Systems and methods for processing packets tapped from a network

Patent metadata

Field	Value
Publication number	US-9571393-B2
Application number	US-201414547024-A
Country	US
Kind code	B2
Filing date	Nov 18, 2014
Priority date	Nov 18, 2014
Publication date	Feb 14, 2017
Grant date	Feb 14, 2017

Abstract

A method performed by a network device that taps to a network having a routing device, includes: determining a first information regarding an input interface of the routing device for a packet; determining a second information regarding an output interface of the routing device for the packet; determining whether the packet belongs to a user-defined category based on one or more mapping formation defined at the network device; and storing the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category in a non-transitory medium in association with each other.

First claim

What is claimed:

1. A method performed by a network device that taps to a network having a routing device, comprising:
determining a first information regarding an input interface of the routing device for a packet using a processing unit by:
receiving a first packet tapped from the network; and
determining the first information based on a destination address of the first packet by comparing the destination address of the first packet with a source address of a discovery protocol packet;

determining a second information regarding an output interface of the routing device for the packet using the processing unit;
determining whether the packet belongs to a user-defined category based on one or more mapping formation defined at the network device; and
storing the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category in a non-transitory medium in association with each other.

2. The method of claim 1 , wherein the network device comprises a plurality of network ports configured to communicate with the network, and a plurality of instrument ports configured to communicate with respective network monitoring instruments.

3. The method of claim 2 , wherein the network device further comprises a processing unit configured to perform the acts of determining.

4. The method of claim 1 , wherein the user-defined category is defined for a subscriber of the network device.

5. The method of claim 1 , wherein the non-transitory medium comprises one or more data center.

6. The method of claim 1 , wherein the act of determining the second information regarding the output interface of the routing device comprises:
receiving a second packet tapped from the network; and
determining the second information based on a source address of the second packet.

7. The method of claim 6 , wherein the act of determining the second information based on the source address of the second packet comprises comparing the source address of the second packet with a destination address of a discovery protocol packet.

8. The method of claim 6 , further comprising:
determining a first CRC for the first packet;
determining a second CRC for the second packet; and
comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

9. The method of claim 1 , further comprising running a discovery protocol at the network device.

10. The method of claim 9 , wherein the discovery protocol comprises a CDP or a LLDP.

11. The method of claim 1 , wherein the network device comprises a single network appliance.

12. The method of claim 1 , wherein the network device comprises multiple network appliances.

13. A network device comprising:
one or more ports for tapping to a network, the network comprising a routing device; and
a processing unit configured for
determining a first information regarding an input interface of the routing device for a packet by:
receiving a first packet tapped from the network; and
determining the first information based on a destination address of the first packet by comparing the destination address of the first packet with a source address of a discovery protocol packet;

determining a second information regarding an output interface of the routing device for the packet;
determining whether the packet belongs to a user-defined category based on one or more mapping formation defined at the network device; and
associating the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category, with each other; and

a non-transitory medium for storing the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category in association with each other.

14. The network device of claim 13 , further comprising a plurality of network ports configured to communicate with the network, and a plurality of instrument ports configured to communicate with respective network monitoring instruments.

15. The network device of claim 13 , wherein the user-defined category is defined for a subscriber of the network device.

16. The network device of claim 13 , wherein the non-transitory medium comprises one or more data center.

17. The network device of claim 13 , wherein the processing unit is configured for determining the second information regarding the output interface of the routing device by:
receiving a second packet tapped from the network; and
determining the second information based on a source address of the second packet.

18. The network device of claim 17 , wherein the processing unit is configured for determining the second information based on the source address of the second packet by comparing the source address of the second packet with a destination address of a discovery protocol packet.

19. The network device of claim 17 , wherein the processing unit is further configured for:
determining a first CRC for the first packet;
determining a second CRC for the second packet; and
comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

20. The network device of claim 13 , wherein the processing unit is further configured for running a discovery protocol.

21. The network device of claim 20 , wherein the discovery protocol comprises a CDP or a LLDP.

22. The network device of claim 13 , wherein the network device comprises a single network appliance.

23. The network device of claim 13 , wherein the network device comprises multiple network appliances.

Assignees

• Gigamon Inc

Inventors

• Alawani Ashutosh
• Settipalli Sreekanth
• Kishore Tanmay
• Cafarelli Dominick
• Merchant Shehzad

Classifications

• H04W48/16

  Discovering, processing access restriction or access information · CPC title

• H04L45/74 Primary

  Address processing for routing · CPC title

• H04L49/208 Primary

  Port mirroring · CPC title

• H04L43/12

  Network monitoring probes · CPC title

• Y02D30/00

  Reducing energy consumption in communication networks · CPC title