Brownout detection
AssigneeCisco Technology, Inc.
InventorsVamsidhar Valluri, Martin Djernaes
Life of this patent
Estimating the term…
Abstract
An apparatus and automatic method for detecting brown-outs in a computer network includes determining normal rates of different types of traffic with respect to defined address prefixes. Thresholds are established based on the normal rates. The rates for the different traffic types are monitored, and when a threshold is exceeded the detected addresses and traffic types are flagged for reporting. In some cases, the inventive system will monitor traffic to finer address granularities to further identify suspect addresses. The system may actively ping suspect sub-prefixes and/or initiate communications with the suspect sub-addresses that is then monitored to determine which sub-prefixes are experiencing abnormal activity.
Claims21
A method for detecting brown-outs in computer networks, the method comprising:
- establishing a baseline indicating a normal traffic pattern with an address prefix;
- establishing a threshold indicative of deviations from the baseline, wherein exceeding the threshold indicates an abnormality in the traffic pattern with the address prefix;
- monitoring the traffic patterns associated with the address prefix;
- comparing the monitored traffic patterns to the threshold, and if the threshold is exceeded;
- flagging that traffic pattern as a suspect abnormality;
- and
- notifying an administrator and/or any consumer process client of this technology of the suspect address prefix and traffic pattern type.
An apparatus for detecting brown-outs in computer networks, the apparatus comprising:
- means for establishing a baseline indicating a normal traffic pattern to and from an address prefix;
- means for establishing a threshold indicative of deviations from the baseline, wherein exceeding the threshold indicates an abnormality in the traffic pattern to the address prefix;
- means for monitoring the traffic patterns associated with the address prefix;
- means for comparing the monitored traffic patterns to the threshold, and if the threshold is exceeded;
- means for flagging that pattern as a suspect abnormality;
- and
- means for notifying an administrator and/or any consumer process client of this technology of the suspect prefix and traffic type.
A network node comprising:
- a processor;
- at least one network interface coupled to another network node;
- and
- a memory storing instructions that are executable by the processor for performing the steps of:
- establishing a baseline indicating a normal traffic pattern with an address prefix;
- establishing a threshold indicative of deviations from the baseline, wherein exceeding the threshold indicates an abnormality in the traffic pattern with the address prefix;
- monitoring the traffic patterns associated with the address prefix;
- comparing the monitored traffic patterns to the threshold, and if the threshold is exceeded;
- flagging that traffic pattern as a suspect abnormality;
- and
- notifying an administrator and/or any consumer process client of this technology of the suspect address prefix and traffic pattern type.
A network node comprising:
- a traffic monitor that accepts and interrogates incoming traffic,
- buckets arranged with respect to address prefixes,
- means for separating that traffic with respect to address prefix,
- means for placing the incoming traffic into the bucket arranged with the corresponding address prefix,
- means for arranging the traffic within each bucket with respect to type, and
- a traffic analysis engine that interrogates the contents of each bucket.
Dependencies are inferred from the claim text.