Portable system for monitoring network flow attributes and associated methods

Patent metadata

Field	Value
Publication number	US-9344344-B2
Application number	US-201414164152-A
Country	US
Kind code	B2
Filing date	Jan 25, 2014
Priority date	Jan 25, 2014
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

A method for monitoring flow attributes at a network node comprises detecting first information indicative of transmission of a packet through the network node. The first information is discernible from information contained within the packet. The method also comprises determining that the packet is not part of an existing flow and generating, in a flow cache memory, a new flow entry corresponding to the packet. The method further comprises receiving second information associated with the transmission of the packet through the network node. The second information is contained in a forwarding information base (FIB) stored in the network node and cannot be discerned from information contained within the packet. The method also comprises writing, in the flow cache memory, at least a portion of the second information to the new flow entry corresponding to the packet.

First claim

What is claimed is:

1. A computer-implemented method for monitoring flow attributes at a network probe coupled to a first device in a network node, wherein the network probe collects flow information for export on behalf of the first device, the method comprising:
detecting, by a processor of a network probe coupled to a first device at the network node, first information indicative of transmission of a packet through the network node, the first information being discernible, at the network probe, from raw data contained within the packet, wherein the network probe comprises the processor and a memory and the first device comprises a second processor and a second memory, the processor and the memory of the network probe being different from the second processor and the second memory of the first device;
determining, by the network probe, that the packet is not part of an existing flow;
generating, in the memory of the network probe, a new flow entry corresponding to the packet;
receiving, at the network probe, from the first device of the network node, second information associated with the transmission of the packet through the network node, the second information contained in a forwarding information base (FIB) stored in the second memory of the first device and which cannot be discerned, at the network probe, from information contained within the packet; and
writing, in the memory of the network probe, the second information to the new flow entry corresponding to the packet.

2. The computer-implemented method of claim 1 , wherein determining that the packet is not part of an existing flow includes:
comparing, at the network probe, the first information with flow information contained in the memory of the network probe; and
determining, at the network probe, based on the comparison, that the first information does not match flow information contained in the memory of the network probe.

3. The computer-implemented method of claim 1 , further comprising providing, by the network probe to the first device, third information associated with the packet, the third information causing the network node to provide the second information to the network probe.

4. The computer-implemented method of claim 1 , wherein the first information includes information that can be determined based on an analysis of raw data associated with the packet.

5. The computer-implemented method of claim 4 , wherein the first information includes at least one selected from the group consisting of a source IP address, a destination IP address, a source port, a destination port, and an IP protocol.

6. The computer-implemented method of claim 1 , wherein the second information includes information that cannot be determined based on an analysis of raw data associated with the packet.

7. The computer-implemented method of claim 6 , wherein the second information includes at least one selected from the group consisting of a next hop for the packet, an input interface, an output interface, an indication of a source autonomous system (AS) from which the packet was generated, an indication of a destination AS to which the packet is being sent, information indicative of a source mask associated with the packet, and information indicative of a destination mask associated with the packet.

8. A computer-implemented method for monitoring flow attributes at a network probe coupled to a first device in a network node, wherein the network probe collects flow information for export on behalf of the first device, the method comprising:
detecting, by a processor at a network probe coupled to a first device at the network node, first information indicative of transmission of a packet through the network node, the first information being discernible, at the network probe, from raw data contained within the packet, wherein the network probe comprises the processor and a memory and the first device comprises a second processor and a second memory, the processor and the memory of the network probe being different from the second processor and the second memory of the first device;
comparing, at the network probe, the information indicative of the transmission of the packet with information contained in a forwarding information base (FIB) associated with the network node;
determining, at the network probe, based on the comparison, that the packet is not part of an existing flow;
generating, in the memory of the network probe, a new flow entry corresponding to the packet;
retrieving, at the network probe, from the second memory of the first device, an updated FIB containing second information associated with the transmission of the packet through the network node, the second information not discernible, at the network probe, from information contained within the packet; and
writing, in the memory, the second information to the new flow entry corresponding to the packet.

9. The computer-implemented method of claim 8 , wherein the FIB is stored in the first device and the memory of the network probe includes a copy of the FIB.

10. The computer-implemented method of claim 8 , wherein the first information includes information that can be determined based on an analysis of raw data associated with the packet.

11. The computer-implemented method of claim 10 , wherein the first information includes at least one selected from the group consisting of a source IP address, a destination IP address, a source port, a destination port, and an IP protocol.

12. The computer-implemented method of claim 8 , wherein the second information includes information that cannot be determined based on an analysis of raw data associated with the packet.

13. The computer-implemented method of claim 12 , wherein the second information includes at least one selected from the group consisting of a next hop for the packet, an input interface, an output interface, an indication of a source autonomous system (AS) from which the packet was generated, an indication of a destination AS to which the packet is being sent, information indicative of a source mask associated with the packet, and information indicative of a destination mask associated with the packet.

14. The computer-implemented method of claim 8 , wherein detecting the first information includes monitoring the first information via a SPAN port associated with the first device.

15. The computer-implemented method of claim 14 , wherein the network probe is coupled to the first device via a virtual integration port that facilitates communication between the network probe and the first device such that the network probe is configured as a virtual line card coupled to the first device.

16. The method of claim 8 , wherein comparing the information indicative of the transmission of the packet with information contained in the forwarding information base (FIB) associated with the network node includes comparing the information indicative of the transmission of the packet with a copy of the information indicative of the transmission of the packet with information contained in the FIB associated with the first device, the copy stored in the memory of the network probe.

17. An apparatus for coupling to a first device to monitor network flow parameters wherein the coupling is via an externally-accessible port of the first device, the apparatus comprising:
a memory configured to store network traffic parameters associated with existing network packet flows;
a processor, communicatively coupled to the memory and configured to:
detect first information indicative of transmission of a packet through the network node, the

Assignees

• Cisco Tech Inc

Inventors

• Bucci Christopher Jon
• Song Walter
• Feng Chao
• Sharma Samar

Classifications

• H04L43/08 Primary

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L45/02 Primary

  Topology update or discovery · CPC title

• H04L47/11

  Identifying congestion · CPC title

• H04L43/026

  using flow identification · CPC title

• H04L43/12

  Network monitoring probes · CPC title