System and method for determination of routing information in a network

摘要

A system and method to use network flow records to generate information about changes in network routing and to understand the impact of these changes on network traffic. The inferences made can be determinative, if sufficient information is available. If sufficient information is not available to make determinative inferences, inferences may be made that narrow the range of possible changes that may have occurred to network traffic and the underlying network.

主权项

1. A method for generating network routing information regarding routing properties of a network comprising:
at a flow record collector, receiving from a first router in the network a first flow record regarding properties of a first packet flow as measured at the first router, the first flow record including a first source interface field identifying a first source interface of the first router where the first packet flow was received, and a first destination interface field identifying a first destination interface of the first router through which the first packet flow was sent based on a destination address of the first packet flow and based on a first router matrix of the first router, the first flow record being generated starting at initial detection of the first packet flow at the first router and ending at termination of the first packet flow at the first router; at the flow record collector, receiving from a second router in the network a second flow record regarding properties of the first packet flow as measured at the second router, the second flow record including a second source interface field identifying a second source interface of the second router where the first packet flow was received, and a second destination interface field identifying a second destination interface of the second router through which the first packet flow was sent based on a destination address of the first packet flow and based on a second router matrix of the second router, the second flow record being generated starting at initial detection of the first packet flow at the second router and ending at termination of the first packet flow at the second router; wherein the first and second flow records additionally include packet timestamp fields indicating times of initial detection and termination of the packet flow; at a flow record analyzer, generating a set of routing information based on contents of the first and second source interface fields and the first and second destination interface fields; and storing the set of routing information.