Techniques for determining network topologies

Abstract

In one embodiment, a monitoring device (or module) monitors messages exchanged between nodes in a communication network. The monitoring device further determines, based on time stamp data associated with each message, one or more latency distributions of paired response times between the nodes, and determines a node topology consistent with each of the one or more latency distributions of paired response times between the nodes. In some embodiments, the monitoring device also generates a graph of the node topology showing one or more communication links between the nodes, and annotates each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the latency distributions.

Description

TECHNICAL FIELD

The present disclosure relates generally to communication systems, and more particularly, to techniques for determining network topologies of communication networks such as a data center network.

BACKGROUND

Increasingly, consumers and businesses alike turn to cloud-based services over local computing environments. Such cloud-based computing services advantageously provide access to customizable and scalable computing resources over a network (e.g., the Internet). Typically, cloud-based service providers house such computing resources in one or more data centers that may include hundreds or even thousands of devices such as servers, switches, processors, memory, and other corresponding hardware and software components. The sheer number of data center devices or nodes as well as the number of possible configurations often results in complex networks within each data center. Moreover, the devices forming such complex networks may dynamically change depending on customer needs. Accordingly, it is often difficult to identify node topologies, data path flow, and/or path characteristics for devices and/or networks within data center networks.

BRIEF DESCRIPTION OF THE DRAWINGS

The embodiments herein may be better understood by referring to the following description in conjunction with the accompanying drawings in which like reference numerals indicate identical or functionally similar elements. Understanding that these drawings depict only exemplary embodiments of the disclosure and are not therefore to be considered to be limiting of its scope, the principles herein are described and explained with additional specificity and detail through the use of the accompanying drawings in which:

FIG. 1 illustrates a schematic diagram of an example communication network;

FIG. 2 illustrates a schematic diagram an example network device/node;

FIG. 3 illustrates schematic diagrams of a pair of nodes exchanging messages or packets;

FIG. 4 illustrates graphs showing latency values or response times for messages exchanged between the pair of nodes shown in FIG. 3;

FIG. 5 illustrates latency charts showing paired latency values or response times for messages exchanged between nodes in a communication network;

FIG. 6 illustrates a network topology, including a network topology for the nodes shown in FIG. 5;

FIG. 7 illustrates latency charts showing paired latency values or response times for messages exchanged between nodes in a communication network;

FIG. 8 illustrates a network topology, including a network topology for the nodes shown in FIG. 7; and

FIG. 9 illustrates an example simplified procedure for mapping a network topology in a communication network.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

According to one or more embodiments of the disclosure, a monitoring device (or module) monitors messages exchanged between nodes in a communication network. The monitoring device further determines, based on time stamp data associated with each message, one or more latency distributions of paired response times between the nodes, and determines a node topology consistent with each of the one or more latency distributions of paired response times between the nodes. In some embodiments, the monitoring device also generates a graph of the node topology showing one or more communication links between the nodes, and annotates each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the latency distributions.

Description

Various embodiments of the disclosure are discussed in detail below. While specific implementations are discussed, it should be understood that this is done for illustration purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without parting from the spirit and scope of the disclosure.

A communication network is a geographically distributed collection of nodes interconnected by communication links and segments for transporting data between end nodes, such as computers, workstations, servers, and the like. Many types of networks are available, ranging from local area networks (LANs) to wide area networks (WANs). LANs typically connect the nodes over dedicated private communications links located in the same general physical location, such as a building or campus. WANs, on the other hand, typically connect geographically dispersed nodes over long-distance communications links, such as common carrier telephone lines, optical lightpaths, synchronous optical networks (SONET), synchronous digital hierarchy (SDH) links, or Powerline Communications (PLC) such as IEEE 61334, IEEE P1901.2, and others. In addition, a Mobile Ad-Hoc Network (MANET) is a kind of wireless ad-hoc network, which is generally considered a self-configuring network of mobile routes (and associated hosts) connected by wireless links, the union of which forms an arbitrary topology. Data centers, as mentioned above, can include complex networks of computing resources (e.g., mainframe computers, servers, application software, file and printer servers executing various operating systems, storage subsystems, network infrastructure, and the like) and provide network-based access to such computer resources.

FIG. 1 illustrates a schematic diagram of an example communication network 100 illustratively comprising a data center network 105, one or more Internet Service Provider (ISP) network(s) 110, and a public/private network 115 (e.g., the Intent). Operatively, data center network 105 hosts computing resources (e.g., applications, services, storage, network infrastructure, and the like) and provides access to such computing resources to one or more client device(s) 120 over public/private network 115 and corresponding ISP network(s) 110

As shown, the various networks include nodes/devices that route requests and facilitate access to computing resources from data center network 105. For example, the nodes/devices shown in FIG. 1 may operate to direct data packets or messages from respective source nodes to a destination node. As shown, data center network 105 illustratively includes nodes/devices 200 (e.g., routers, sensors, servers, computers, etc.) interconnected by communication links 106. Communication links 105 may be wired links or shared media (e.g., wireless links, PLC links, etc.) where certain nodes/devices 200 may be in communication with other nodes/devices based on, for example, distance, signal strength, network topology, current operational status, location, etc. Further, certain nodes/devices 200 may be located near an “edge” of a network

Data packets 150 (e.g., traffic and/or messages) may be exchanged among the nodes/devices 200 in communication network 100 using predefined network communication protocols such as certain known wired protocols (e.g., Interior Gateway Protocol (IGP), Exterior Border Gateway Protocol (E-BGP), TCP/IP, etc.), wireless protocols (e.g., IEEE Std. 802.15.4, WiFi, Bluetooth®, etc.), PLC protocols, or other shared-media protocols where appropriate. In this context, a protocol consists of a set of rules defining how the nodes interact with each other.

Those skilled in the art will understand that any number of nodes, devices, communication links, and the like may be used, and that the view shown herein is for simplicity. Also, those skilled in the art will further understand that while communication network 100 (including networks 105, 110, and 115) is shown in a certain orientation, such orientation is merely an example for purposes of illustration, not limitation.

FIG. 2 is a schematic diagram of one example node/device 200 that may be used with one or more embodiments described herein, e.g., as one of the nodes/devices shown in FIG. 1 above. Device 200 may comprise one or more network interfaces 210 (e.g., wired, wireless, PLC, etc.), at least one processor 220, and a memory 240 interconnected by a system bus 250.

Network interface(s) 210 contain the mechanical, electrical, and signaling circuitry for communicating data over communication links 106 coupled to communication network 100. Network interfaces 210 may be configured to transmit and/or receive data using a variety of different communication protocols. Note, further, that one or more nodes/devices may include two different types of network interfaces 210, e.g., wireless and wired/physical connections, and that the view herein is merely for illustration.

Memory 240 comprises a plurality of storage locations that are addressable by the processor 220 and network interfaces 210 for storing software programs and data structures associated with the embodiments described herein. Note that certain devices may have limited memory or no memory (e.g., no memory for storage other than for programs/processes operating on the device and associated caches). Processor 220 may comprise hardware elements or hardware logic adapted to execute the software programs and manipulate the data structures 245. An operating system 242, portions of which may resident in memory 240 and executed by processor 220, functionally organizes the device by, inter alia, invoking operations in support of software processes and/or services executing on the device. These software processes and/or services may comprise monitoring process/services 244, and an illustrative network topology process 248, as described herein. Note that while processes/services 244 and 248 are shown in centralized memory 240, alternative embodiments provide for the process to be operated within network interfaces 210 (e.g., as a component of a MAC layer, etc.).

It will be apparent to those skilled in the art that other processor and memory types, including various computer-readable media, may be used to store and execute program instructions pertaining to the techniques described herein. Also, while the description illustrates various processes, it is expressly contemplated that various processes may be embodied as modules configured to operate in accordance with the techniques herein (e.g., according to the functionality of a similar process). Further, while the processes have been shown separately, those skilled in the art will appreciate that processes may be routines or modules within other processes.

As noted above, data centers present unique challenges for understanding node topologies, data path flow, and/or path characteristics for devices and/or networks therein. Furthermore, providing customers on-demand cloud-based services creates a dynamic and ever changing environment, including possible frequent instantiations and de-instantiations of devices. Conventional approaches for determining network topologies often use round trip response times between nodes/devices to determine relative positions in a network topology. Notably, round trip time generally refers a total amount of time for a message or a packet to travel from a first node to a second node and then back to the first node. However, such round trip time may be inaccurate and affected by various factors such as network fluctuations, packet types, and the like. Accordingly, the techniques disclosed herein improve network mapping and generate network topologies based on, for example, statistical latency distributions (e.g., response times) for messages exchanged between nodes/devices in the network.

Notably, as used herein, the term “latency” or “latency value” generally refers to a response time for messages exchanged between nodes in a communication network; the term “packet” generally refers to messages or data exchanged between the nodes in a communication network; and the terms “paired” or “pair-wise” generally refers to a two-way exchange—e.g., one exchange representing packets sent from a first node and received by a second node, and another exchange representing packets sent from the second node and received by the first node.

According to the network monitoring and/or the network mapping technique disclosed herein, a monitoring device (or module) such as a switch, router, edge device, or other network device, determines communication latency or paired response times between nodes in a communication network from statistical latency distributions for all messages or packets exchanged between the nodes. More specifically, in some embodiments, the monitoring device determines communication latency for paired response times between nodes (e.g., from time stamp data associated with each message or packet exchanged between nodes). In certain embodiments, the monitoring device may be part of a distributed monitoring system, including a number of remote monitoring devices/nodes (e.g., located at edge switches in a network). These remote monitoring devices/nodes may be configured to time stamp messages or packets exchanged between the nodes in the network (e.g., on receipt, on transmission, etc.). Based on the time stamp data for each message, the monitoring device can determine latency distributions between pairs of nodes, and further determine representative latency values—e.g., mean latency, median latency, and the like. In some embodiments, outlier latency values or “bad” packet response times in a latency distribution may be eliminated or removed so as to avoid skewing the representative latency values (e.g., for initial network topology mapping). However, in other embodiments, these outlier latency values may be used to identify and troubleshoot network issues—e.g., according policies of the communication network and/or according to thresholds and/or deviations in a latency distribution. The network monitoring device further determines a node topology for the nodes in the communication network, consistent with the representative latency values, and generates a graph showing the node topology, including communication links annotated with corresponding representative latency values.

Illustratively, these techniques may be performed by hardware, software, and/or firmware, such as in accordance with the “monitoring” process 244 and/or “network topology” process 248, which may contain computer executable instructions executed by the processor 220 (or independent processor of interfaces 210) to perform certain functions.

FIG. 3 illustrates schematic diagrams of a pair of nodes exchanging messages or packets. For example, as shown, FIG. 3 includes a diagram 301 and a diagram 302 which collectively show messages exchanged between a node A and a node B. More specifically, diagram 301 shows a node A sending a packet 305 to a node B, and diagram 302 shows node B sending a packet 306 to node A. The exchange shown in diagram 301 and diagram 302 may be used to determine one or more paired latency values and/or paired latency distributions for communications between nodes—e.g., node A and node B.

As shown in FIG. 3, node A and node B are also configured to include respective monitoring modules 310 and 311. Notably, monitoring modules 310 and 311 may be part of a larger distributed monitoring device/system, and may send information related to packet tracking, time stamps, latency, and the like, to a remote module/device for further processing (or storage). In addition, monitoring modules 310 and 311 may be configured to execute one or more processes, such as monitoring process 244 and/or network topology process 248 (discussed above). It is appreciated that FIG. 3 and discussion herein are provided for purposes of exemplary embodiments, which are not to be limited to a particular protocol (e.g., transport layer protocol TCP, etc.).

Operatively, monitoring modules 310 and 311 in respective node A and node B time stamp “TS” packets on transmission and on reception. For example, in diagram 301, monitoring module 310 time stamps a packet 305 at 0t when node A sends packet 305 to node B. Similarly, monitoring module 311 time stamps packet 305 on reception by node B at 10t. With respect to tracking the time stamps and time stamp data for an exchange between nodes—here, TS=0t and TS=10t—monitoring modules 310 and/or 311 operably associate and/or assign respective time stamps with/to packet 305 based on one or more unique message identifiers. For example, unique message identifiers can include a sequence number (SEQ: 1) (shown in FIG. 3), a packet header, packet type, packet size, payload data, a byte size data, acknowledge (ACK) data or identifier, and the like. In this fashion, monitoring module 310 and/or monitoring module 311 determine a response time or latency value for packet 305 by comparing time stamps associated with packet 305 and determining a time difference there-between—e.g., a time difference between 0t and 10t yields a total latency value of 10t.

In some embodiments, monitoring modules 310 and/or 311 (or a remote monitoring device) employ statistical algorithms to classify each packet according to a particular attribute (e.g., a packet type) and determine attribute specific latency values. In this manner, latency and latency distributions between nodes can be determined with granularity (e.g., specific to packet attributes, etc.)

In diagram 302, monitoring module 311 time stamps packet 306 at 3t, and sends packet 306 to node A. Monitoring module 310 time stamps packet 306 on reception by node A at 12t. As shown in diagram 302, monitoring modules 310 and 311 associate or assign respective time stamps for packet 306 with a sequence number—SEQ: 2. As with diagram 301 (discussed above), a latency value or response time for packet 306 may be determined by a comparing respective time stamps associated with packet 306—e.g., a time difference between 3t and 12t yields a total latency value of 9t.

Packets 305 and 306 are tracked by monitoring modules 310 and 311 and associated with a paired latency value or paired response time for communications between node A and node B. Specifically, time stamps associated with each packet are analyzed to determine paired latency values. Further, these paired latency values may be analyzed according to a latency distribution graph. For example, one or more statistical algorithms may be employed to generate a latency distribution, and representative latency values may be derived from such latency distribution. For example, some representative latency values include an average or median latency or response time between node A and node B. Further, as mentioned, an average or median latency can be determined from all packets exchanged between pairs of nodes, and/or according to certain packet attributes.

Although FIG. 3 illustrates multiple monitoring modules—here, monitoring module 310 and 311—it is appreciated that a single monitoring module or device may be employed (e.g., monitoring traffic on the communication link between node A and node B, and/or any additional number of monitoring modules or devices may be used as appropriate. Further, although FIG. 3 illustrates a direct communication link between node A and node B, it is appreciated that any number of nodes or hops may be present and that the view shown herein in for purposes of illustration, not limitation.

FIG. 4 illustrates two graphs, here 401 and 402, showing latency values (or response times) (ms) for messages exchanged between node A and node B over a time period (e.g., an hour, a day, a week, a month, etc.). More specifically, graph 401 illustrates raw data points corresponding to a paired response time for packets exchanged between node A and node B. Graph 402 illustrates a statistical distribution or a latency distribution of the raw paired response times. Notably, as is appreciated by those skilled in the art, a time period shown in graph 402 may represent the same time period shown in graph 401, or it may only represent only a portion thereof. Further, as shown in graph 402, the raw paired response times over the time period conform to a log-normal distribution. Further, as shown in graph 402, the latency distribution includes a center line (μ) having one or more standards of deviation (μ+/−σ, μ+/−2σ, etc.) spaced apart on both sides. In some embodiments, the center line (μ) may represent latency values corresponding to a mean response time, a median response time, and the like. It is further appreciated that various other distribution curves or other distribution analysis may be used as appropriate (e.g., mean lines, bell-curve distributions, and the like).

In addition, as mentioned above, the latency distribution shown in graph 402 may also indicate one or more outlier latency values, which can be determined according to policies of the communication network and/or according to pre-determined thresholds. For example, certain outlier latency values may result from dropped packets, internal device buffering, or other network conditions not relevant to an initial network topology mapping. Accordingly, in some embodiments, these outlier latency values may be eliminated from an initial latency analysis or calculation since the outlier latency values may improperly skew representative latency value determinations. Notably, however, these outlier latency values may be important for subsequent network analysis and/or network troubleshooting. For example, these outlier latency values may indicate communications issues amongst nodes—e.g., when a measured response time is (statistically) greater than a median response time, a mean response time, and the like. Moreover, the latency distribution shown in graph 402, including the representative latency value (μ), may be used to annotate paired latency values for communication links between nodes, as shown in FIGS. 5-8.

In particular, FIG. 5 illustrates latency charts 501, 502, and 503, showing paired latency values for messages or packets exchanged between nodes 510, 515, and 520. Preferably, these paired latency values are determined from latency distributions, as discussed above (e.g., Nt+/−σ, etc.). As shown, latency chart 501 indicates a paired latency value between node 510 and 515 at 10t, latency chart 502 indicates a paired latency value between nodes 510 and 520 at 20t, and latency chart 503 indicates a paired latency value between nodes 520 and 515 at 10t.

Next to each latency chart, potential network topologies are shown. The potential network topologies represent possible network configurations, with certain communication links marked with an “x” to represent an inconsistency with the paired latency values shown in latency charts 501, 502, and 503 and/or an inconsistency with a threshold tolerance. For example, a network topology conforming to latency chart 501 includes a communication link or connection between node 510 and node 515, having an annotated latency value of 10t. However, multiple network topologies potentially conform to paired latency chart 502 (and remain consistent with latency chart 501). Here, one potential network topology includes a direct communication link or connection between node 510 and node 520 (with an annotated latency value of 20t), and another potential network topology includes node 515 disposed between node 510 and node 520, including corresponding communication links. Notably, the potential network topology including node 515 disposed between node 510 and node 520 includes an unknown latency value (marked as “??”) for the communication link between node 515 and node 520. Further latency information from latency chart 503 resolves the unknown latency value. Alternatively, or in addition, latency distribution information may also resolve ambiguity between multiple potential network topologies. For example, referring to the topology shown next to latency chart 503, assume a latency of 20t for direct communications between node 510 and node 520 represents an outlier latency value and/or a latency value outside a threshold tolerance. In this example, the direct communication link between node 510 and node 520 is marked with an X since the latency value of 20t is an outlier/outside tolerance. Further, the remaining latency value shown in latency chart 503 provides the previously unknown latency value as 10t, which validates the network topology having node 515 disposed between node 510 and node 520. Thus, the network topology consistent with the latency charts 501, 502, and 503, and latency distribution information (e.g., excluding outliers and/or response times outside of thresholds, etc.), includes node 515 disposed between nodes 510 and 520, with communication links there-between.

FIG. 6 illustrates a network topology 600, showing the node topology for nodes 510, 515, and 520, as well as a larger node topology for other nodes in the communication network. In particular, network topology 600 is derived from paired latency charts such as those shown in FIG. 5, as well as an analysis of latency distributions for communications between each of the nodes. Preferably, node topology 600 shows annotated communication links between representing latency values or response times for packets exchanged between the nodes. These latency values, as discussed above, may represent an average or median latency value for all packets exchanged between two corresponding nodes, and/or for packets having particular attributes.

FIG. 7 also illustrates exemplary latency charts similar to those shown in FIG. 5. Here, FIG. 7 includes latency charts 701, 702, and 703, showing paired latency values for packets exchanged between nodes 710, 715, and 720. In particular, latency chart 701 shows a paired latency value between node 710 and 715 at 10t, latency chart 702 shows a paired latency value between nodes 710 and 720 at 18t, and latency chart 703 shows a paired latency value between nodes 720 and 715 at 10t. As discussed above, the paired latency values in paired latency charts 701, 702, and 703 may be determined from latency distributions (e.g., Nt+/−σ, etc.) of response times for messages exchanged between the nodes. Further, similar to FIG. 5, FIG. 7 provides potential network topologies next to respective latency charts.

As shown, a network topology conforming to latency chart 701 includes a communication link between node 710 and node 715, having an annotated latency value of 10t. Multiple network topologies are possible consistent with latency chart 702 (and consistent with latency chart 701). As shown, one potential network topology includes a direct link or direct connection between node 710 and node 720, having an annotated latency value of 18t, and another potential network topology includes node 715 disposed between node 710 and node 720, having an unknown latency value “??” for the communication link connecting node 715 and node 720.

Additional latency distribution information and/or additional latency values (e.g., latency chart 703) may resolve ambiguity between the potential network topologies. Specifically, latency chart 703 indicates a latency value for communications between nodes 715 and 720 at 10t, which invalidates the network topology having node 715 disposed between nodes 710 and 720. Put differently, the node topology having node 715 disposed between nodes 710 and 720 results in a total latency value of 20t from an aggregation of (10t) between 710-715 and (10t) between 715 and 720, while the latency value between nodes 710 and 720 is only 18t. In this fashion, the network topology, showing node 715 disposed between node 710 and 720, is in consistent with the latency values shown in latency chart 703. Thus, the network topology consistent with the latency charts 701, 702, and 703, includes a direct communication link between node 710 and node 720, a direct communication link between node 720 and node 715, and a direct communication link between node 715 and node 710. Notably, in this example, the additional latency distribution information such as indications of outlier response times, thresholds, and the like, was not employed to determine the appropriate network topology.

FIG. 8 illustrates a network topology 800, showing the node topology for nodes 710, 715, and 720, as well as a broader node topology of other nodes in the communication network. Network topology 800 is preferably derived, in part, from paired latency values (e.g., latency charts 701, 702, 703), and/or from an analysis of latency distributions for communications between the nodes. As shown, node topology 800 includes annotated communication links representing latency values or response times between the nodes. The latency values, as discussed above, may represent an average or median response time for all packets exchanged between two corresponding nodes, and/or, in some embodiments, the latency values may represent response times for certain types of packets.

FIGS. 5-8 collectively illustrate example node topologies determined from latency distributions, tolerances, thresholds, and the like. The example node topologies shown in FIGS. 5-8, including the illustrated orientations, latency values, and the like, are provided for purposes of discussion, not limitation. It is appreciated that various types of node topologies, orientations, latency values, and the like, may be used as appropriate.

FIG. 9 illustrates an example simplified procedure 900 for mapping network topologies in a communication network (e.g., a data center network), in accordance with one or more embodiments described herein. As shown, procedure 900 is shown from the view of a monitoring node/device in the data center (e.g., a switch, a hypervisor, a router, a virtual machine, etc.).

Procedure 900 begins at step 905 and continues to step 910, where, as described in greater detail above, the monitoring device (or node) monitors messages or packets exchanged between nodes in a communication network (e.g., a data center network). For purposes of discussion, the monitoring device particularly monitors messages exchanged between, for example, a first node, a second node, and a third node.

Procedure 900 continues to step 915, where the monitoring device determines one or more latency distributions for paired response times corresponding to the messages exchanged between the nodes. For example, the one or more latency distributions can include a first latency distribution corresponding to response times between the first node and the second node, a second latency distribution corresponding to response times between the first node and the third node, and a third latency distribution corresponding to response times between the second node and the third node.

The monitoring device also determines, at step 920, a node topology consistent with the one or more latency distributions—here, the first latency distribution, the second latency distribution, and the third latency distribution—and generates, at step 925, a graph of a node topology showing one or more communication links between the nodes.

With respect to determining the node topology, in some embodiments, the monitoring device may compare, aggregate, or otherwise analyze the latency distributions to determine relative positions for each node in the communication network. Further, as discussed above, the latency distributions may be refined according to tolerances and/or thresholds to eliminate certain response times (e.g., outliers, outside thresholds, etc.), which certain response times may improperly skew initial node topology mapping (e.g., skew median/mean lines in the corresponding latency distributions).

Preferably, the monitoring device annotates, at step 930, each communication link with a representative response time or latency value. For example, the representative response time may include a mean response time, a median response time, or other measures of a response time from the corresponding latency distribution.

It should be noted that while certain steps within procedure 900 may be optional, and further, the steps shown in FIG. 9 are merely examples for illustration—certain other steps may be included or excluded as desired. Further, while a particular order of the steps is shown, this ordering is merely illustrative, and any suitable arrangement of the steps may be utilized without departing from the scope of the embodiments herein.

The techniques described herein, therefore, provide for monitoring and mapping network topologies in a communication network (e.g., a data center network) based on statistical analysis of response times or latency between pairs of nodes. The techniques described herein provide simple solutions to determine latency based on time stamped values, which can be assigned by network devices such as an edge switch, router, and the like.

While there have been shown and described illustrative embodiments to determine latency distributions amongst pairs of network nodes, network topology mapping, and the like, it is to be understood that various other adaptations and modifications may be made within the spirit and scope of the embodiments herein. For example, the embodiments have been shown and described herein using response times in factors of a generic time (t), however it is appreciated that latency or response times may be measured in specific fractions, or portions of seconds (e.g., milliseconds, microseconds, etc.) or other appropriate measures of time.

The foregoing description has been directed to specific embodiments. It will be apparent; however, that other variations and modifications may be made to the described embodiments, with the attainment of some or all of their advantages. For instance, it is expressly contemplated that the components and/or elements described herein can be implemented as software being stored on a tangible (non-transitory) computer-readable medium, devices, and memories (e.g., disks/CDs/RAM/EEPROM/etc.) having program instructions executing on a computer, hardware, firmware, or a combination thereof. Further, methods describing the various functions and techniques described herein can be implemented using computer-executable instructions that are stored or otherwise available from computer readable media. Such instructions can comprise, for example, instructions and data which cause or otherwise configure a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. Portions of computer resources used can be accessible over a network. The computer executable instructions may be, for example, binaries, intermediate format instructions such as assembly language, firmware, or source code. Examples of computer-readable media that may be used to store instructions, information used, and/or information created during methods according to described examples include magnetic or optical disks, flash memory, USB devices provided with non-volatile memory, networked storage devices, and so on. In addition, devices implementing methods according to these disclosures can comprise hardware, firmware and/or software, and can take any of a variety of form factors. Typical examples of such form factors include laptops, smart phones, small form factor personal computers, personal digital assistants, and so on. Functionality described herein also can be embodied in peripherals or add-in cards. Such functionality can also be implemented on a circuit board among different chips or different processes executing in a single device, by way of further example. Instructions, media for conveying such instructions, computing resources for executing them, and other structures for supporting such computing resources are means for providing the functions described in these disclosures. Accordingly this description is to be taken only by way of example and not to otherwise limit the scope of the embodiments herein. Therefore, it is the object of the appended claims to cover all such variations and modifications as come within the true spirit and scope of the embodiments herein.

Claims

1. A method, comprising: monitoring, by a monitoring device in a communication network, messages exchanged between at least a first node, a second node, and a third node;determining, based on time stamp data associated with each message, one or more latency distributions of paired response times between the first node, the second node, and the third node, the one or more latency distributions include at least a first latency distribution corresponding to response times between the first node and the second node, a second latency distribution corresponding to response times between the first node and the third node, and a third latency distribution corresponding to response times between the second node and the third node;determining a node topology consistent with the first latency distribution, the second latency distribution, and the third latency distribution;generating a graph of the node topology showing one or more communication links between one or more of the first node, the second node, or the third node; andannotating each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the first latency distribution, the second latency distribution, or the third latency distribution.

2. The method of claim 1, wherein determining the node topology further comprises: comparing an aggregated latency distribution of the first latency distribution and the second latency distribution to the third latency distribution to determine a position in the node topology for each of the first node, the second node, and the third node.

3. The method of claim 2, further comprising: determining the second node is disposed between the first node and the second node in the node topology when the aggregated latency distribution substantially matches the third latency distribution.

4. The method of claim 1, wherein the monitoring device includes a plurality of distributed monitoring modules operable by one or more of the first node, the second node, and the third node.

5. The method of claim 4, further comprising: receiving, by the monitoring device, the time stamp data associated with each message from the plurality of monitoring modules.

6. The method of claim 1, further comprising: determine, by the monitoring device, the time stamp data associated with each message based on a unique message identifier, andwherein, determining the one or more latency distributions, further comprises determining, based on the time stamp data associated with each message and the unique identifier associated with each message, the one or more latency distributions of paired response times for the messages exchanged between the first node, the second node, and the third node.

7. The method of claim 6, wherein the unique message identifier includes at least one of a packet header, a sequence number, an acknowledgement number, a type, or a size of the message.

8. The method of claim 1, wherein the first latency distribution represents a first paired response time distribution for the messages exchanged between the first node and the second node, the second latency distribution represents a second paired response time distribution for the messages exchanged between the first node and the third node, and the third latency distribution represents a third paired response time distribution for the messages exchanged between the second node and the third node.

9. The method of claim 1, further comprising: determining at least one of the average response time or the median response time for each latency distribution, including the first latency distribution, the second latency distribution, and the third latency distribution, andwherein, determining the node topology further comprises determining the node topology consistent with the at least one of the average response time or the median response time for each latency distribution.

10. The method of claim 1, wherein determining the node topology, further comprises: identifying one or more outlier response times in each latency distribution, including the first latency distribution, the second latency distribution, and the third latency distribution;removing the one or more outlier response times from each latency distribution; andgenerating the at least one of the median response time or the mean response time for each latency distribution after removing the one or more outlier response times.

11. The method of claim 1, wherein at least one of the first node, the second node, or the third node includes one of a virtual machine, a hypervisor, a switch, or a router.

12. A monitoring device, comprising: one or more network interfaces to communicate within a communication network;a processor coupled to the network interfaces and adapted to execute one or more processes; anda memory configured to store a process executable by the processor, the process when executed operable to: monitor messages exchanged in the communication network between at least a first node, a second node, and a third node;determine, based on time stamp data associated with each message, one or more latency distributions of paired response times between the first node, the second node, and the third node, the one or more latency distributions include at least a first latency distribution corresponding to response times between the first node and the second node, a second latency distribution corresponding to response times between the first node and the third node, and a third latency distribution corresponding to response times between the second node and the third node;determine a node topology consistent with the first latency distribution, the second latency distribution, and the third latency distribution;generate a graph of the node topology showing one or more communication links between one or more of the first node, the second node, or the third node; andannotate each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the first latency distribution, the second latency distribution, or the third latency distribution.

13. The monitoring device of claim 12, wherein the process, when executed to determine the node topology, is further operable to: compare an aggregated latency distribution of the first latency distribution and the second latency distribution to the third latency distribution to determine a position in the node topology for each of the first node, the second node, and the third node.

14. The monitoring device of claim 13, wherein the process, when executed, is further operable to: determine the second node is disposed between the first node and the second node in the node topology when the aggregated latency distribution substantially matches the third latency distribution.

15. The monitoring device of claim 12, further comprising: a plurality of distributed monitoring modules operable by one or more of the first node, the second node, and the third node, andwherein, the process, when executed, is further operable to receive the time stamp data associated with each message from the plurality of monitoring modules.

16. The monitoring device of claim 12, wherein the process, when executed, is further operable to: determine the time stamp data associated with each message based on a unique message identifier, andwherein, the process to determine the one or more latency distributions, when executed, is further operable to determine, based on the time stamp data associated with each message and the unique identifier associated with each message, the one or more latency distributions of paired response times for the messages exchanged between the first node, the second node, and the third node.

17. The monitoring device of claim 16, wherein the unique message identifier includes at least one of a packet header, a sequence number, an acknowledgement number, a type, or a size of the message.

18. The monitoring device of claim 12, wherein the process, when executed, is further operable to: determine at least one of the average response time or the median response time for each latency distribution, including the first latency distribution, the second latency distribution, and the third latency distribution, andwherein, the process to determine the node topology, when executed, is further operable to determine the node topology consistent with at least one of the average response time or the median response time for each latency distribution.

19. The monitoring device of claim 12, wherein the process to determine the node topology, when executed, is further operable to: identify one or more outlier response times in each latency distribution, including the first latency distribution, the second latency distribution, and the third latency distribution;remove the one or more outlier response times from each latency distribution; andgenerate the at least one of the median response time or the mean response time for each latency distribution after removing the one or more outlier response times.

20. A tangible, non-transitory, computer-readable media having software encoded thereon, the software, when executed by a processor, operable to: monitor messages exchanged in the communication network between at least a first node, a second node, and a third node;determine, based on time stamp data associated with each message, one or more latency distributions of response times between the first node, the second node, and the third node based on time stamp data associated with each message, the one or more latency distributions include at least a first latency distribution corresponding to response times between the first node and the second node, a second latency distribution corresponding to response times between the first node and the third node, and a third latency distribution corresponding to response times between the second node and the third node;determine a node topology consistent with the first latency distribution, the second latency distribution, and the third latency distribution;generate a graph of the node topology showing one or more communication links between one or more of the first node, the second node, or the third node; andannotate each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the first latency distribution, the second latency distribution, or the third latency distribution.