# US 2019/0173736 A1 · Cross-domain assurance > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173736 A1 - Document ID: US20190173736A1 - Status: Published application - Kind: A1 - Application number: 15/831,708 - Filed: 2017-12-05 - Published: 2019-06-06 - Earliest claimed: 2017-12-05 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Kannan Ponnuswamy; Alok Lalit Wadhwa; Furong Ma Gisiger; Robert Bukofser - Web page: https://patentgrep.com/patent/US20190173736A1 ## CPC - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/12: Network monitoring probes - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and computer-readable media for providing network assurance across a network. In some embodiments, network traffic data of a cluster of nodes in a network environment can be gathered based on first network traffic flowing through the nodes using a first group of sensors implemented in the network environment. Network events occurring in the network environment can be identified, e.g. using sensors deployed in an infrastructure of the network environment. Subsequently, the network events can be correlated with the network traffic data to generate correlated network data for the network environment. The correlated network data for the network environment can be used to provide assurance between at least one server in the cluster of nodes and the network infrastructure of the network environment as part of providing assurance across the network environment. ## Claims ### Claim 1 A method comprising: receiving network traffic data of a cluster of nodes in a network environment gathered based on first network traffic flowing through the cluster of nodes using a first group of sensors implemented in the network environment; identifying network events occurring in the network environment; correlating the network events and the network traffic data to generate correlated network data for the network environment; and providing assurance between at least one server included in the cluster of nodes in the network environment and a network infrastructure of the network environment using the correlated network data. ### Claim 2 (depends on 1) The method of claim 1, wherein the correlated network data is used to identify a mismatch between intent of a network administrator of the network infrastructure and a server administrator of the at least one server as part of providing assurance between the at least one server and the network infrastructure. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving server data of the at least one server from at least one sensor implemented on the at least one server; correlating the network events, the network traffic data, and the server data to generate the correlated network data; and providing the assurance between the at least one server and the network infrastructure of the network environment based, at least in part, on the server data using the correlated network data created, at least in part, using the server data. ### Claim 4 (depends on 3) The method of claim 3, further comprising detecting configuration mismatches between the at least one server and one or more switches in the network infrastructure using the correlated network data as part of providing assurance between the at least one server and the network infrastructure. ### Claim 5 (depends on 3) The method of claim 3, further comprising: detecting a buffer overrun in operation of the network environment using the correlated network data; and identifying an application associated with the buffer overrun using the correlated network data as part of providing assurance between the at least one server and the network infrastructure. ### Claim 6 (depends on 5) The method of claim 5, further comprising identifying a specific server of the at least one server associated with the buffer overrun using the correlated network data as part of providing assurance between the at least one server and the network infrastructure. ### Claim 7 (depends on 3) The method of claim 3, further comprising determining if a link aggregation policy implemented between the at least one server and the network infrastructure is configured correctly using the correlated network data as part of providing assurance between the at least one server and the network infrastructure of the network environment using the correlated network data. ### Claim 8 (depends on 7) The method of claim 7, further comprising determining, using the correlated network data, if a configuration of the at least one server to implement the link aggregation policy matches a configuration of the network infrastructure to implement the link aggregation policy as part of determining if the link aggregation policy implemented between the at least one server and the network infrastructure is configured correctly using the correlated network data. ### Claim 9 (depends on 1) The method of claim 1, further comprising detecting mismatches in autonegotiations between the at least one server and the network infrastructure using the correlated network data as part of providing assurance between the at least one server and the network infrastructure. ### Claim 10 (depends on 1) The method of claim 1, wherein the network events and the network traffic data is correlated by joining first data in the network events and second data in the network traffic data, the first data in the network events having shared data with the second data in the network traffic data. ### Claim 11 (depends on 1) The method of claim 1, further comprising determining if a number of data packets received from the at least one server at one or more switches in the network infrastructure matches a number of data packets sent by the at least one server using the correlated network data as part of providing assurance between the at least one server and the network infrastructure. ### Claim 12 (depends on 1) The method of claim 1, further comprising mapping the network events to applications, using application dependency mappings included in the correlated network data, wherein mappings of the network events to applications are used in providing assurance between the at least one server and the network infrastructure of the network environment using the correlated network data. ### Claim 13 (depends on 1) The method of claim 1, further comprising maintaining a timeline of assurance levels between the at least one server and the network infrastructure of the network environment using the correlated network data as part of providing assurance between the at least one server and the network infrastructure of the network environment using the correlated network data. ### Claim 14 (depends on 1) The method of claim 1, further comprising determining if a port is failing at the at least one server using the correlated network data. ### Claim 15 A system comprising: one or more processors; and at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising: receiving network traffic data of a cluster of nodes in a network environment gathered based on first network traffic flowing through the cluster of nodes using a first group of sensors implemented in the network environment; receiving server data of at least one server included in the cluster of nodes in the network environment from at least one sensor implemented on the at least one server; identifying network events occurring in the network environment; correlating the network events, the server data, and the network traffic data to generate correlated network data for the network environment; and providing assurance between the at least one server and a network infrastructure of the network environment using the correlated network data. ### Claim 16 (depends on 15) The system of claim 15, wherein the correlated network data is used to identify a mismatch between intent of a network administrator of the network infrastructure and a server administrator of the at least one server as part of providing assurance between the at least one server and the network infrastructure. ### Claim 17 (depends on 15) The system of claim 15, wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising detecting configuration mismatches between the at least one server and one or more switches in the network infrastructure using the correlated network data as part of providing assurance between the at least one server and the network infrastructure. ### Claim 18 (depends on 15) The system of claim 15, wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising: detecting a buffer overrun in operation of the network environment using the correlated network data; and identifying an application associated with the buffer overrun using the correlated network data as part of providing assurance between the at least one server and the network infrastructure. ### Claim 19 (depends on 15) The system of claim 15, wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising determining if a link aggregation policy implemented between the at least one server and the network infrastructure is configured correctly using the correlated network data as part of providing assurance between the at least one server and the network infrastructure of the network environment using the correlated network data. ### Claim 20 A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations comprising: receiving network traffic data of a first cluster of nodes in a network environment gathered based on first network traffic flowing through the first cluster of nodes using a first group of sensors implemented in the network environment; identifying network events occurring in a network infrastructure of the network environment; correlating the network events and the network traffic data to generate correlated network data for the network environment; and providing assurance between at least one server and a network infrastructure of the network environment using the correlated network data by identifying a mismatch between intent of a network administrator of the network infrastructure and a server administrator of at least one server of the network environment.