Measuring Performance of a Network Using Mirrored Probe Packets

Patent metadata

Field	Value
Publication number	US-2016352601-A1
Application number	US-201514726245-A
Country	US
Kind code	A1
Filing date	May 29, 2015
Priority date	May 29, 2015
Publication date	Dec 1, 2016
Grant date	—

Abstract

Functionality is described herein for measuring the performance of a network. The functionality operates by generating a probe packet and injecting the probe packet into the network. The probe packet is configured, using one or more layers of encapsulation, to target a particular network component of interest in the network, or to target a particular collection of network components in the network. A switch to which the probe packet is addressed operates by: (a) generating mirrored information that is associated with the probe packet; (b) decapsulating the probe packet (with respect to its outermost encapsulation) to produce a new probe packet; and (c) passing the new probe packet to a downstream network component, in accordance with a destination address associated with the new probe packet. The functionality uses the mirrored information that has been collected in the above manner to detect various anomalies in the network.

First claim

What is claimed is:

1 . A method for measuring performance of a network, comprising:
providing an innermost probe packet, the innermost probe packet having an innermost destination address; generating a first probe packet, the first probe packet including:
a first destination address that identifies a first network component in the network; and
the innermost probe packet, which is encapsulated in the first probe packet through at least one layer of encapsulation;
sending the first probe packet to the first network component of the network based on the first destination address associated with the first probe packet; at the first network component, generating first mirrored information, the first mirrored information providing content that is associated with the first probe packet; providing the first mirrored information to a collection and analysis (CA) system; decapsulating the first probe packet to produce a second probe packet, the second probe packet including a second destination address; and sending the second probe packet to a second network component that is associated with the second destination address.

2 . The method of claim 1 , further comprising:
at the CA system, collecting one or more instances of mirrored information produced by one or more respective network components in the network, in response to injection of one or more probe packets into the network; and providing information regarding at least one network-related behavior based on said one or more instances of mirrored information.

3 . The method of claim 2 , wherein the network-related behavior corresponds to packet loss that has occurred at at least one network component within the network.

4 . The method of claim 2 , wherein the network-related behavior corresponds to roundtrip latency associated with at least one link within the network.

5 . The method of claim 2 , wherein the network-related behavior corresponds to looping behavior, in which a packet is routed through a same network component more than once.

6 . The method of claim 2 , wherein the network-related behavior corresponds to an imbalance in a distribution of packets by a load balancing mechanism.

7 . The method of claim 1 ,
wherein the second probe packet corresponds to the innermost probe packet, and, as such, the second destination address corresponds to the innermost destination address, and wherein the network sends the innermost probe packet to the second network component via zero, one or more additional network components.

8 . The method of claim 7 , wherein the first network component or the second network component is a network component to be investigated for occurrence of packet loss.

9 . The method of claim 1 , wherein the second network component:
generates second mirrored information, the second mirrored information providing content that is associated with the second probe packet; provides the second mirrored information to the CA system; decapsulates the second probe packet to produce a third probe packet, the third probe packet including a third destination address that identifies a third network component; and sends the third probe packet to the third network component, based on the third destination address.

10 . The method of claim 9 ,
wherein the third probe packet corresponds to the innermost probe packet, and, as such, the third destination address corresponds to the innermost destination address, and wherein the third network component corresponds to the first network component.

11 . The method of claim 10 , wherein the first network component, upon receiving the third probe packet:
generates third mirrored information, the third mirrored information providing content that is associated with the third probe packet; and provides the third mirrored information to the CA system.

12 . The method of claim 11 ,
wherein a link couples the first network component to the second network component, wherein a first instance of time information identifies a time of receipt, by the CA system, of the first mirrored information, wherein another instance of time information identifies a time of receipt, by the CA system, of the third mirrored information, and the method further comprising generating a roundtrip latency measure associated with the link based on the first instance of time information and the other instance of time information.

13 . The method of claim 1 ,
wherein the first network component is triggered to perform decapsulation upon receiving the first probe packet via a specified address; and wherein the first network component is triggered to perform mirroring upon detecting status information in the first probe packet that indicates that mirroring is to be performed.

14 . The method of claim 1 , further comprising:
collecting preliminary-phase instances of mirrored information in a preliminary phase of measurement, wherein the first probe packet targets a particular part of the network that has generated anomalous behavior, as reflected in the preliminary-phase instances of mirrored information.

15 . One or more computing devices for generating a probe packet for injection into a network, comprising:
logic configured to produce a first probe packet that includes:
a first destination address that identifies a first network component in the network;
an innermost probe packet, which is directly or indirectly encapsulated in the first probe packet, the innermost probe packet specifying an innermost destination address; and
status information to indicate that the first probe packet is a packet to be mirrored by the first network component; and
logic configured to send the first probe packet to the first network component of the network.

16 . The one or more computing devices of claim 15 , wherein the first probe packet includes, encapsulated in the first probe packet, a second probe packet, the second probe packet including:
a second destination address that identifies a second network component in the network; and the innermost probe packet, which is encapsulated in the second probe packet.

17 . The one or more computing devices of claim 16 , wherein the first probe packet encapsulates a set of probe packets having respective destination addresses that, when followed, specifies a path in which at least one network component is encountered twice.

18 . A hardware switch for use in processing packets in a network, comprising:
a receiving component configured to receive a packet having a destination address that identifies the hardware switch, the packet that is received corresponding to a received packet; logic configured to determine whether the received packet corresponds to a probe packet; a mirroring component configured, when the received packet is determined to correspond to a probe packet, to:
generate mirrored information that provides content that is associated with the probe packet; and
provide the mirrored information to a collection and analysis (CA) system;
a decapsulation component configured to decapsulate the probe packet to produce another packet, which is encapsulated in the probe packet, and which specifies another destination address; and a sending component configured to send the other packet to the other destination address.

19 . The hardware switch of claim 18 , wherein the other packet that is produced encapsulates yet another packet.

20 . The hardware switch of claim 18 , wherein the probe packet encapsulates a set of probe

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Zhang Ming
• Lu Guohan
• Yuan Lihua
• Zhu Yibo

Classifications

• H04L43/0823 Primary

  Errors, e.g. transmission errors · CPC title

• H04L43/14

  using software, i.e. software packages (network security related monitoring H04L63/1408) · CPC title

• H04L43/0829 Primary

  Packet loss · CPC title

• H04L43/0864

  Round trip delays · CPC title

• H04L43/12

  Network monitoring probes · CPC title