Packet capture via packet tagging

Patent metadata

Field	Value
Publication number	US-10917318-B2
Application number	US-201816138891-A
Country	US
Kind code	B2
Filing date	Sep 21, 2018
Priority date	Sep 21, 2018
Publication date	Feb 9, 2021
Grant date	Feb 9, 2021

Abstract

Techniques are disclosed for capturing network traffic in a virtualized computing environment. A packet to be captured in the virtualized environment is identified. The packet is tagged using a pattern of one or more bits in a header of the packet. The pattern indicates that the packet is to be traced. The pattern is propagated to an outer layer during encapsulation of the packet. A header of the encapsulated packet includes the pattern of one or more bits. At least one network device is caused to mirror identified packets based on the reserved bit.

First claim

What is claimed is:

1. A method for capturing network traffic in a virtualized computing environment comprising at least one or more computing devices and one or more network devices, the virtualized computing environment configured to implement one or more virtual networks associated with a user of the virtualized computing environment, the one or more virtual networks implemented with one or more virtual machines, the method comprising:
receiving a request to track data packets associated with a specified flow of the virtualized computing environment or the one or more virtual networks of the virtualized computing environment, the request comprising a specified state for data packets to be tracked;
in response to the request, generating rules for hosts that are hosting virtual machines associated with the request, the rules usable to enable identification and tagging of the data packets associated with the request;
based on the rules, tagging, by hosts that are hosting virtual machines associated with the request, packets identified by the rules using a pattern of one or more bits in a reserved field of a header of the packet, wherein the pattern indicates that the packet is to be tracked;
propagating the pattern to an outer layer during encapsulation of the packet, wherein a header of the encapsulated packet includes the pattern of one or more bits;
causing the network devices, virtual network functions, and end hosts of the virtualized computing environment to track identified packets based on the pattern in the header of the encapsulated packet; and
collecting tagged packets and a number of tracked packets for network traffic analysis of the virtualized computing environment.

2. The method of claim 1 , wherein the packet to be tracked is specified using an associated 5-tuple.

3. The method of claim 1 , wherein the packet to be tracked is specified using an associated 5-tuple and a user or customer identifier.

4. The method of claim 1 , wherein the packet to be tracked is based on a source virtual machine.

5. The method of claim 1 , wherein the packet to be tracked is translated to a packet with one or more additional or removed headers.

6. The method of claim 1 , wherein markings that indicate that the packet is to be mirrored are propagated to an outer header.

7. The method of claim 1 , wherein the pattern of one or more bits comprises a bit in a Differentiated Services Code Point (DSCP) header.

8. The method of claim 7 , wherein the bit is a second most significant bit in the DSCP header.

9. The method of claim 1 , wherein the pattern of one or more bits comprises a bit in an Internet Protocol (IP) identifier field.

10. The method of claim 1 , further comprising implementing a packet counter configured based on incoming and outgoing tagged packets.

11. The method of claim 1 , wherein packets are tagged at end hosts and entry points at an edge of the virtualized computing environment.

12. A non-transitory computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by one or more processors of a computing device, cause the computing device to:
determine a packet to be captured in a virtualized computing environment comprising at least one or more computing devices and one or more network devices, the virtualized computing environment configured to implement one or more virtual networks associated with a user of the virtualized computing environment, the one or more virtual networks implemented with one or more virtual machines;
receive a request to track data packets associated with a specified flow of the virtualized computing environment or the one or more virtual networks of the virtualized computing environment, the request comprising a specified state for data packets to be tracked;
in response to the request, generate rules for hosts that are hosting virtual machines associated with the request, the rules usable to enable identification and tagging of the data packets associated with the request;
based on the rules, tag, by hosts that are hosting virtual machines associated with the request, packets identified by the rules using a pattern of one or more bits in a reserved field of a header of the packet, wherein the pattern indicates that the packet is to be tracked;
propagate the pattern to an outer layer during encapsulation of the packet, wherein a header of the encapsulated packet includes the pattern of one or more bits; and
cause the network devices, virtual network functions, and end hosts of the virtualized computing environment to track identified packets based on the pattern in the header of the encapsulated packet.

13. The non-transitory computer-readable storage medium of claim 12 , wherein the pattern of one or more bits comprises a bit in an Internet Protocol (IP) identifier field.

14. The non-transitory computer-readable storage medium of claim 12 , wherein the pattern is a bit in a Differentiated Services Code Point (DSCP) header.

15. A system, comprising:
one or more processors; and
a memory in communication with the one or more processors, the memory having computer-readable instructions stored thereupon that, when executed by the one or more processors, cause the system to perform operations comprising:
receiving a request to track data packets associated with a specified flow of a virtualized computing environment or a virtual network of the virtualized computing environment, the virtualized computing environment comprising at least one or more computing devices and one or more network devices, the request comprising a specified state for data packets to be tracked;
in response to the request, generating rules for hosts that are hosting virtual machines associated with the request, the rules usable to enable identification and tagging of the data packets associated with the request;
based on the rules, tagging, by hosts that are hosting virtual machines associated with the request, packets identified by the rules using a pattern of one or more bits in a reserved field of a header of the packet, wherein the pattern indicates that the packet is to be tracked;
propagating the pattern to an outer layer during encapsulation of the packet, wherein a header of the encapsulated packet includes the pattern of one or more bits;
causing the network devices, virtual network functions, and end hosts of the virtualized computing environment to track identified packets based on the pattern in the header of the encapsulated packet; and
collecting tagged packets and a number of tracked packets for network traffic analysis of the virtualized computing environment.

16. The system of claim 15 , wherein the packet to be tracked is specified using an associated 5-tuple and a user or customer identifier.

17. The system of claim 15 , wherein the packet to be tracked is based on a source virtual machine.

18. The system of claim 15 , wherein the packet to be tracked is translated to a packet with one or more additional or removed headers.

19. The system of claim 15 , wherein the pattern of one or more bits comprises a bit in a DSCP header or IP identifier field.

20. The system of claim 15 , wherein packets are tagged at end hosts and entry points at an edge of the virtualized network.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Yuan Lihua
• Zan Xinyan
• Bansal Deepak
• Maltz David A
• Deng Leiwen
• Lu Sheng

Classifications

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L12/4645

  Details on frame tagging (routing of packets H04L45/00; support for virtual LAN H04L49/354) · CPC title

• H04L43/04 Primary

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title