein each of the plurality of lookup tables is associated with one of the plurality of administrative domains, and wherein each of the plurality of lookup tables maps IP addresses to administrative domains;
generating, based on the network data, a workload identification table that maps combinations of IP addresses and administrative domains to workloads;
receiving the flow record from the observation point, wherein the observation point comprises an endpoint at which the flow record was observed, and wherein the flow record comprises a source IP address, a destination IP address, and an observation point; and
identifying a source workload and a destination workload of the flow record using the observation point mapping information, a lookup table of the plurality of lookup tables, and the workload identification table by:
using the observation point mapping information to determine an administrative domain that is mapped to the observation point;
selecting, using the administrative domain, the lookup table of the plurality of lookup tables, wherein the lookup table is associated with the administrative domain;
using the lookup table to determine a source administrative domain that is mapped to the source IP address and a destination administrative domain that is mapped to the destination IP address;
using the workload identification table to identify a source workload that is mapped to a combination of the source IP address and the source administrative domain; and
using the workload identification table to identify a destination workload that is mapped to a combination of the destination IP address and the destination administrative domain.

### Claim 2 (depends on 1)

The method of claim 1, wherein the flow record comprises a tuple including the source IP address, the destination IP address, a source port, a destination port, and a protocol, and wherein the method further comprises:
generating a second tuple comprising the source IP address, the destination IP address, the source port, the destination port, the protocol, the source administrative domain, and the destination administrative domain.

### Claim 3 (depends on 1)

The method of claim 1, wherein determining, based on the network data, the plurality of administrative domains within the networking environment comprises:
using the network data to divide the networking environment into the plurality of administrative domains such that at least one of the following is achieved:
each given virtual network interface controller (VNIC) within the networking environment is included within an administrative domain that is specific to the given VNIC;
all interfaces of a given layer 3 (L3) subnet within the networking environment are included within an administrative domain specific to the given L3 subnet; or
all subnets within a given virtual private cloud (VPC) within the networking environment are included within an administrative domain specific to the given VPC.

### Claim 4 (depends on 1)

The method of claim 1, wherein the network data further comprises network address translation (NAT) rules, and wherein determining, based on the network data, the plurality of administrative domains within the networking environment comprises:
using the NAT rules to determine direction of isolation information for a plurality of interfaces within the networking environment; and
determining administrative domain boundaries based on the direction of isolation information.

### Claim 5 (depends on 4)

The method of claim 4, wherein determining the administrative domain boundaries based on the direction of isolation information comprises:
using the network data to model a topology of the network as a graph such that each node of the graph corresponds to an interface of the plurality of interfaces and each edge of the graph corresponds to a network link between interfaces of the plurality of interfaces;
setting a direction property for each of a plurality of edges of the graph based on the direction of isolation information;
excluding edges from the graph that have a direction property set;
running a breadth first search (BFS) of the graph to identify isolated sections of the graph; and
for each isolated section of the graph, including each node of the isolated section in an administrative domain specific to the isolated section.

### Claim 6 (depends on 1)

The method of claim 1, wherein generating, based on the network data, the observation point mapping information comprises:
for each administrative domain of the plurality of administrative domains:
for each workload within the administrative domain, creating an entry in the observation point mapping information that maps the administrative domain to each observation point that captures flow records of the workload.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
using the source workload and the destination workload to perform at least one of the following:
segregate the flow record with respect to a plurality of flow records; or
de-duplicate the flow record with respect to the plurality of flow records.

### Claim 8

A system comprising: one or more processors; and a non-transitory computer-readable medium storing instructions that, when executed, cause the one or more processors to perform a method for identifying workloads in a networking environment based on a flow record from an observation point, the method comprising:
receiving network data from one or more endpoints in the networking environment, wherein the network data comprises topology data and routing data;
determining, based on the network data, a plurality of administrative domains within the networking environment, wherein each of the plurality of administrative domains comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique;
generating, based on the network data, observation point mapping information that maps each observation point within the networking environment to one of the plurality of administrative domains, wherein each observation point within the networking environment comprises an endpoint capable of observing a flow record;
generating, based on the network data, a plurality of lookup tables, wherein each of the plurality of lookup tables is associated with one of the plurality of administrative domains, and wherein each of the plurality of lookup tables maps IP addresses to administrative domains;
generating, based on the network data, a workload identification table that maps combinations of IP addresses and administrative domains to workloads;
receiving the flow record from the observation point, wherein the observation point comprises an endpoint at which the flow record was observed, and wherein the flow record comprises a source IP address, a destination IP address, and an observation point; and
identifying a source workload and a destination workload of the flow record using the observation point mapping information, a lookup table of the plurality of lookup tables, and the workload identification table by:
using the observation point mapping information to determine an administrative domain that is mapped to the observation point;
selecting, using the administrative domain, the lookup table of the plurality of lookup tables, wherein the lookup table is associated with the administrative domain;
using the lookup table to determine a source administrative domain that is mapped to the source IP address and a destination administrative domain that is mapped to the destination IP address;
using the workload identification table to identify a source workload that is mapped to a combination of the source IP address and the source administrative domain; and
using the workload identification table to identify a destination workload that is mapped to a combination of the destination IP address and the destination administrative domain.

### Claim 9 (depends on 8)

The system of claim 8, wherein the flow record comprises a tuple including the source IP address, the destination IP address, a source port, a destination port, and a protocol, and wherein the method further comprises:
generating a second tuple comprising the source IP address, the destination IP address, the source port, the destination port, the protocol, the source administrative domain, and the destination administrative domain.

### Claim 10 (depends on 8)

The system of claim 8, wherein determining, based on the network data, the plurality of administrative domains within the networking environment comprises:
using the network data to divide the networking environment into the plurality of administrative domains such that at least one of the following is achieved:
each given virtual network interface controller (VNIC) within the networking environment is included within an administrative domain that is specific to the given VNIC;
all interfaces of a given layer 3 (L3) subnet within the networking environment are included within an administrative domain specific to the given L3 subnet; and/or
all subnets within a given virtual private cloud (VPC) within the networking environment are included within an administrative domain specific to the given VPC.

### Claim 11 (depends on 8)

The system of claim 8, wherein the network data further comprises network address translation (NAT) rules, and wherein determining, based on the network data, the plurality of administrative domains within the networking environment comprises:
using the NAT rules to determine direction of isolation information for a plurality of interfaces within the networking environment; and
determining administrative domain boundaries based on the direction of isolation information.

### Claim 12 (depends on 11)

The system of claim 11, wherein determining the administrative domain boundaries based on the direction of isolation information comprises:
using the network data to model a topology of the network as a graph such that each node of the graph corresponds to an interface of the plurality of interfaces and each edge of the graph corresponds to a network link between interfaces of the plurality of interfaces;
setting a direction property for each of a plurality of edges of the graph based on the direction of isolation information;
excluding edges from the graph that have a direction property set;
running a breadth first search (BFS) of the graph to identify isolated sections of the graph; and
for each isolated section of the graph, including each node of the isolated section in an administrative domain specific to the isolated section.

### Claim 13 (depends on 8)

The system of claim 8, wherein generating, based on the network data, the observation point mapping information comprises:
for each administrative domain of the plurality of administrative domains:
for each workload within the administrative domain, creating an entry in the observation point mapping information that maps the administrative domain to each observation point that captures flow records of the workload.

### Claim 14 (depends on 8)

The system of claim 8, wherein the method further comprises:
using the source workload and the destination workload to perform at least one of the following operations:
segregate the flow record with respect to a plurality of flow records; or
de-duplicate the flow record with respect to the plurality of flow records.

### Claim 15

A non-transitory computer-readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for identifying workloads in a networking environment based on a flow record from an observation point, the method comprising:
receiving network data from one or more endpoints in the networking environment, wherein the network data comprises topology data and routing data;
determining, based on the network data, a plurality of administrative domains within the networking environment, wherein each of the plurality of administrative domains comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique;
generating, based on the network data, observation point mapping information that maps each observation point within the networking environment to one of the plurality of administrative domains;
generating, based on the network data, a plurality of lookup tables, wherein each of the plurality of lookup tables is associated with one of the plurality of administrative domains, and wherein each of the plurality of lookup tables maps IP addresses to administrative domains;
generating, based on the network data, a workload identification table that maps combinations of IP addresses and administrative domains to workloads, wherein each observation point within the networking environment comprises an endpoint capable of observing a flow record;
receiving the flow record from the observation point, wherein the observation point comprises an endpoint at which the flow record was observed, and wherein the flow record comprises a source IP address, a destination IP address, and an observation point; and
identifying a source workload and a destination workload of the flow record using the observation point mapping information, a lookup table of the plurality of lookup tables, and the workload identification table by:
using the observation point mapping information to determine an administrative domain that is mapped to the observation point;
selecting, using the administrative domain, the lookup table of the plurality of lookup tables, wherein the lookup table is associated with the administrative domain;
using the lookup table to determine a source administrative domain that is mapped to the source IP address and a destination administrative domain that is mapped to the destination IP address;
using the workload identification table to identify a source workload that is mapped to a combination of the source IP address and the source administrative domain; and
using the workload identification table to identify a destination workload that is mapped to a combination of the destination IP address and the destination administrative domain.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the flow record comprises a tuple including the source IP address, the destination IP address, a source port, a destination port, and a protocol, and wherein the method further comprises:
generating a second tuple comprising the source IP address, the destination IP address, the source port, the destination port, the protocol, the source administrative domain, and the destination administrative domain.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein determining, based on the network data, the plurality of administrative domains within the networking environment comprises:
using the network data to divide the networking environment into the plurality of administrative domains such that at least one of the following is achieved:
each given virtual network interface controller (VNIC) within the networking environment is included within an administrative domain that is specific to the given VNIC;
all interfaces of a given layer 3 (L3) subnet within the networking environment are included within an administrative domain specific to the given L3 subnet; or
all subnets within a given virtual private cloud (VPC) within the networking environment are included within an administrative domain specific to the given VPC.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the network data further comprises network address translation (NAT) rules, and wherein determining, based on the network data, the plurality of administrative domains within the networking environment comprises:
using the NAT rules to determine direction of isolation information for a plurality of interfaces within the networking environment; and
determining administrative domain boundaries based on the direction of isolation information.

### Claim 19 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein determining the administrative domain boundaries based on the direction of isolation information comprises:
using the network data to model a topology of the network as a graph such that each node of the graph corresponds to an interface of the plurality of interfaces and each edge of the graph corresponds to a network link between interfaces of the plurality of interfaces;
setting a direction property for each of a plurality of edges of the graph based on the direction of isolation information;
excluding edges from the graph that have a direction property set;
running a breadth first search (BFS) of the graph to identify isolated sections of the graph; and
for each isolated section of the graph, including each node of the isolated section in an administrative domain specific to the isolated section.

### Claim 20 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein generating, based on the network data, the observation point mapping information comprises:
for each administrative domain of the plurality of administrative domains:
for each workload within the administrative domain, creating an entry in the observation point mapping information that maps the administrative domain to each observation point that captures flow records of the workload.

### Claim 21 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the method further comprises:
using the source workload and the destination workload to perform at least one of the following operations:
segregate the flow record with respect to a plurality of flow records; or
de-duplicate the flow record with respect to the plurality of flow records.