Portable system for monitoring network flow attributes and associated methods

Patent metadata

Field	Value
Publication number	US-2015215183-A1
Application number	US-201414164152-A
Country	US
Kind code	A1
Filing date	Jan 25, 2014
Priority date	Jan 25, 2014
Publication date	Jul 30, 2015
Grant date	—

Abstract

A method for monitoring flow attributes at a network node comprises detecting first information indicative of transmission of a packet through the network node. The first information is discernible from information contained within the packet. The method also comprises determining that the packet is not part of an existing flow and generating, in a flow cache memory, a new flow entry corresponding to the packet. The method further comprises receiving second information associated with the transmission of the packet through the network node. The second information is contained in a forwarding information base (FIB) stored in the network node and cannot be discerned from information contained within the packet. The method also comprises writing, in the flow cache memory, at least a portion of the second information to the new flow entry corresponding to the packet.

First claim

What is claimed is:

1 . A computer-implemented method for monitoring flow attributes at a network node, comprising:
detecting, at a network probe coupled to the network node, first information indicative of transmission of a packet through the network node, the first information being discernible from information contained within the packet; determining, by the network probe, that the packet is not part of an existing flow; generating, in a flow cache memory of the network probe, a new flow entry corresponding to the packet; receiving, from the network node, second information associated with the transmission of the packet through the network node, the second information contained in a forwarding information base (FIB) stored in the network node and which cannot be discerned from information contained within the packet; and writing, in the flow cache memory, at least a portion of the second information to the new flow entry corresponding to the packet.

2 . The computer-implemented method of claim 1 , wherein determining that the packet is not part of an existing flow includes:
comparing the first information with flow information contained in the flow cache memory; and determining, based on the comparison, that the first information does not match flow information contained in the flow cache memory.

3 . The computer-implemented method of claim 1 , further comprising providing, by the network probe to the network node, third information associated with the packet, the third information causing the network node to provide the second information to the network probe.

4 . The computer-implemented method of claim 1 , wherein the first information includes information that can be determined based on an analysis of raw data associated with the packet.

5 . The computer-implemented method of claim 4 , wherein the first information includes at least one of a source IP address, a destination IP address, a source port, a destination port, or an IP protocol.

6 . The computer-implemented method of claim 1 , wherein the second information includes information that cannot be determined based on an analysis of raw data associated with the packet.

7 . The computer-implemented method of claim 6 , wherein the second information includes at least one of a next hop for the packet, an input interface, an output interface, an indication of a source autonomous system (AS) from which the packet was generated, an indication of a destination AS to which the packet is being sent, information indicative of a source mask associated with the packet, or information indicative of a destination mask associated with the packet.

8 . A computer-implemented method for monitoring flow attributes at a network node, comprising:
detecting, at a network probe coupled to the network node, first information indicative of transmission of a packet through the network node, the first information being discernible from information contained within the packet; comparing the information indicative of the transmission of the packet with information contained in a forwarding information base (FIB) associated with the network node; determining, based on the comparison, that the packet is not part of an existing flow; generating, in a flow cache memory of the network probe, a new flow entry corresponding to the packet; retrieving, from the network node, an updated FIB containing second information associated with the transmission of the packet through the network node, the second information not discernible from information contained within the packet; and writing, in the flow cache memory, at least a portion of the second information to the new flow entry corresponding to the packet.

9 . The computer-implemented method of claim 8 , wherein the FIB is stored in the network node and the flow cache memory includes a copy of the FIB.

10 . The computer-implemented method of claim 8 , wherein the first information includes information that can be determined based on an analysis of raw data associated with the packet.

11 . The computer-implemented method of claim 10 , wherein the first information includes at least one of a source IP address, a destination IP address, a source port, a destination port, or an IP protocol,

12 . The computer-implemented method of claim 8 , wherein the second information includes information that cannot be determined based on an analysis of raw data associated with the packet.

13 . The computer-implemented method of claim 12 , wherein the second information includes at least one of a next hop for the packet, an input interface, an output interface, an indication of a source autonomous system (AS) from which the packet was generated, an indication of a destination AS to which the packet is being sent, information indicative of a source mask associated with the packet, or information indicative of a destination mask associated with the packet.

14 . The computer-implemented method of claim 8 , wherein detecting the first information includes monitoring the first information via a SPAN port associated with the network node.

15 . The computer-implemented method of claim 14 , wherein the network probe is coupled to the network node via a virtual integration port that facilitates communication between the network probe and the network node such that the network probe is configured as a virtual line card coupled to the network node.

16 . The method of claim 8 , wherein comparing the information indicative of the transmission of the packet with information contained in the forwarding information base (FIB) associated with the network node includes comparing the information indicative of the transmission of the packet with a copy of the information indicative of the transmission of the packet with information contained in the FIB associated with the network node, the copy stored in the flow cache memory of the network probe.

17 . An apparatus for monitoring network flow parameters in a network node, the system configured for coupling the network node via an externally-accessible port of the network node, the apparatus comprising:
a flow cache memory configured to store network traffic parameters associated with existing network packet flows; a processor, communicatively coupled to the flow cache memory and configured to:
detect first information indicative of transmission of a packet through the network node, the first information being discernible from information contained within the packet;
determine that the packet is not part of an existing network flow;
creating, in the flow cache memory, a new flow entry corresponding to the packet;
receive second information associated with the transmission of the packet through the network node, the second information contained in a forwarding information base (FIB) stored in the network node and which cannot be discerned from information contained within the packet; and
write, in the flow cache memory, at least a portion of the second information to the new flow entry corresponding to the packet.

18 . The apparatus of claim 17 , wherein determining that the packet is not part of an existing network flow includes:
comparing the first information with flow information contained in the flow cache memory and determining, based on the comparison, that the first information does not match flow information contained in the flow cache memory.

19 . The apparatus of claim 17 , wherein the processor is configured to provide, to the network node, third information associated with the packe

Assignees

• Cisco Tech Inc

Inventors

• Bucci Christopher Jon
• Song Walter
• Feng Chao
• Sharma Samar

Classifications

• H04L43/08 Primary

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L45/02 Primary

  Topology update or discovery · CPC title

• H04L47/11

  Identifying congestion · CPC title

• H04L43/026

  using flow identification · CPC title

• H04L43/12

  Network monitoring probes · CPC title