Systems and methods for processing packets

Patent metadata

Field	Value
Publication number	US-10063671-B2
Application number	US-201615188705-A
Country	US
Kind code	B2
Filing date	Jun 21, 2016
Priority date	Jan 17, 2014
Publication date	Aug 28, 2018
Grant date	Aug 28, 2018

Abstract

A network switch apparatus, includes: a network port configured to receive a packet; instrument ports configured to communicate with respective network monitoring instruments; a packet duplication module configured to copy the packet to provide multiple packets that are identical to each other: a tagging module configured to tag the multiple packets with different respective identifiers to obtain tagged packets; and a processing unit coupled to the instrument ports; wherein the processing unit is configured to determine whether a first one of the tagged packets satisfies a first criterion, whether a second one of the tagged packets satisfies a second criterion, process the first one of the tagged packets in a first manner if the first one of the tagged packets satisfies the first criterion, and process the second one of the tagged packets in a second manner if the second one of the tagged packets satisfies the second criterion.

First claim

The invention claimed is:

1. A method to efficiently distribute data traffic to a plurality of network monitoring instruments, the method comprising:
receiving a packet on a network port;
in response to receiving the packet on the network port, copying the packet to produce a plurality of packets without analyzing the packet by creating a number of packets equal to a number of criteria in a plurality of criteria, wherein each criterion in the plurality of criteria corresponds to exactly one network monitoring instrument in the plurality of network monitoring instruments monitoring the network port;
in response to copying the packet, tagging each packet in the plurality of packets with a different unique identifier to produce a plurality of unique tagged packets, each of which is unique among the plurality of unique tagged packets, each said unique identifier representing a correspondence between a unique tagged packet and exactly one criterion in the plurality of criteria, each criterion including an action that includes mapping the packet to a port of a network monitoring instrument in the plurality of network monitoring instruments, wherein at least two of the plurality of unique tagged packets have the different unique identifier, and wherein each said unique identifier includes a Virtual Area Network (VLAN) tag;
for each unique tagged packet in the plurality of unique tagged packets, determining whether the unique tagged packet matches the criterion having the correspondence to the unique tagged packet, without determining whether the unique tagged packet matches a remainder of criteria in the plurality of criteria; and
in response to determining that the unique tagged packet matches the criterion having the correspondence to the unique tagged packet, performing the action associated with the criterion.

2. The method of claim 1 , further comprising:
sending the unique tagged packet to the network monitoring instrument.

3. The method of claim 1 , comprising:
removing a portion of the packet to produce a compact packet, wherein the removed portion comprises at least one of a header associated with the packet or a body associated with the packet; and
based on the criterion, copying the compact packet to produce the plurality of packets.

4. The method of claim 1 , comprising:
identifying the network port that received the packet;
identifying a particular criterion based on identification of the network port that received the packet and an express association between the particular criterion and the network port that received the packet;
determining a number of copies of the packet to make, based on the particular criterion; and
copying the packet according to the determined number of copies to provide the plurality of packets.

5. The method of claim 1 , wherein the unique identifier comprises a Virtual Local Area Network (VLAN) tag.

6. The method of claim 1 , further comprising: when a matched criterion is not found, dropping the packet.

7. The method of claim 1 , further comprising storing the criterion in Ternary Content-Addressable Memory (TCAM).

8. The method of claim 1 , said tagging each packet in the plurality of packets comprising:
tagging each packet in the plurality of packets with an ordinal number to obtain the plurality of unique tagged packets; and
matching each packet in the plurality of packets to the criterion to obtain a matched criterion such that the ordinal number associated with the packet corresponds to an ordinal number associated with the matched criterion.

9. A method to efficiently distribute data traffic to a plurality of network monitoring instruments, the method comprising:
receiving a packet on a network port;
in response to receiving the packet on the network port, copying the packet to produce a plurality of packets without analyzing the packet by creating a number of packets in the plurality of packets equal to a number of criteria in a plurality of criteria, wherein each criterion in the plurality of criteria corresponds to exactly one network monitoring instrument in the plurality of network monitoring instruments monitoring the network port;
in response to copying him the packet, tagging each packet in the plurality of packets with a different unique identifier to produce a plurality of unique tagged packets, each of which is unique among the plurality of unique tagged packets, each said unique identifier representing a correspondence between a unique tagged packet and exactly one criterion in the plurality of criteria, each criterion including an action that includes mapping the packet to a port of a network monitoring instrument in the plurality of network monitoring instruments, wherein at least two of the plurality of unique tagged packets have the different unique identifier, wherein the unique identifier includes a Virtual Area Network (VLAN) tag, and wherein the action comprises forwarding the packet to the network port, forwarding the packet to group of network ports, dropping the packet, assigning the packet to a multicast group, or modifying a field associated with the packet;
in response to tagging each packet, determining whether the unique tagged packet in the plurality of unique tagged packets matches the criterion having the correspondence to the unique tagged packet, without determining whether the unique tagged packet in the plurality of unique tagged packets matches a remainder of criteria in the plurality of criteria; and
in response to matching the unique tagged packet, performing the action associated with the criterion.

10. The method of claim 9 , said tagging each packet in the plurality of packets comprising:
tagging each packet in the plurality of packets with an ordinal number to obtain the plurality of unique tagged packets;
matching each packet in the plurality of packets to the to obtain a matched criterion such that the ordinal number associated with the packet corresponds to an ordinal number associated with the matched criterion; and
performing the action associated with the matched criterion.

11. A system to efficiently distribute data traffic to a plurality of network monitoring instruments, the system comprising:
a network port configured to receive a packet;
packet duplication circuitry to copy the packet to produce a plurality of packets without analyzing the packet by creating a number of packets in the plurality of packets equal to a number of criteria in a plurality of criteria, wherein each criterion in the plurality of criteria corresponds to exactly one network monitoring instrument in the plurality of network monitoring instruments monitoring the network port; and
tagging circuitry to tag each packet in the plurality of packets with a different unique identifier to produce a plurality of unique tagged packets, each of which is unique among the plurality of unique tagged packets, each said unique identifier representing a correspondence between a unique tagged packet and exactly one criterion in the plurality of criteria, each criterion including an action that includes mapping the packet to a port of a network monitoring instrument in the plurality of network monitoring instruments, wherein at least two of the plurality of unique tagged packets have the different unique identifier, wherein the unique identifier includes a Virtual Area Network (VLAN) tag;
a processing unit to determine whether the unique tagged packet in the plurality of unique tagged packets matches the criterion having the correspondence to the unique tagged packet, without determining whether the unique tagged packet in the plurality of unique tagged packet matches a remainder of criteria in the plurality of criteria, and to

Assignees

• Gigamon Inc

Inventors

• Merchant Shehzad
• Ng Qi Ming
• Wang Ning

Classifications

• H04L45/566

  Routing instructions carried by the data packet, e.g. active networks · CPC title

• H04L45/74

  Address processing for routing · CPC title

• H04L45/16

  Multipoint routing · CPC title

• H04L69/22 Primary

  Parsing or analysis of headers · CPC title