Scalable performance monitoring using dynamic flow sampling

Patent metadata

Field	Value
Publication number	US-9577906-B2
Application number	US-201314020539-A
Country	US
Kind code	B2
Filing date	Sep 6, 2013
Priority date	Sep 6, 2013
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

Techniques for scalable performance monitoring using dynamic flow sampling are described. According to one approach, a method comprises intercepting, at an intermediary network device, one or more packets traveling between a source device and a destination device; identifying, at the intermediary network device, a traffic flow based on the one or more packets; determining, at the intermediary network device, whether to collect one or more metrics from the traffic flow based on one or more performance factors of the intermediary network device; in response to a determination to collect the one or more metrics from the traffic flow, the intermediary network collecting the one or more metrics from subsequently intercepted packets belonging to the traffic flow; wherein the method is performed by one or more computing devices.

First claim

What is claimed is:

1. A method comprising:
intercepting, at an intermediary network device, one or more packets traveling between a source device and a destination device;
identifying, at the intermediary network device, a traffic flow based on the one or more packets;
randomly determining based on a flow sample rate, at the intermediary network device, whether to:
(a) inspect all packets intercepted from the traffic flow to collect one or more metrics, or
(b) inspect none of the packets intercepted from the traffic flow to collect the one or more metrics;
wherein the flow sample rate is dependent on one or more performance factors of the intermediary network device;
wherein the one or more performance factors include one or more of: utilization of one or more processors of the intermediary network device or memory utilization of the intermediary network device;
in response to a determination to inspect all packets intercepted from the traffic flow to collect the one or more metrics, the intermediary network inspecting all subsequently intercepted packets belonging to the traffic flow to collect the one or more metrics;
wherein the method is performed by one or more computing devices.

2. The method of claim 1 , further comprising sending at least a portion of the one or more metrics to a collector device.

3. The method of claim 1 , wherein determining whether to collect the one or more metrics from the traffic flow is based at least in part on central processing unit (CPU) utilization of the intermediary network device.

4. The method of claim 1 , wherein the traffic flow adheres to a multi-phase protocol and collecting the one or more metrics from the subsequently intercepted packets includes determining during which phase of the multi-phase protocol the one or more metrics are being collected.

5. The method of claim 1 , wherein the one or more metrics include one or more of: application identification information, web metrics, media metrics, application specific metrics, digital telephony metrics, connection metrics, consolidated metrics, network layer metrics, transport metrics, or timestamp information.

6. The method of claim 1 , further comprising adding information identifying the traffic flow to a data structure specifying active traffic flows, determining which traffic flows of the active traffic flows are being monitored, and reporting a number or percentage of the active traffic flows that are being monitored to a collector device.

7. A non-transitory computer readable medium storing one or more instructions which, when executed by one or more processors, cause the one or more processors to perform steps of:
intercepting, at an intermediary network device, one or more packets traveling between a source device and a destination device;
identifying, at the intermediary network device, a traffic flow based on the one or more packets;
randomly determining based on a flow sample rate, at the intermediary network device, whether to:
(a) inspect all packets intercepted from the traffic flow to collect one or more metrics, or
(b) inspect none of the packets intercepted from the traffic flow to collect the one or more metrics;
wherein the flow sample rate is dependent on one or more performance factors of the intermediary network device;
wherein the one or more performance factors include one or more of: utilization of one or more processors of the intermediary network device or memory utilization of the intermediary network device;
in response to a determination to inspect all packets intercepted from the traffic flow for to collect the one or more metrics, the intermediary network inspecting all subsequently intercepted packets belonging to the traffic flow to collect the one or more metrics.

8. The non-transitory computer readable medium of claim 7 , wherein the steps further comprise sending at least a portion of the one or more metrics to a collector device.

9. The non-transitory computer readable medium of claim 7 , wherein determining whether to collect the one or more metrics from the traffic flow is based at least in part on central processing unit (CPU) utilization of the intermediary network device.

10. The non-transitory computer readable medium of claim 7 , wherein the traffic flow adheres to a multi-phase protocol and collecting the one or more metrics from the subsequently intercepted packets includes determining during which phase of the multi-phase protocol the one or more metrics are being collected.

11. The non-transitory computer readable medium of claim 7 , wherein the one or more metrics include one or more of: application identification information, web metrics, media metrics, application specific metrics, digital telephony metrics, connection metrics, consolidated metrics, network layer metrics, transport metrics, or timestamp information.

12. The non-transitory computer readable medium of claim 7 , wherein the steps further comprise adding information identifying the traffic flow to a data structure specifying active traffic flows, determining which traffic flows of the active traffic flows are being monitored, and reporting a number or percentage of the active traffic flows that are being monitored to a collector device.

13. An apparatus comprising:
one or more processors;
one or more non-transitory computer-readable storage mediums storing one or more instructions which, when executed by the one or more processors, cause the one or more processors to:
intercept, at an intermediary network device, one or more packets traveling between a source device and a destination device;
identify, at the intermediary network device, a traffic flow based on the one or more packets;
randomly determine based on a flow sample rate, at the intermediary network device, whether to:
(a) inspect all packets intercepted from the traffic flow to collect one or more metrics, or
(b) inspect none of the packets intercepted from the traffic flow to collect the one or more metrics;
wherein the flow sample rate is dependent on one or more performance factors of the intermediary network device;
wherein the one or more performance factors include one or more of: utilization of one or more processors of the intermediary network device or memory utilization of the intermediary network device;
in response to a determination to inspect all packets intercepted from the traffic flow to collect the one or more metrics, inspect, at the intermediary device, all subsequently intercepted packets belonging to the traffic flow to collect the one or more metrics.

14. The apparatus of claim 13 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to send at least a portion of the one or more metrics to a collector device.

15. The apparatus of claim 13 , wherein the determination whether to collect the one or more metrics from the traffic flow is based at least in part on central processing unit (CPU) utilization of the intermediary network device.

16. The apparatus of claim 13 , wherein the traffic flow adheres to a multi-phase protocol and the collection of the one or more metrics from the subsequently intercepted packets includes determining during which phase of the multi-phase protocol the one or more metrics are being collected.

17. The apparatus of claim 13 , wherein the one or more metrics include one or more of: application identification information, web metrics, media metrics, application specific metrics, digital telephony metrics, connection metrics, consolidated metrics, network layer m

Assignees

• Cisco Tech Inc

Inventors

• Ferreira Joao Carlos Leite
• Nagulapalli Harinadh
• Chinthammit Kangwarn
• Ben-Dvora Nir

Classifications

• H04L43/0876 Primary

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L43/024 Primary

  by adaptive sampling · CPC title

• H04L43/106

  using time related information in packets, e.g. by adding timestamps · CPC title