Abstract: A technique includes determining a network interface aggregation information for a given network device. Determining the aggregation includes determining whether the network device is capable of providing first data identifying an aggregation and selectively inferring the aggregation based at least in part on other data if a determination is made that the network device is incapable of providing the first data.

Abstract: A network topology may be determined based on flow data exported from a network. A topology generator analyzes flow data and determines a topology based on devices and connections between the devices indicated in the flow data. The topology generator may also infer types of the devices based on communication protocols and port numbers used by the devices. The topology generator may continually update the topology as additional flow data is exported from devices in the network and analyzed. As a result, the topology reflects a current status of devices in the network based on the communications indicated in the additional flow data. The topology generator may also retrieve flow data from a specified time period or flow data related to a specified device to generate topologies that are targeted for analysis or troubleshooting of a particular network issue.

Abstract: To avoid inflated measurements, a flow data analyzer can select a single source of flow data to use when determining network traffic measurements for a given host. By selecting a single source of flow data, the flow data analyzer reduces the chance of redundant flow data causing inflated measurements. To select a flow data source for a host, the flow data analyzer analyzes flow data received from network devices and selects a network device based on a flow data source criterion. Examples of a flow data source criterion include a network device's sample rate or an amount of flow data for the host captured by the network device. Once a flow data source is selected, the flow data analyzer uses flow data generated by the selected source. The flow data analyzer may select a different flow data source for each host being monitored by the network manager.

Abstract: A technique includes determining a network interface aggregation information for a given network device. Determining the aggregation includes determining whether the network device is capable of providing first data identifying an aggregation and selectively inferring the aggregation based at least in part on other data if a determination is made that the network device is incapable of providing the first data.

Abstract: A system and method for managing overlapping address domains are described herein. The method includes receiving, at a global network node management system, communications from a plurality of tenants within a network address translation (NAT) environment, wherein each of the plurality of tenants includes a group of network devices with non-overlapping internet protocol (IP) addresses. The method also includes tracking, via the global network node management system, a state of the NAT environment based on the communications.