# US 2025/0097128 A1 · Autospan Network Traffic Based on Monitored Applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097128 A1 - Document ID: US20250097128A1 - Status: Published application - Kind: A1 - Application number: 18/602,756 - Filed: 2024-03-12 - Published: 2025-03-20 - Earliest claimed: 2023-09-20 - Assignees: Arista Networks, Inc. - Applicants: Arista Networks, Inc. - Inventors: Shashank HEGDE; Sandip SHAH - Web page: https://patentgrep.com/patent/US20250097128A1 ## CPC - H04L 43/062: related to network traffic - H04L 41/082: the condition being updates or upgrades of network functionality - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/12: Network monitoring probes - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure is directed to capturing network traffic for analysis. The present disclosure describes techniques to automate setting up a monitoring session for an application. The technique allows a user to set up a monitoring session by specifying the application to be monitored and one or more monitoring destinations (e.g., monitoring tools, monitoring fabric, etc.). The monitoring session can then be autonomously set up by the system without further input from the user. ## Claims ### Claim 1 A method in a network management system for monitoring network traffic in a production network, the method comprising: receiving a request to monitor network traffic associated with an application running on the production network, the application accessing a plurality of associated services that support functions of the application; identifying a plurality of servers on which the application and the plurality of associated services run; identifying a plurality of network devices and interfaces on those network devices that can reach the plurality of servers; and configuring one or more of the plurality of network devices to capture data packets sent to and sent by the application. ### Claim 2 (depends on 1) The method of claim 1, wherein an application and its corresponding services are hosted on one or more servers. ### Claim 3 (depends on 1) The method of claim 1, wherein the network traffic to be monitored comprises network traffic from multiple instances of the application running on different servers behind corresponding switches. ### Claim 4 (depends on 1) The method of claim 1, further comprising discovering applications running in the production network, including identifying corresponding services used by the applications and identifying servers that host the applications and corresponding services. ### Claim 5 (depends on 1) The method of claim 1, further comprising detecting changes in the application including addition or removal of one or more servers that host the application and/or the plurality of associated services and, in response thereto, updating configuration of network devices to which the one or more servers are connected. ### Claim 6 (depends on 1) The method of claim 1, further comprising detecting a state change in one or more of the network devices that are configured to capture data packets associated with the application and, in response thereto, updating configuration of the one or more network devices. ### Claim 7 (depends on 1) The method of claim 1, wherein configuring at least some of the plurality of network devices to capture data packets associated with the application includes enabling at least some of the plurality of network devices to mirror data packets associated with the application and transmit the mirrored data packets to a collector. ### Claim 8 A network device comprising: one or more computer processors; and a computer-readable storage device comprising instructions for controlling the one or more computer processors to: receive a request to monitor network traffic associated with an application running on the production network, the application accessing a plurality of associated services that support functions of the application; identify a plurality of servers on which the application and the plurality of associated services run; identify a plurality of network devices and interfaces on those network devices that can reach the plurality of servers; and configure one or more of the plurality of network devices to capture data packets sent to and sent by the application. ### Claim 9 (depends on 8) The network device of claim 8, wherein an application and its corresponding services are hosted on one or more servers. ### Claim 10 (depends on 8) The network device of claim 8, wherein the network traffic to be monitored comprises network traffic from multiple instances of the application running on different servers behind corresponding switches. ### Claim 11 (depends on 8) The network device of claim 8, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors to discover applications running in the production network, including identifying corresponding services used by the applications and identifying servers that host the applications and corresponding services. ### Claim 12 (depends on 8) The network device of claim 8, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors to detect changes in the application including addition or removal of one or more servers that host the application and/or the plurality of associated services and, in response thereto, update configuration of network devices to which the one or more servers are connected. ### Claim 13 (depends on 8) The network device of claim 8, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors to detect state change in one or more of the network devices that are configured to capture data packets associated with the application and, in response thereto, update configuration of the one or more network devices. ### Claim 14 (depends on 8) The network device of claim 8, wherein configuring at least some of the plurality of network devices to capture data packets associated with the application includes enabling at least some of the plurality of network devices to mirror data packets associated with the application and transmit the mirrored data packets to a collector. ### Claim 15 A non-transitory computer-readable storage device in a network device, the non-transitory computer-readable storage device having stored thereon computer executable instructions, which when executed, cause the network device to: receive a request to monitor network traffic associated with an application running on the production network, the application accessing a plurality of associated services that support functions of the application; identify a plurality of servers on which the application and the plurality of associated services run; identify a plurality of network devices and interfaces on those network devices that can reach the plurality of servers; and configure one or more of the plurality of network devices to capture data packets sent to and sent by the application. ### Claim 16 (depends on 15) The non-transitory computer-readable storage device of claim 15, wherein the network traffic to be monitored comprises network traffic from multiple instances of the application running on different servers behind corresponding switches. ### Claim 17 (depends on 15) The non-transitory computer-readable storage device of claim 15, wherein the computer executable instructions, which when executed, further cause the network device to discover applications running in the production network, including identifying corresponding services used by the applications and identifying servers that host the applications and corresponding services. ### Claim 18 (depends on 15) The non-transitory computer-readable storage device of claim 15, wherein the computer executable instructions, which when executed, further cause the network device to detect changes in the application including addition or removal of one or more servers that host the application and/or the plurality of associated services and, in response thereto, update configuration of network devices to which the one or more servers are connected. ### Claim 19 (depends on 15) The non-transitory computer-readable storage device of claim 15, wherein the computer executable instructions, which when executed, further cause the network device to detect state change in one or more of the network devices that are configured to capture data packets associated with the application and, in response thereto, update configuration of the one or more network devices. ### Claim 20 (depends on 15) The non-transitory computer-readable storage device of claim 15, wherein configuring at least some of the plurality of network devices to capture data packets associated with the application includes enabling at least some of the plurality of network devices to mirror data packets associated with the application and transmit the mirrored data packets to a collector.