Event correlation using network data flow simulation over unmanaged network segments

摘要

A network simulator comprises a virtual network and event correlation logic. The virtual model models a network that comprises a managed portion and an unmanaged portion. The event correlation logic, when executed, is operable to perform receiving first data indicating that an event occurred in the network. A network flow is initiated at a source virtual network element (VNE) corresponding to the source network device toward a destination VNE corresponding to the destination network device. A first VNE is communicatively coupled to a particular VNE corresponding to an unmanaged portion of the network. A logical topological link to a second VNE is identified and traversed. Second data that is associated with the unmanaged portion of the network is identified. As a result, the first data is stored in association with the second data.

主权项

1. A network simulator comprising:
a virtual network that models a network that comprises one or more managed portions and one or more unmanaged portions; wherein the virtual network comprises a plurality of virtual network elements (VNEs) that correspond to a plurality of network elements in the network; logic encoded in one or more non-transitory tangible media for execution and, when executed, operable to perform:
receiving first data that indicates an event occurred in the network;in response to the first data, initiating a network flow at a source VNE corresponding to a source network device toward a destination VNE corresponding to a destination network device;traversing one or more first physical topological links between the source VNE and the destination VNE;before the network flow arrives at the destination VNE, determining that a first VNE is communicatively coupled to a particular VNE in a portion of the virtual network and that a physical topological link from the first VNE toward the destination VNE is not available, wherein the particular VNE corresponds to an unmanaged portion of the one or more unmanaged portions of the network;in response to the determining that the first VNE is communicatively coupled to the particular VNE and that a physical topological link from the first VNE toward the destination VNE is not available, identifying and traversing a logical topological link to a second VNE;after traversing the logical topological link to the second VNE, identifying second data that is associated with the unmanaged portion of the network; andstoring, in association, the first data and the second data.