Abstract:
A method for determination of a network topology includes generating a list of device sets for a destination; removing any duplicate device sets from the list; creating a tree for the destination by introducing a root node into the tree; sorting the list of device sets for the destination by length; removing the shortest device set from the list; introducing a new node representing the shortest device set into the tree; determining whether a node in the tree represents a maximum length subset of the shortest device set, and in the event that a node is determined, connecting the new node to the determined node, or else connecting the new node to the root node; setting the identifier of the introduced node to a list of members of the shortest device set that are not included in the maximum length subset of the determined node.

Description:
BACKGROUND 
     This disclosure relates generally to the field of network topology determination. 
     Computer networks are complex systems that may be difficult to manage and operate. The deployed topology layout and routing regimes may not be fully understood. A network administrator may examine the network configuration at network nodes, such as routers or switches; however, verification of the deployed configuration is not easy, as a network administrator may not necessarily have access to the network configuration information needed to fully understand the topology layout and routing regime. 
     Sniffing of Open Shortest Path First/Border Gateway Protocol (OSPF/BGP) routing information is one solution that may be used to determine network topology. A drawback of this approach is that sniffing is costly, laborious, and may require special permissions. Another solution is accessing configurations via Simple Network Management Protocol (SNMP), however, credentials may be required, and routers must be known. 
     There exists a need in the art for a method for determination of network topology using traffic records comprising flow-based traffic information. 
     SUMMARY 
     An exemplary embodiment of a method for determination of a network topology from a set of traffic records includes: generating a list of device sets for a destination from the set of traffic records, each device set comprising at least one network device; removing any duplicate device sets from the list of device sets; creating a tree for the destination using the list of device sets, wherein creating a tree comprises: introducing a root node into the tree; sorting the list of device sets for the destination by length; removing the shortest device set from the list; introducing a new node representing the shortest device set into the tree; determining whether a node in the tree represents a maximum length subset of the shortest path, and in the event that a node is determined, connecting the new node to the determined node, or else connecting the new node to the root node; setting the identifier of the introduced node to a list of members of the shortest device set that are not represented in the determined node, or, in the event that the new node is connected to the root node, to a list of members of the shortest device set; and repeating the removing the shortest device set, introducing, determining, and setting for the next shortest device set in the list, until there are no more device sets remaining for the destination. 
     Additional features are realized through the techniques of the present exemplary embodiment. Other embodiments are described in detail herein and are considered a part of what is claimed. For a better understanding of the features of the exemplary embodiment, refer to the description and to the drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
       Referring now to the drawings wherein like elements are numbered alike in the several FIGURES: 
         FIG. 1  illustrates a network topology that may be discovered using an embodiment of a method for determination of network topology using flow-based traffic information. 
         FIG. 2  illustrates an embodiment of a method for determination of network topology using flow-based traffic information. 
         FIG. 3  illustrates an embodiment of a method for tree creation. 
         FIG. 4  illustrates a tree that may be created using an embodiment of a method for tree creation. 
         FIG. 5  illustrates a tree that may be created using an embodiment of a method for tree creation. 
         FIG. 6  illustrates a topology that may be discovered using an embodiment of a method for determination of network topology using flow-based traffic information. 
         FIG. 7  illustrates an embodiment of a method for tree building for a router from a list of source-destination observations taken at the router. 
         FIG. 8  illustrates a computer that may be used in conjunction with an embodiment of a method for determination of network topology using flow-based traffic information. 
     
    
    
     DETAILED DESCRIPTION 
     Embodiments of a method for determination of network topology using flow-based traffic information are provided, with exemplary embodiments being discussed below in detail. Information records obtained from an end-to-end flow-based traffic measurement utility such as, for example, Cisco&#39;s NetFlow, or Internet Engineering Task Force&#39;s IP Flow Information Export (IPFIX) (http://www.ietforg/html.charters/ipfix-charter.html), may be used. Traffic flow information records in the form of source-destination pairs (s→d pairs) observed at various locations are exported at network routers and switches; these source-destination pairs are processed to determine topology. Directed topology graphs may be generated using s→d pairs if the assumption of shortest-path destination routing (meaning that a selected route depends only on the destination) with static routes is not violated during the observation time interval that the s→d pairs are collected. 
     Key fields from the traffic records may include source address, destination address, inbound interface, interface information, identification of a measurement point (i.e., router address and id), timing information, and actual loads of paths. The source-destination pairs observed at a network device, including but not limited to routers, switches, or other types of network nodes, may be analyzed against hypothetical topologies and routing paths between various network devices. The number of possible paths may be reduced when source-destination pairs are observed at multiple measurement points and a shortest-path destination routing regime with static routes is assumed. Additional constraints for reducing possible paths may be based on the timing information of the flow observations, the inbound/outbound interface information, or the actual load of the paths. 
       FIG. 1  shows an embodiment of a network topology  100  that may be discovered using flow-based traffic information. The topology is not known in advance. The path between a source and a destination via a sequence of routers may be denoted by p. For each source-destination pair, {R} denotes the set of network devices, which may include routers, switches, or any other type of network node, at which a particular source-destination pair is observed. {R} is the device set of path p. The following traffic flow records are obtained from the network topology of  FIG. 1  by a traffic measurement utility: s 1 →d 1  is observed at router r 1 ; s 1 →d 1  is observed at router r 2 ; and s 2 →d 1  is observed at router r 2 . Therefore, destination di has two distinct source destination pairs: s 1 →d 1  and s 2 →d 1 . Device set {r 1 , r 2 } corresponds to s 1 →d 1 , and device set {r 2 } corresponds to s 2 →d 1 . If shortest path routing is used, device r 1  must be before device r 2  on the path to destination d 1 , because for any destination d, if {R 1 } and {R 2 } are two device sets of destination d, the network devices contained in both sets {R 1 } and {R 2 } (i.e., {R 1 } ∩ {R 2 }) are closer to destination d than any other devices in sets R 1  or R 2 . 
     From the observed source-destination pairs, the following end-to-end paths are possible: for s 1 →d 1 , path p 1 : s 1 →r 1 →r 2 →d 1 , or path p 2 : s 1 →r 2 →r 1 →d 1 ; and for s 2 →d 1 , path p 3 : s 2 →r 2 →d 1 . The combination of paths p 2  and p 3  lead to a conflict under the assumption of destination routing with static single routes because s 2 →d 1  is not observed at r 1 . Therefore, a conflict-free routing topology tree constructed from the observed data set for d 1  is shown in  FIG. 1 , combining p 1  and p 3 . Source s 1  ( 102 ) communicates with d 1  ( 101 ) via routers r 1  ( 103 ) and r 2  ( 104 ), and source s 2  ( 106 ) communicates with d 1  ( 101 ) via router r 2  ( 104 ). Router r 3  ( 105 ) cannot be detected from the data, as no traffic measurements are given for router r 3  ( 105 ). 
       FIG. 2  shows an embodiment of a method  200  for topology discovery using traffic records. Referring to  FIG. 2 , in block  201 , a list of device sets for each destination is determined from the traffic records obtained regarding each destination. In block  202 , any duplicate device sets are removed from each list. A tree G d  is created in block  203  for each destination; tree creation is discussed in further detail below with regard to  FIG. 3 . In the created trees G d , each node represents a network device or set of network devices. In block  204 , the trees G d  created for each destination are merged. Merging two or more trees might not be possible if intersecting but non-identical node identifiers exist. For example, if a tree has a node with an identifier {r 2 ,r 3 ,r 4 } and a second tree has a node with an identifier {r 2 , r 3 }, then it might not be possible to unambiguously merge the trees. In this case, the topological information is included in the individual trees. If all non-identical node identifiers have empty intersections, then a merged graph consists of the union of nodes and links in the trees. 
       FIG. 3  shows an embodiment of a method  300  for tree creation. In block  301 , a root node is introduced representing destination d. In block  302 , the list of device sets for destination d is sorted by length, i.e., by the number of devices contained in each device set. In block  303 , the shortest device set {R i } is removed from the list. In block  304 , a new node is introduced in the tree. In block  305 , it is determined if any node in the tree represents a maximum length subset of the shortest device set. In block  306 , the new node from block  304  is connected to the node determined in block  305 ; if no node is determined in block  305 , the new node is connected to the root node. In block  307 , the identifier of the new node is set to the members of the shortest device set that are not present in the maximum length subset of any node determined in block  305 , or, f no node was determined in block  305 , the identifier of the new node is set to the members of the shortest device set. In block  308 , blocks  303 - 307  are repeated for the next shortest device set in the list, until there are no more device sets remaining for the destination. The resulting graph is the topology tree for the destination. 
     In an example, the following lists of device sets are generated for destinations d 1  and d 2  in block  201  of  FIG. 2 : device sets {r 1 }, {r 2 }, {r 3 } and {r 4 , r 1 } for destination d 1 ; and device sets {r 2 }, {r 1 , r 2 }, {r 3 , r 2 }, and {r 4 , r 1 , r 2 } for destination d 2 . These generated lists of device sets contain no duplicate device sets, as required by  FIG. 2 , block  202 . In block  203 , performing the tree-creation method of  FIG. 3  on the above data yields tree  400  for d 1  as shown in  FIG. 4 , and tree  500  for d 2  as shown in  FIG. 5 . Execution of the method of  FIG. 3  on the above data is discussed in detail below. 
     Generation of the tree shown in  FIG. 4  for d 1  using the method of  FIG. 3  is as follows. In block  301 , a root node  401  for destination di is introduced. Next, in block  302 , the list of device sets for d 1  is sorted by length, yielding {r 1 }, {r 2 }, {r 3 }, and {r 4 , r 1 }. In block  303 , {r 1 } is removed from the list of device sets. A node  402  is introduced into the tree in block  304 . In block  305 , it is determined that there is no node in the tree representing a maximum length subset of the shortest device set {r 1 }, so in block  306 , node  402  is connected to root node  401 . The identifier of node  402  is set to r 1  in block  307 . In block  308 , blocks  303 - 307  are repeated for {r 2 }, then for {r 3 }, and lastly for {r 4 , r 1 }. 
     For {r 2 }, in block  303 , {r 2 } is removed from the list. In block  304 , node  403  is introduced into the tree. In block  305 , it is determined that there is no node in the tree representing a maximum length subset of the shortest device set {r 2 }, so in block  306 , node  403  is connected to root node  401 . The identifier of node  403  is set to r 2  in block  307 . For {r 3 }, in block  303 , {r 3 } is removed from the list. In block  304 , node  404  is introduced into the tree. In block  305 , it is determined that there is no node in the tree representing a maximum length subset of the shortest device set {r 3 }, so in block  306 , node  404  is connected to root node  401 . The identifier of node  404  is set to r 3  in block  307 . Lastly, for {r 4 , r 1 }, in block  303 , {r 4 , r 1 } is removed from the list. In block  304 , node  405  is introduced into the tree. In block  305 , it is determined that node  402  represents {r 1 }, which is the maximum length subset of the shortest device set {r 4 , r 1 }, so in block  306 , node  403  is connected to node  402 . The identifier of node  405  is set to r 4  in block  307 , as r 4  is not in {r 1 } (node  402 ). At this point, there are no more device sets for destination d 1 , and the end result is the tree  400  shown in  FIG. 4 . 
     Generation of the tree shown in  FIG. 5  for d 2  using the method of  FIG. 3  is as follows. Starting at block  301 , a root node  501  for destination d 2  is introduced. Next, in block  302 , the list of device sets for d 1  is sorted by length, yielding {r 2 }, {r 1 , r 2 }, {r 3 , r 2 }, and {r 4 , r 1 , r 2 }. In block  303 , {r 2 } is removed from the list of device sets. A node  502  is introduced into the tree in block  304 . In block  305 , it is determined that there is no node in the tree representing a maximum length subset of the shortest device set {r 2 }, so in block  306 , node  502  is connected to root node  501 . The identifier of node  502  is set to r 2  in block  307 . In block  308 , blocks  303 - 307  are repeated for {r 1 , r 2 }, {r 3 , r 2 }, and {r 4 , r 1 , r 2 }. 
     For {r 1 , r 2 }, in block  303 , {r 1 , r 2 } is removed from the list. In block  304 , node  504  is introduced into the tree. In block  305 , it is determined that node  502  represents {r 2 }, which is the maximum length subset of the shortest device set {r 1 , r 2 }, so in block  306 , node  504  is connected to node  502 . The identifier of node  504  is set to r 1  in block  307 , as r 1  is not in {r 2 } (node  502 ). For {r 3 , r 2 }, in block  303 , {r 3 , r 2 } is removed from the list. In block  304 , node  503  is introduced into the tree. In block  305 , it is determined that node  502  represents {r 2 }, which is the maximum length subset of the shortest device set {r 3 , r 2 }, so in block  306 , node  503  is connected to node  502 . The identifier of node  503  is set to r 3  in block  307 , as r 3  is not in {r 2 } (node  502 ). For {r 4 , r 1 , r 2 }, in block  303 , {r 4 , r 1 , r 2 } is removed from the list. In block  304 , node  505  is introduced into the tree. In block  305 , it is determined that node  504  represents {r 2 , r 1 }, which is the maximum length subset of the shortest device set {r 4 , r 1 , r 2 }, so in block  306 , node  505  is connected to node  504 . The identifier of node  503  is set to r 4  in block  307 , as r 4  is not in {r 2 , r 1 } (nodes  502  and  504 ). At this point, there are no more device sets for destination d 2 , and the end result is the tree  500  shown in  FIG. 5 . 
     Once trees  400  and  500  are obtained for destinations d 1  and d 2  in block  203  of  FIG. 2 , trees  400  and  500  are merged in block  204  to yield the overall topology  600  of the network that includes destinations d 1  and d 2  as shown in  FIG. 6 . The merged graph consists of the union of the various nodes and links present in trees  400  and  500 . 
       FIG. 7  shows an embodiment of a method  700  for tree building for a network device from a list of source-destination observations taken at the network device, which may be used in conjunction with the methods of  FIGS. 2 and 3 . In block  701 , a first source-destination observation (s 1 →d 1 ) provided from the network device r is used to build a directed graph g={s 1 →r, r→d 1 }. In block  702 , graph g 1  is added to the set of all possible graphs G. In block  703 , a directed graph g n  is built for a next source-destination observation (s n →d n ) provided from network device r. In block  704 , repeat block  703  until no more source-destination observations are available from the network device r. In block  705 , for all g in G: If g can be inserted without conflict into G. i.e., there is no violation of the assumption of destination routing with static routes, then insert g into G; if there is a conflict, g is not added to G. In block  706 , return G as the topology tree for network device r. Method  700  may be performed for all network devices for which data is available. A topology tree generated by method  700  may be merged with other topology trees generated for a network using the methods of  FIG. 3  or  FIG. 7  to determine the overall topology of the network. 
       FIG. 8  illustrates an example of a computer  800  having capabilities, which may be utilized by exemplary embodiments of a method for determination of network topology using flow-based traffic information as embodied in software. Various operations discussed above may utilize the capabilities of the computer  800 . One or more of the capabilities of the computer  800  may be incorporated in any element, module, application, and/or component discussed herein. 
     The computer  800  includes, but is not limited to, PCs, workstations, laptops, PDAs, palm devices, servers, storages, and the like. Generally, in terms of hardware architecture, the computer  800  may include one or more processors  810 , memory  820 , and one or more input and/or output (I/O) devices  870  that are communicatively coupled via a local interface (not shown). The local interface can be, for example but not limited to, one or more buses or other wired or wireless connections, as is known in the art. The local interface may have additional elements, such as controllers, buffers (caches), drivers, repeaters, and receivers, to enable communications. Further, the local interface may include address, control, and/or data connections to enable appropriate communications among the aforementioned components. 
     The processor  810  is a hardware device for executing software that can be stored in the memory  820 . The processor  810  can be virtually any custom made or commercially available processor, a central processing unit (CPU), a data signal processor (DSP), or an auxiliary processor among several processors associated with the computer  800 , and the processor  810  may be a semiconductor based microprocessor (in the form of a microchip) or a macroprocessor. 
     The memory  820  can include any one or combination of volatile memory elements (e.g., random access memory (RAM), such as dynamic random access memory (DRAM), static random access memory (SRAM), etc.) and nonvolatile memory elements (e.g., ROM, erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), tape, compact disc read only memory (CD-ROM), disk, diskette, cartridge, cassette or the like, etc.). Moreover, the memory  820  may incorporate electronic, magnetic, optical, and/or other types of storage media. Note that the memory  820  can have a distributed architecture, where various components are situated remote from one another, but can be accessed by the processor  810 . 
     The software in the memory  820  may include one or more separate programs, each of which comprises an ordered listing of executable instructions for implementing logical functions. The software in the memory  820  includes a suitable operating system (O/S)  850 , compiler  840 , source code  830 , and one or more applications  860  in accordance with exemplary embodiments. As illustrated, the application  860  comprises numerous functional components for implementing the features and operations of the exemplary embodiments. The application  860  of the computer  800  may represent various applications, computational units, logic, functional units, processes, operations, virtual entities, and/or modules in accordance with exemplary embodiments, but the application  860  is not meant to be a limitation. 
     The operating system  850  controls the execution of other computer programs, and provides scheduling, input-output control, file and data management, memory management, and communication control and related services. It is contemplated by the inventors that the application  860  for implementing exemplary embodiments may be applicable on all commercially available operating systems. 
     Application  860  may be a source program, executable program (object code), script, or any other entity comprising a set of instructions to be performed. When a source program, then the program is usually translated via a compiler (such as the compiler  840 ), assembler, interpreter, or the like, which may or may not be included within the memory  820 , so as to operate properly in connection with the O/S  850 . Furthermore, the application  860  can be written as (a) an object oriented programming language, which has classes of data and methods, or (b) a procedure programming language, which has routines, subroutines, and/or functions, for example but not limited to, C, C++, C#, Pascal, BASIC, API calls, HTML, XHTML, XML, ASP scripts, FORTRAN, COBOL, Perl, Java, ADA, .NET, and the like. 
     The I/O devices  870  may include input devices such as, for example but not limited to, a mouse, keyboard, scanner, microphone, camera, etc. Furthermore, the I/O devices  870  may also include output devices, for example but not limited to a printer, display, etc. Finally, the I/O devices  870  may further include devices that communicate both inputs and outputs, for instance but not limited to, a NIC or modulator/demodulator (for accessing remote devices, other files, devices, systems, or a network), a radio frequency (RF) or other transceiver, a telephonic interface, a bridge, a router, etc. The I/O devices  870  also include components for communicating over various networks, such as the Internet or intranet. 
     If the computer  800  is a PC, workstation, intelligent device or the like, the software in the memory  820  may further include a basic input output system (BIOS) (omitted for simplicity). The BIOS is a set of essential software routines that initialize and test hardware at startup, start the O/S  850 , and support the transfer of data among the hardware devices. The BIOS is stored in some type of read-only-memory, such as ROM, PROM, EPROM, EEPROM or the like, so that the BIOS can be executed when the computer  800  is activated. 
     When the computer  800  is in operation, the processor  810  is configured to execute software stored within the memory  820 , to communicate data to and from the memory  820 , and to generally control operations of the computer  800  pursuant to the software. The application  860  and the O/S  850  are read, in whole or in part, by the processor  810 , perhaps buffered within the processor  810 , and then executed. 
     When the application  860  is implemented in software it should be noted that the application  860  can be stored on virtually any computer readable medium for use by or in connection with any computer related system or method. In the context of this document, a computer readable medium may be an electronic, magnetic, optical, or other physical device or means that can contain or store a computer program for use by or in connection with a computer related system or method. 
     The application  860  can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. In the context of this document, a “computer-readable medium” can be any means that can store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer readable medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. 
     More specific examples (a nonexhaustive list) of the computer-readable medium may include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic or optical), a random access memory (RAM) (electronic), a read-only memory (ROM) (electronic), an erasable programmable read-only memory (EPROM, EEPROM, or Flash memory) (electronic), an optical fiber (optical), and a portable compact disc memory (CDROM, CD R/W) (optical). Note that the computer-readable medium could even be paper or another suitable medium, upon which the program is printed or punched, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory. 
     In exemplary embodiments, where the application  860  is implemented in hardware, the application  860  can be implemented with any one or a combination of the following technologies, which are each well known in the art: a discrete logic circuit(s) having logic gates for implementing logic functions upon data signals, an application specific integrated circuit (ASIC) having appropriate combinational logic gates, a programmable gate array(s) (PGA), a field programmable gate array (FPGA), etc. 
     The technical effects and benefits of exemplary embodiments include determination of topology using information available from traffic measurements, without the need for credentials or other network configuration information. 
     The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an”, and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. 
     The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.