Method of resolving network address to host names in network flows for network device
OwnerJosh Stephensinventor
Life of this patent
Estimating the term…
Abstract
The present invention provides a system and method for using network flows records exported from network routers to provide information about the traffic entering/exiting the device. Network flow information exported from network devices identify the network devices involved in the flow using their network address. An application displays a user friendly host name of the network device. This method describes the steps necessary to efficiently resolve the network device address to their domain names.
Claims24
A system for resolving network address to host names in network flows for a network device, the system comprising:
- network device configured to produce a flow record;
- a flow record storage configured to receive said flow record from said network device and to store said flow record;
- a data analysis tool configured to access said stored flow record and to identify a numerical network address contained in the stored flow record;
- and
- an address analysis tool comprising a mapping table, said mapping table comprising a plurality of mappings of numerical network addresses to possible text network addresses, wherein each of said mappings associates one of said possible numerical network address with one of said possible text network addresses, wherein the address analysis tool is configured to receive the numerical network address, to identify one of said mappings corresponding to said numerical network address, and to return a text network address associated in said one identified mapping.
A method for resolving network address to host names in network flows for a network device, the method comprising:
- receiving a flow record from the network device;
- storing said flow record from said network device;
- locating a network address contained in the stored flow record;
- accessing a mapping table that uniquely associates stored host names corresponding to stored numerical network address;
- and
- identifying a host name corresponding to said numerical network address.
A system for dynamically resolving network address to host names in network flows for a network device, the system comprising:
- a flow record storage system configured to receive and store a record of the flow;
- a data analysis device configured to:
- access the storage system and to identify a network address in the flow record, and
- modify the flow record to replace the network address with a host name.
A mapping table comprising a plurality of mappings that each uniquely associates a stored host name with a stored numerical network address,
- wherein the mapping table is configured to receive a network address contained in a flow record and to identifying a host name corresponding to said network address, and
- wherein, when the mapping table does not contain an associated mapping for the said numerical network address, the mapping table forwards the network address to a data agent configured to receive the network address, to access a network to identify the host name, and to populate a mapping table with a new mapping of said network address to said host name.
Dependencies are inferred from the claim text.