Patent ID: 8028058
Filing Date: 2011-09-27
Classification: H04L

Abstract:
1. A computer-implemented method, comprising: executing, by a processor, an agent; the agent being stored in memory coupled to the processor; identifying, by the agent, a first process that uses a first port number from a packet observed by at least one network sniffer based on an association between the first process and the first port number, wherein packets in a network comprise the packet; the packet having a first network address, the first port number, a second network address and a second port number; identifying, by the agent, a second process that uses the second port number from the packet observed by the at least one network sniffer based on an association between the second process and the second port number; identifying, by the agent, the second process that uses the second port number from another packet observed by the at least one network sniffer based on the association between the second process and the second port number; wherein the packets comprise the another packet; the another packet having the second network address, the second port number, a third network address and a third port number; identifying, by the agent, a third process that uses the third port number from the another packet observed by the at least one network sniffer based on an association between the third process and the third port number; sending, by the agent, a first request to a first computer having the first network address from the packet, to identify a first application having the identified first process; receiving, by the agent, a first application name in response to the first request; sending, by the agent, a second request to a second computer having the second network address from the packet, to identify a second application having the identified second process; receiving, by the agent, a second application name from the second computer in response to the second request; sending, by the agent, a third request to a third computer having the third network address from the another packet, to identify a third application having the identified third process; receiving, by the agent, a third application name from the third computer in response to the third request; displaying a graphical representation of a topology indicating that the first application on the first computer communicates with the second application on the second computer over the network, the graphical representation comprising the first application name, the first network address from the packet, the second application name, and the second network address from the packet, wherein the graphical representation indicates that the second application on the second computer communicates with the third application on the third computer, the graphical representation comprising the received third application name; and determining an amount of traffic based on at least a subset of the packets transmitted between a first port having the first port number and a second port having the second port number; wherein the graphical representation comprises an indicator of the amount of traffic.