Patent ID: 11902123
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 12:
13. A non-transitory computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform operations comprising:
receiving, from a plurality of capturing agents deployed in a plurality of devices, data generated based on traffic at the plurality of devices, a first one of the plurality of devices including a leaf switch in a spine-leaf network fabric, and a second one of the plurality of devices includes a host of a hypervisor coupled with the spine-leaf network fabric via the leaf switch;
comparing characteristics of the data to determine a difference in the characteristics;
based on the difference, determining a state of at least one of the plurality of capturing agents, comprising:
determining an indication of a threshold discrepancy between a first amount of traffic captured at the host and a second amount of traffic captured at the leaf switch; and
determining the threshold discrepancy is at least partially a result of unauthorized activity at the first one of the plurality of devices or the second one of the plurality of devices;

wherein the data is generated based on observed data, statistics, and/or metadata about one or more packets, flows, communications, processes, events, and/or activities at the plurality of devices.