System and method for data plane signaled packet capture in a service function chaining network

Patent metadata

Field	Value
Publication number	US-10003660-B2
Application number	US-201615056516-A
Country	US
Kind code	B2
Filing date	Feb 29, 2016
Priority date	Feb 29, 2016
Publication date	Jun 19, 2018
Grant date	Jun 19, 2018

Abstract

Presented herein are service-function chaining techniques that enable data plane signaling of a packet as a candidate for capture at various network nodes along a service function path of a service function chain. That is, a capture signal is embedded within the respective packet that carries a user traffic. The signaling occurs in-band, via the data plane, such that classification of the packet for capture beneficially occurs, at the ingress node of the network, once to which subsequent network nodes along a service function path are signaled to capture or further inspect the packet for capture. Service function chaining treats service functions as resources with associated attributes available for scheduled consumption to which selective traffic are steered according to a policy construct to the requisite network-service resources.

First claim

What is claimed is:

1. A method comprising:
in a service function chain network, receiving, at a first network node, a packet to selectively apply, according to one or more policies enforced at the first network node, one or more service functions of a plurality of service functions associated with a plurality of network nodes, wherein the plurality of network nodes comprise one or more devices selected from the group consisting of a router, a network addressor translation (NAT) device, an intrusion prevention system (IPS), an intrusion detection system (IDS), a deep packet inspection (DPI) device, a firewall, a switch, a network-attached storage (NAS) device, a load balancer (LB) system, a wide-area network/local-area network (WAN/LAN) accelerator, a computing device executing a virtual instance of any of the above, and a computing system executing a virtual machine (VM);
receiving, at the first network node, one or more packet capture policies; and
for each of the one or more service function paths selected to be traversed by the received packet, generating, at the first network node, a service function packet having a service function header that encapsulates the received packet, wherein the service function header includes a capture bit in a data-plane portion of the service function header, and wherein the capture bit signals, to the plurality of network nodes along each selected service path, the packet as a candidate for capture.

2. The method of claim 1 , wherein each generated service function packet is transmitted to a plurality of service function forwarders associated with the selected service function path, each service function forwarder being traversed according to an order defining the selected service function path and having forwarded the received network service packet to a corresponding network node associated with the given service function forwarder to apply a service function prior to forwarding the received network service packet to a next service function forwarder, and wherein each service function forwarder is configured to interrogate the capture bit and initiate, upon a presence of a positive capture signal, and capture the encapsulated packet of the service function packet.

3. The method of claim 1 , wherein each generated service function packet is transmitted to a plurality of service function forwarders associated with the selected service function path, each service function forwarder being traversed according to an order defining the selected service function path and having forwarded the received network service packet to a corresponding network node associated with the given service function forwarder to apply a service function prior to forwarding the received network service packet to a next service function forwarder, and wherein each service function forwarder is configured to interrogate the capture bit and initiate, upon a presence of a positive capture signal, and capture the service function packet.

4. The method of claim 3 , wherein, upon a detected presence of a positive capture signal at the capture bit, the service function forwarder being configured to replicate a second service function packet and classifying the replicated second service function packet to a first service function path having a packet capture service function or a second service function path having a deep packet inspection service function.

5. The method of claim 3 , wherein, upon a detected presence of a positive capture signal at the capture bit, the service function forwarder being configured to:
forward the received network service packet to the corresponding network node associated with the given service function forwarder to apply a service function;
replicate a first capture service function packet corresponding to the received network service packet and forward the first capture service function packet to a service function path having a packet capture service function and/or packet analysis service function; and
upon receipt of the received network service packet returning from the corresponding network node, replicate a second capture service function packet corresponding to the returned network service packet and forward the second capture service function packet to the service function path having the packet capture service function and/or packet analysis service function.

6. The method of claim 1 , wherein the service function header includes a base header of a Network Service Header (NSH).

7. The method of claim 3 , wherein the capture bit comprises at least one bit selected from the group consisting of bit 4 , bit 5 , bit 6 , bit 7 , bit 8 , and bit 9 , of the base header of the Network Service Header.

8. The method of claim 1 , wherein the one or more capture policies are selected from the group consisting of per-SFP capture, per-flow in the SFP capture, time capture, and packet count capture.

9. The method of claim 1 , wherein the first network node includes a classifier located at an ingress node of the network.

10. The method of claim 1 , wherein the service function packet generated at the first network node includes a metadata header portion, the metadata header portion comprising a first field specifying a capture format definition and a second field for specifying a capture destination address.

11. The method of claim 1 , wherein the metadata header portion comprises a type-2 metadata header of the Network Service Header.

12. The method of claim 1 , wherein each of the network nodes of the first and second sets of network nodes is configured to interrogate the capture definition data in response to a positive capture indication at the capture position of the interrogated encapsulated header, said network node i) forwarding the received encapsulating header and corresponding encapsulated packet to a next service function forwarder along the service function path and ii) forwarding the encapsulated packet to a network storage specified at the capture destination address.

13. The method of claim 1 , wherein,
at a second network node located, along a service path, downstream to the first network node, modifying the capture bit of the service function header to signal the service function packet as a candidate for capture by one or more third network nodes along the service path.

14. The method of claim 11 , wherein the second network node includes a service function forwarder (SFF) or a service function (SF).

15. A method comprising:
in a service function chain network, receiving, at a service function forwarder of a plurality of service function forwarders, collectively, forming a first service function path, a service function packet, the service function packet having a packet payload encapsulated via a service function header;
interrogating, at the service function forwarder, a capture bit in a data-plane portion of the service function header of the received service function packet, wherein the capture bit signals the received service function packet as a candidate for capture, wherein the received service function packet was generated by a first network node in the service function chain network from a packet received there-at that selectively applied, according to one or more policies enforced at the first network node, one or more service functions of a plurality of service functions associated with the plurality of network nodes, and wherein the plurality of network nodes comprise one or more devices selected from the group consisting of a router, a network addressor translation (NAT) device, an intrusion prevention system (IPS), an intrusion detection system (IDS), a deep pa

Assignees

• Cisco Tech Inc

Inventors

• Furr Richard
• Nainar Nagendra Kumar
• Pignataro Carlos
• Clarke Joseph Michael

Classifications

• H04L45/74

  Address processing for routing · CPC title

• H04L45/566 Primary

  Routing instructions carried by the data packet, e.g. active networks · CPC title

• H04L67/16 Primary

  Electricity · mapped topic

• H04L45/64

  using an overlay routing layer · CPC title

• H04L67/63

  Routing a service request depending on the request content or context · CPC title