# US 10,873,593 B2 · Mechanism for identifying differences between network snapshots > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,593 B2 - Document ID: US10873593B2 - Status: Granted - Kind: B2 - Application number: 15/992,071 - Filed: 2018-05-29 - Published: 2019-07-25 - Granted: 2020-12-22 - Earliest claimed: 2018-01-25 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Shashi Gandham; Navindra Yadav; Janardhanan Radhakrishnan; Hoang-Nam Nguyen; Umesh Paul Mahindra; Sunil Gupta; Praneeth Vallem; Supreeth Rao; Darshan Shrinath Purandare; Xuan Zou; Joseph Daniel Beshay; Jothi Prakash Prabakaran - Web page: https://patentgrep.com/patent/US10873593B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 41/0886: {Fully automatic configuration} - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/028: by filtering - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1458: {Denial of Service} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed is a system configured to receive a set of network snapshot segments from an output stream of a stream processing service, compile the set of network snapshot segments from the set of messages into a first network snapshot and a second network snapshot, and compare the first network snapshot and the second network snapshot to identify a difference between the first network snapshot and the second network snapshot. ## Claims ### Claim 1 A computer-implemented method comprising: receiving a set of messages associated with an output stream of a stream processing service, wherein each message in the set of messages includes a network snapshot segment; determining, from the set of messages, a message of the set of messages includes an end tag; based on the end tag, determining that the set of messages includes the network snapshot segments for a first network snapshot and a second network snapshot; in response to determining the set of messages includes the network snapshot segments for a first network snapshot and a second network snapshot, compiling the network snapshot segments from the set of messages into the first network snapshot and the second network snapshot; identifying a difference between the first network snapshot and the second network snapshot; and providing the difference to a consumer system. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the first network snapshot corresponds to a state of a network during a first time period and the second network snapshot corresponds to the state of the network during a second time period. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein the state of the network comprises network policies for the network. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the difference between the first network snapshot and the second network snapshot indicates a change in a state of a network. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, from the consumer system, filtering criteria for the first network snapshot and the second network snapshot; and filtering the difference between the first network snapshot and the second network snapshot based on the filtering criteria. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, from the consumer system, filtering criteria for the first network snapshot and the second network snapshot; and filtering the first network snapshot and the second network snapshot based on the filtering criteria. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein the filtering criteria comprises a list of IP addresses associated with the consumer system. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving a first message associated with the output stream, wherein the first message includes a first network snapshot segment and an offset for the first network snapshot segment; determining, based on the offset, that at least one additional network snapshot segment associated with the output stream has not been previously received; and transmit, to the stream processing service, a request for the at least one additional network snapshot segment. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the request the at least one additional network snapshot segment is for an out-of-stream message outside a sequence of messages associated with the output stream, wherein the out-of-stream message includes the at least one additional network snapshot segment. ### Claim 10 A non-transitory computer-readable medium having computer readable instructions that, upon being executed by a processor, cause the processor to: receive a set of network snapshot segments from an output stream of a stream processing service; determine, from the set of messages, a message of the set of messages includes an end tag; based on the end tag, determine that the set of messages includes the network snapshot segments for a first network snapshot and a second network snapshot; in response to the determination that the set of messages includes the network snapshot segments for a first network snapshot and a second network snapshot, compile the set of network snapshot segments from the output stream into the first network snapshot and the second network snapshot; and compare the first network snapshot and the second network snapshot to identify a difference between the first network snapshot and the second network snapshot. ### Claim 11 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the instructions, upon being executed by the processor, further cause the processor to provide the difference to a consumer system. ### Claim 12 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein each network snapshot segment in the set of network snapshot segments is associated with an offset, and wherein the first network snapshot and the second network snapshot is compiled based on the offsets for each network snapshot segment in the set of network snapshot segments. ### Claim 13 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the first network snapshot corresponds to a state of a network during a first time period and the second network snapshot corresponds to the state of the network during a second time period. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the state of the network comprises network policies for the network. ### Claim 15 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the instructions further cause the processor to: receive, from a consumer system, filtering criteria for the first network snapshot and the second network snapshot; and filter the first network snapshot and the second network snapshot based on the filtering criteria. ### Claim 16 A system comprising: a processor; and memory including instructions that, upon being executed by the processor, cause the system to: receive, from a consumer system, filtering criteria for network information generated by a network traffic monitoring system; receive a set of messages associated with an output stream of a stream processing service, wherein each message in the set of messages includes a network snapshot segment; determine, from the set of messages, a message of the set of messages includes an end tag; based on the end tag, determine that the set of messages includes the network snapshot segments for a first network snapshot and a second network snapshot; in response to the determination that the set of messages includes the network snapshot segments for a first network snapshot and a second network snapshot, compile the network snapshot segments from the set of messages into the first network snapshot and the second network snapshot; identify a difference between the first network snapshot and the second network snapshot, wherein the difference complies with the filtering criteria; and provide the difference to an end usera consumer system. ### Claim 17 (depends on 16) The system of claim 16, comprising further instructions, which when executed causes the system to: receive, from the consumer system, filtering criteria for network information generated by a network traffic monitoring system, wherein the filtering criteria is a list of IP addresses associated from the consumer system. ### Claim 18 (depends on 16) The system of claim 16, wherein the first network snapshot corresponds to a state of a network during a first time period and the second network snapshot corresponds to the state of the network during a second time period. ### Claim 19 (depends on 18) The system of claim 18, wherein the state of the network comprises network policies for the network. ### Claim 20 (depends on 16) The system of claim 16, wherein the difference between the first network snapshot and the second network snapshot indicates a change in a state of a network.