Method and system for managing a distributed network of network monitoring devices

Abstract

Network traffic information for nodes of a first logical hierarchy is stored at a monitoring device according to ranks of the nodes within the logical hierarchy as determined by each node's position therein and user preferences. At least some of the network traffic information stored at the network monitoring device may then be reported to another network monitoring device, where it can be aggregated with similar information from other network monitoring devices. Such reporting may occur according to rankings of inter-node communication links between nodes of different logical hierarchies of monitored nodes.

1 . A network monitoring system comprising:
 a plurality of network monitoring devices that monitor network traffic data from a plurality of nodes of a network, each network monitoring device being configured to collect network traffic data from an assigned subset of the nodes in the network, and   a central network monitoring device that is configured to receive at least a portion of the network traffic data collected by the network monitoring devices;   wherein at least one of the network monitoring devices is configured to select fewer nodes than its assigned subset of nodes for collecting network traffic data, based on a capacity of the network monitoring device and a priority associated with each node of its assigned subset of nodes.   
     
     
         2 . The network monitoring system of  claim 1 , wherein the priority associated with at least one of the nodes is based on a number of network monitoring devices that provide network traffic data associated with this node to the central network monitoring device. 
     
     
         3 . The network monitoring system of  claim 1 , wherein each subset of assigned nodes includes a root node, each of the nodes of the subset being hierarchically related to the root node, and the priority associated with each node is based on a hierarchical distance of the node from the root node. 
     
     
         4 . The network monitoring system of  claim 1 , wherein each subset of assigned nodes includes leaf nodes and branch nodes arranged in a hierarchy, and the priority associated with each branch node is based on a hierarchical distance of the branch node from a hierarchically-closest leaf node. 
     
     
         5 . The network monitoring system of  claim 1 , wherein the priority associated with each link between nodes is dependent upon a number of network monitoring devices that provide network traffic data associated with each node of the link to the central network monitoring device. 
     
     
         6 . The network monitoring system of  claim 1 , wherein the central network monitoring device controls the portion of the network traffic data received from the network monitoring devices based on a capacity of the central network monitoring device and a priority associated with links between the nodes in the network. 
     
     
         7 . The network monitoring system of  claim 1 , wherein each subset of assigned nodes includes a root node, each of the nodes of the subset being hierarchically related to the root node, and the priority associated with each link is based on a hierarchical distance of each node of the link from its root node. 
     
     
         8 . The network monitoring system of  claim 1 , wherein each subset of assigned nodes includes leaf nodes and branch nodes arranged in a hierarchy, and the priority associated with each link is based on a hierarchical distance of each node of the link from a hierarchically-closest leaf node, the hierarchical distance of a leaf node from a hierarchically-closest leaf node being zero. 
     
     
         9 . A method comprising:
 assigning, via a central monitoring device, a subset of nodes in a network to each of a plurality of network monitoring devices that are configured to monitor network traffic data of the assigned subset of nodes,   selecting, at at least one network monitoring device, fewer nodes to monitor than its assigned subset of nodes, based on a capacity of the at least one network monitoring device and a priority associated with each node of its assigned subset of nodes, and collecting network traffic data from the selected fewer nodes,   receiving, at the central monitoring device, at least a portion of the network traffic data collected by the plurality of network monitoring devices, and   reporting, by the central monitoring device, one or more statistics based on the received network traffic data.   
     
     
         10 . The method of  claim 9 , wherein the priority associated with at least one of the nodes is based on a number of network monitoring devices that provide network traffic data associated with this node to the central network monitoring device. 
     
     
         11 . The method of  claim 9 , wherein each subset of assigned nodes includes a root node, each of the nodes of the subset being hierarchically related to the root node, and the priority associated with each node is based on a hierarchical distance of the node from the root node. 
     
     
         12 . The method of  claim 9 , wherein each subset of assigned nodes includes leaf nodes and branch nodes arranged in a hierarchy, and the priority associated with each branch node is based on a hierarchical distance of the branch node from a hierarchically-closest leaf node. 
     
     
         13 . The method of  claim 9 , including selecting, by the central network monitoring device, the portion of the network traffic data to be received from the network monitoring devices based on a capacity of the central network monitoring device and a priority associated with links between the subsets of nodes in the network. 
     
     
         14 . The method of  claim 13 , wherein the priority associated with each link between subsets is dependent upon a number of network monitoring devices that provide network traffic data associated with each node of the link to the central network monitoring device. 
     
     
         15 . The method of  claim 13 , wherein each subset of assigned nodes includes a root node, each of the nodes of the subset being hierarchically related to the root node, and the priority associated with each link is based on a hierarchical distance of each node of the link from its root node. 
     
     
         16 . The method of  claim 13 , wherein each subset of assigned nodes includes leaf nodes and branch nodes arranged in a hierarchy, and the priority associated with each link is based on a hierarchical distance of each node of the link from a hierarchically-closest leaf node, the hierarchical distance of a leaf node from a hierarchically-closest leaf node being zero. 
     
     
         17 . A non-transitory computer readable medium that includes a computer program that, when executed at a network monitoring device, causes the device to:
 receive an assignment of a subset of nodes in a network to monitor for network traffic data,   select fewer nodes to monitor than the assigned subset of nodes, based on a capacity of the network monitoring device and a priority associated with each node of its assigned subset of nodes,   collect network traffic data from the selected fewer nodes, and   communicate at least a portion of the collected network traffic data to a central monitoring device.   
     
     
         18 . The medium of  claim 17 , wherein the priority associated with at least one of the nodes is based on a number of other network monitoring devices that provide network traffic data associated with this node to the central network monitoring device. 
     
     
         19 . The medium of  claim 17 , wherein the subset of assigned nodes includes a root node, each of the nodes of the subset being hierarchically related to the root node, and the priority associated with each node is based on a hierarchical distance of the node from the root node. 
     
     
         20 . The medium of  claim 17 , wherein the subset of assigned nodes includes leaf nodes and branch nodes arranged in a hierarchy, and the priority associated with each branch node is based on a hierarchical distance of the branch node from a hierarchically-closest leaf node. 
     
     
         21 . A non-transitory computer readable medium that includes a computer program that, when executed at a central monitoring device, causes the device to:
 assign a subset of nodes of a network to each of a plurality of network monitoring devices, each network monitoring device being configured to collect network traffic data from the subset of nodes, and   receive a portion of the network traffic data from the network monitoring devices based on a capacity of the central network monitoring device and a priority associated with links between the subsets of nodes.   
     
     
         22 . The medium of  claim 21 , wherein the priority associated with each link between subsets is dependent upon a number of network monitoring devices that provide network traffic data associated with each node of the subset to the central network monitoring device. 
     
     
         23 . The medium of  claim 21 , wherein each subset of assigned nodes includes a root node, each of the nodes of the subset being hierarchically related to the root node, and the priority associated with each link is based on a hierarchical distance of each node of the link from its root node. 
     
     
         24 . The medium of  claim 21 , wherein each subset of assigned nodes includes leaf nodes and branch nodes arranged in a hierarchy, and the priority associated with each link is based on a hierarchical distance of each node of the link from a hierarchically-closest leaf node, the hierarchical distance of a leaf node from a hierarchically-closest leaf node being zero.