Optimized Container-Based Network Intelligence

A non-transitory computer readable storage medium having instructions encoded thereon that, when executed by one or more processors, cause the one or more processors to perform steps comprising:

• deploying a plurality of agents in a cloud environment, wherein each agent of the plurality of agent is deployed onto a different node of a plurality of nodes, and
• wherein each agent of the plurality of agents is:
• executed in a kernel of a node on which the agent is deployed,
• attached to network-related system calls in the kernel in which the network-related system calls are executed, and
• configured to monitor data associated with network traffic flows that originate from or received by the node and determine metrics associated with network traffic flows on the node based on the monitored data;
• receiving, from each of the plurality of nodes, respective metrics associated with network traffic flows on the node determined by the agent deployed on the node;
• identifying process-level network traffic flows based on the received metrics associated with network traffic flows and a topology of the plurality of the nodes in the cloud environment;
• classifying each of the process-level network flows into intra-zone or cross zone based on traffic being local or external to a zone;
• generating a graph based on the identified process-level network traffic flows, the graph including a plurality of vertices representing source or destination processes running on the plurality of nodes, and edges linking the vertices representing process-level network traffic flows, wherein the graph corresponds to the topology of the plurality of nodes, and the edges are annotated to indicate whether the corresponding traffic flows between nodes are intra-zone or cross-zone;
• and
• presenting the graph for display at a client device.

A system, comprising:

• one or more processors;
• and
• a non-transitory computer readable storage medium having instructions encoded thereon that, when executed by the one or more processors, cause the one or more processors to perform steps comprising:
• deploying a plurality of agents in a cloud environment, wherein each agent of the plurality of agent is deployed onto a different node of a plurality of nodes, and wherein each agent of the plurality of agents is:
• executed in a kernel of a node on which the agent is deployed,
• attached to network-related system calls in the kernel in which the network-related system calls are executed, and
• configured to monitor data associated with network traffic flows that originate from or received by the node and determine metrics associated with network traffic flows on the node based on the monitored data;
• receiving, from each of the plurality of nodes, respective metrics associated with network traffic flows on the node determined by the agent deployed on the node;
• identifying process-level network traffic flows based on the received metrics associated with network traffic flows and a topology of the plurality of the nodes in the cloud environment;
• classifying each of the process-level network flows into intra-zone or cross zone based on traffic being local or external to a zone;
• generating a graph based on the identified process-level network traffic flows, the graph including a plurality of vertices representing source or destination processes running on the plurality of nodes, and edges linking the vertices representing process-level network traffic flows, wherein the graph corresponds to the topology of the plurality of nodes, and the edges are annotated to indicate whether the corresponding traffic flows between nodes are intra-zone or cross-zone;
• and
• presenting the graph for display at a client device.