Abstract: Embodiments described herein generally involve identifying workloads in a multi-site networking environment. Embodiments include determining that a given network is stretched across a first network segment at a first site and a second network segment at a second site. Embodiments include creating a stretched administrative domain for the given network and mapping an address of the given network to the stretched administrative domain in a lookup table for an administrative domain associated with the first network segment. Embodiments include receiving a flow record from an observation point in the first network segment, the flow record having a source IP address associated with the second network segment and a destination IP address associated with the first network segment. Embodiments include identifying a source workload and destination workload of the flow record using the lookup table and a workload identification table that maps combinations of IP addresses and administrative domains to workloads.

Abstract: Embodiments for identifying workloads in a networking environment based on a flow record from an observation point are described. One embodiment of a method includes receiving network data from an endpoint in the networking environment, determining a plurality of administrative domains within the networking environment, and generating observation point mapping information that maps each observation point within the networking environment to one of the plurality of administrative domains. Some embodiments include generating a plurality of lookup tables, where a first lookup table is associated with a first administrative domain and where the first administrative domain corresponds to an L2 network that is disconnected from any router in the networking environment.

Abstract: Example methods and systems for packet flow monitoring are described. In one example, a first computer system may detect a flow of packets along a datapath between a source and a destination and determine source attribute information associated with the source and destination attribute information associated with the destination. The first computer system may perform attribute-to-identifier mapping by (a) mapping the source attribute information to a source identifier having a reduced size compared to the source attribute information, and/or (b) mapping the destination attribute information to a destination identifier having a reduced size compared to the destination attribute information.

Abstract: An example method of identifying a hybrid connection associated with a network flow in a multi-cloud computing system includes: obtaining, by a network analyzer, network information from a plurality of data centers in the multi-cloud computing system, the plurality of data centers corresponding to a respective plurality of namespaces; identifying Internet Protocol (IP) subnetworks associated with the hybrid connection from the network information; generating connection indexes for the namespaces relating source IP subnetworks of the IP subnetworks, destination IP subnetworks of the IP subnetworks, and an identifier for the hybrid connection; searching a source IP address and a destination IP address of a flow record for the network flow in the connection indexes to obtain the identifier for the hybrid connection; and tagging the flow record with the identifier for the hybrid connection.

Abstract: Embodiments described herein generally involve identifying workloads in a multi-site networking environment. Embodiments include determining that a given network is stretched across a first network segment at a first site and a second network segment at a second site. Embodiments include creating a stretched administrative domain for the given network and mapping an address of the given network to the stretched administrative domain in a lookup table for an administrative domain associated with the first network segment. Embodiments include receiving a flow record from an observation point in the first network segment, the flow record having a source IP address associated with the second network segment and a destination IP address associated with the first network segment. Embodiments include identifying a source workload and destination workload of the flow record using the lookup table and a workload identification table that maps combinations of IP addresses and administrative domains to workloads.