Presenting data regarding grouped flows

Abstract

Some embodiments provide a novel method for receiving a plurality of attribute sets from a set of host computers, each attribute set associated with a group of one or more flows that is created by using a key to associate individual flows into the group of flows. The appliance, in some embodiments, merges two identified attribute sets into one merged attribute set and analyzes the merged attribute set to identify a set of properties of the flows in the groups of flows associated with the two attribute sets. In some embodiments, a visualization process includes identifying machines as members of groups and identifying machines that are connected. The visualization process, in some embodiments, also generates a graphical user interface that can be used to select groups of machines, domains, or individual machines and displays contextual attributes relevant to the selected group, domain, or machine.

1 - 17 . (canceled) 
     
     
         18 . A method for analyzing attributes of data flows associated with a set of machines executing on a set of host computers, the method comprising:
 providing definitions of keys to the set of host computers to use to associate individual flows into groups of flows, each host computer in the set identifying for each group of flows a set of attributes;   analyzing sets of attributes collected from the host computers for the identified groups of flows;   in response to the analysis, generating at least one new definition for at least one new key to provide the set of host computers to use to associate individual flows into one new group of flows.   
     
     
         19 . The method of  claim 18  further comprising providing, with the new definition of the new key, instructions to each host computer in the set of host computers to discard a prior key. 
     
     
         20 . The method of  claim 19 , wherein generating the definition of the new key comprising:
 selecting the prior key; and   modifying the definition of the prior key.   
     
     
         21 . The method of  claim 20  further comprising generating a definition of another new key by modifying the definition of the prior key and providing this other new key to the set of host computers. 
     
     
         22 . The method of  claim 19 , wherein the new key specifies an attribute to include in the set of attributes that was not included in the set of attributes based on the discarded prior key. 
     
     
         23 . The method of  claim 19 , wherein the new key does not specify at least one attribute to include in the set of attributes that was specified in the discarded prior key. 
     
     
         24 . The method of  claim 19 , wherein associating individual flows into groups of flows comprises generating for each group of flows a key value that is used to identify the individual flows that are grouped into the group of flows, a key value comprising a set of attribute values for each attribute in a set of attributes specified by an associated key. 
     
     
         25 . The method of  claim 18 , wherein each host computer uses the new key to identify the new group of flows, to collect a set of attributes for the new group, and to provide the collected set of attributes for the new group for analysis. 
     
     
         26 . The method of  claim 18 , wherein at least one particular key specifies at least one condition that must be met for an attribute value of an individual flow in order for the individual flow to be grouped into a group of flows. 
     
     
         27 . The method of  claim 26 , wherein the condition specifies at least one range of values for the attribute value. 
     
     
         28 . The method of  claim 18 , wherein at least one particular key specifies at least one condition that must not be met for an attribute value of an individual flow in order for the individual flow to be grouped into a group of flows. 
     
     
         29 . The method of  claim 28 , wherein the condition specifies a plurality of attribute values, wherein individual flows comprising any of the specified plurality of attribute values are not grouped into any group of flows for the key. 
     
     
         30 . The method of  claim 18 , wherein at least one particular key specifies that a set of values for a particular attribute are considered equivalent when identifying, for an individual flow, a group of flows. 
     
     
         31 . The method of  claim 30 , wherein the set of values is a first set of values and is specified by specifying a second set of values that are not in the first set. 
     
     
         32 . The method of  claim 31 , wherein at least one of the first and second sets is specified using at least one range of values. 
     
     
         33 . The method of  claim 18 , wherein at least one particular key specifies a manner of combining, for each attribute, attribute values in each individual flow into a set of attributes for the group of flows. 
     
     
         34 . The method of  claim 33 , wherein for a particular attribute, attribute values are combined by identifying unique values for the attribute in the individual flows in the group of flows. 
     
     
         35 . The method of  claim 33 , wherein for a particular attribute, attribute values are combined by concatenating attribute values for the attribute from individual flows in the group of flows. 
     
     
         36 . The method of  claim 33 , wherein for a particular attribute, attribute values are combined by summing the attribute values for the attribute from each individual flow in the group of flows. 
     
     
         37 . The method of  claim 33 , wherein for a particular attribute, attribute values are combined by keeping an extreme attribute value for the attribute from the individual flows in the group of flows.