A computer system for visualizing a network data communication flow over a network topology, comprising:
- a device information management module defined to obtain device configuration data from device information tables of a plurality of network devices within a network;
- a network visualization module defined to analyze the obtained device configuration data to identify interfaces of each of the plurality of network devices, the interfaces including physical interfaces and logical interfaces, and to identify subnets to which the interfaces connect, and further defined to render in a visual display a topology view of the network including graphical representations of the subnets, the network devices, the physical interfaces within the network devices, the logical interfaces within the network devices;
- a network flow collection management module defined to acquire a plurality of network data communication flow records from each of the plurality of network devices within the network for a specified time period,
- wherein each of the plurality of network data communication flow records is associated with a corresponding one of the plurality of network devices, and
- wherein each of the plurality of network data communication flow records includes information about network traffic flowing through the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and
- wherein each of the plurality of network data communication flow records is generated and stored by the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and
- wherein each of the plurality of network data communication flow records is generated and stored separate from the network traffic flowing through the corresponding one of the plurality of network device to which the network data communication flow record is associated, and
- wherein each of the plurality of network data communication flow records includes data fields for
- 1) an identifier of an ingress interface through which the network traffic entered the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and
- 2) an identifier of an egress interface through which the network traffic exited the corresponding one of the plurality of network devices to which the network data communication flow record is associated or an identifier of an internal interface at which the network traffic terminated within the corresponding one of the plurality of network devices to which the network data communication flow record is associated, and
- 3) an internet protocol source address for the network traffic, and
- 4) an internet protocol destination address for the network traffic, and
- 5) a source port for the network traffic, and
- 6) a destination port for the network traffic;
- a network flow correlation module defined to correlate separate ones of the plurality of network data communication flow records acquired from different ones of the plurality of network devices in the network based on content of the data fields so as to create a common network data communication flow record as a combination of the correlated separate ones of the plurality of network data communication flow records,
- wherein each of the separate ones of the plurality of network data communication flow records within the common network data communication flow record has
- 1) identical content in the data field for the internet protocol source address for the network traffic, and
- 2) identical content in the data field for the internet protocol destination address for the network traffic, and
- 3) identical content in the data field for the source port for the network traffic, and
- 4) identical content in the data field for the destination port for the network traffic,
- the network flow correlation module defined to repeat the correlating of separate ones of the plurality of network data communication flow records based on content of the data fields so as to create a plurality of common network data communication flow records,
- the network flow correlation module defined to aggregate some of the plurality of common network data communication flow records based on identical content in one or more data fields of the plurality of common network data communication flow records to create an aggregated network communication flow record, and
- wherein the network visualization module is defined to render in the topology view of the network on the visual display a graphical representation of the aggregated network communication flow record in lieu of rendering graphical representations of the plurality of common network data communication flow records represented by the aggregated network communication flow record, the graphical representation of the aggregated network communication flow record including one or more arrows to represent a data communication path traversed through some of the plurality of network devices by network flows represented by the aggregated network communication flow record, the graphical representation of the aggregated network communication flow record including at least one arrow extending between two internal interfaces of a given one of the plurality of network devices.