Workload identification for ip addresses in network traffic flow

A system for identifying workloads in a networking environment based on a flow record from an observation point, the system comprising:

• at least one processor;
• and
• at least one memory, the at least one processor and the at least one memory configured to cause the system to:
• receive network data from one or more endpoints in the networking environment, wherein the network data comprises topology data and routing data;
• determine, based on the network data, a plurality of administrative domains within the networking environment, wherein each of the plurality of administrative domains comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique;
• generate, based on the network data, observation point mapping information that maps each observation point within the networking environment to one of the plurality of administrative domains;
• generate, based on the network data, a plurality of lookup tables, wherein each of the plurality of lookup tables is associated with one of the plurality of administrative domains, wherein each of the plurality of lookup tables maps IP subnets to administrative domains, wherein a first lookup table of the plurality of lookup tables is associated with a first administrative domain of the plurality of administrative domains, wherein the first administrative domain corresponds to an L2 network that is disconnected from any router in the networking environment;
• generate, based on the network data, a workload identification table that maps combinations of IP addresses and administrative domains to workloads;
• receive the flow record from the observation point;
• and
• identify a source workload and a destination workload of the flow record using the observation point mapping information, the first lookup table, and the workload identification table.

A non-transitory computer-readable medium for identifying workloads in a networking environment based on a flow record from an observation point, comprising instructions that, when executed by at least one processor of a computing system, cause the computing system to perform operations for virtual computing instance remediation, the operations comprising:

• receiving network data from one or more endpoints in the networking environment, wherein the network data comprises topology data and routing data;
• determining, based on the network data, a plurality of administrative domains within the networking environment, wherein each of the plurality of administrative domains comprises a distinct section of the networking environment within which every Internet Protocol (IP) address is unique;
• generating, based on the network data, observation point mapping information that maps each observation point within the networking environment to one of the plurality of administrative domains;
• generating, based on the network data, a plurality of lookup tables, wherein each of the plurality of lookup tables is associated with one of the plurality of administrative domains, wherein each of the plurality of lookup tables maps IP subnets to administrative domains, wherein a first lookup table of the plurality of lookup tables is associated with a first administrative domain of the plurality of administrative domains, wherein the first administrative domain corresponds to an L2 network that is disconnected from any router in the networking environment;
• generating, based on the network data, a workload identification table that maps combinations of IP addresses and administrative domains to workloads;
• receiving the flow record from the observation point;
• and
• identifying a source workload and a destination workload of the flow record using the observation point mapping information, the first lookup table, and the workload identification table.