Patent ID: 11968103
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 10:
11. A system comprising:
at least one processor; and
at least one memory storing instructions, which when executed by the at least one processor, causes the at least one processor to:
receive, from one or more sensors in a network, flow data associated with one of more packets traversing the network, wherein the flow data uniquely describes the one or more packets, wherein the system includes a plurality of collectors for receiving the flow data from the one or more sensors, the plurality of collectors being respectively connected to one or more network devices in the network and outside a path the one or more packets are traversing;
determine, from the flow data, one or more endpoint groups associated with the one or more packets;
determine whether a first policy was enforced on the one or more packets based at least on part on whether a packet of the one or more packets was blocked or allowed at an endpoint of the one or more endpoint groups, wherein the first policy is associated with the one or more endpoint groups;
in response to the first policy being enforced, update utilization data for the first policy in a policy table;
determine, based on a comparison of utilization data in the policy table, whether the first policy is utilized more than a second policy; and
in response to determining that the first policy is utilized more than the second policy, reorder a first position of the first policy and a second position of the second policy in the policy table.