Method for streaming packet captures from network access devices to a cloud server over HTTP

Patent metadata

Field	Value
Publication number	US-9692802-B2
Application number	US-201514704417-A
Country	US
Kind code	B2
Filing date	May 5, 2015
Priority date	Mar 14, 2013
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

A system for streaming packet captures over the Internet includes multiple network access devices, each operating as one of a gateway device, a wireless access point, and a network switch, and a management server communicatively coupled to the network access devices over the Internet for managing the network access devices. The management server maintains a persistent hypertext transport protocol (HTTP) connection with each of the network access devices over the Internet. The management server is to generate a bytecode based on a filtering expression for packet captures (PCAPs) representing one or more PCAPs filtering rules, transmit the bytecode to the network access devices without requiring the network access devices to compile the PCAPs filtering rules, receive PCAPs from the network access devices captured by the network access devices based on the PCAPs filtering rules, and merge the PCAPs received from the network access devices into merged PCAPs.

First claim

The invention claimed is:

1. A system, comprising:
a plurality of network access devices, wherein each of the network access devices provides network access to a plurality of client devices over a local area network (LAN); and
a management server communicatively coupled to the network access devices for managing the network access devices, wherein the management server is configured to:
transmit a bytecode to at least a portion of the network access devices, the bytecode based on a filtering expression for packet captures (PCAPs), the bytecode representing one or more PCAPs filtering rules;
receive PCAPs from at least a portion of the network access devices, wherein the PCAPs were captured by the network access devices based on the PCAPs filtering rules; and
merge the PCAPs received from the network access devices into merged PCAPs.

2. The system of claim 1 , wherein the bytecode is transmitted to at least a portion of the network access devices without requiring the network access devices to compile the PCAPs filtering rules.

3. The system of claim 1 , wherein the management server includes a Web interface to provide a set of network management tools to allow a user to configure the network access devices over the Internet, and wherein the filtering expression is received from the user via the Web interface to specify how the PCAPs are to be captured.

4. The system of claim 1 , wherein the management server maintains a persistent hypertext transport protocol (HTTP) connection with each of the network access devices.

5. The system of claim 4 , wherein each of the network access devices includes an HTTP server component running therein that communicates with an HTTP client component running within the management server to maintain the HTTP connection.

6. The system of claim 4 , wherein the PCAPs are streamed over the Internet via the HTTP connections between the management server and the network access devices.

7. The system of claim 6 , wherein the PCAPs are streamed from HTTP server components of the network access devices to an HTTP client component using an HTTP streaming protocol in which the PCAPs are transported in a plurality of HTTP chunks.

8. The system of claim 1 , wherein a PCAP stream received from a network access device of the plurality of network access devices includes a PCAP header and a plurality of PCAP packets as a payload of the PCAP stream, and wherein the PCAP header includes a first timestamp indicating time when a PCAP process of the network access device started.

9. A method, comprising:
maintaining, by a management server, a persistent hypertext transport protocol (HTTP) connection with each of a plurality of network access devices over the Internet, wherein each of the network access devices provides network access to a plurality of client devices over a local area network (LAN);
transmitting, by the management server, a bytecode to at least a portion of the network access devices, the bytecode based on a filtering expression for packet captures (PCAPs), the bytecode representing one or more PCAPs filtering rules;
receiving PCAPs from at least a portion of the network access devices, wherein the PCAPs were captured by the network access devices based on the PCAPs filtering rules; and
merging the PCAPs received from the network access devices into merged PCAPs.

10. The method of claim 9 , wherein transmitting the bytecode to at least a portion of the network access devices is performed without requiring the network access devices to compile the PCAPs filtering rules.

11. The method of claim 9 , wherein the management server includes a Web interface to provide a set of network management tools to allow a user to configure the network access devices over the Internet, and wherein the filtering expression is received from the user via the Web interface to specify how the PCAPs are to be captured.

12. The method of claim 9 , wherein each of the network access devices includes an HTTP server component running therein that communicates with an HTTP client component running within the management server to maintain the HTTP connection.

13. The method of claim 9 , wherein the PCAPs are streamed from HTTP server components of the network access devices to an HTTP client component using an HTTP streaming protocol in which the PCAPs are transported in a plurality of HTTP chunks.

14. The method of claim 13 , wherein a PCAP stream received from a network access device of the plurality of network access devices includes a PCAP header and a plurality of PCAP packets as a payload of the PCAP stream, and wherein the PCAP header includes a first timestamp indicating time when a PCAP process of the network access device started.

15. A non-transitory machine-readable medium having instructions stored therein, which when executed by one or more processors, cause the one or more processors to:
maintain, by a management server, a persistent hypertext transport protocol (HTTP) connection with each of a plurality of network access devices over the Internet, wherein each of the network access devices provides network access to a plurality of client devices over a local area network (LAN);
transmit, by the management server, a bytecode to at least a portion of the network access devices, the bytecode based on a filtering expression for packet captures (PCAPs), the bytecode representing one or more PCAPs filtering rules;
receive PCAPs from at least a portion of the network access devices, wherein the PCAPs were captured by the network access devices based on the PCAPs filtering rules; and
merge the PCAPs received from the network access devices into merged PCAPs.

16. The non-transitory machine-readable medium of claim 15 , wherein transmitting the bytecode to at least a portion of the network access devices is performed without requiring the network access devices to compile the PCAPs filtering rules.

17. The non-transitory machine-readable medium of claim 15 , wherein the management server includes a Web interface to provide a set of network management tools to allow a user to configure the network access devices over the Internet, and wherein the filtering expression is received from the user via the Web interface to specify how the PCAPs are to be captured.

18. The non-transitory machine-readable medium of claim 15 , wherein each of the network access devices includes an HTTP server component running therein that communicates with an HTTP client component running within the management server to maintain the HTTP connection.

19. The non-transitory machine-readable medium of claim 15 , wherein the PCAPs are streamed from HTTP server components of the network access devices to an HTTP client component using an HTTP streaming protocol in which the PCAPs are transported in a plurality of HTTP chunks.

20. The non-transitory machine-readable medium of claim 19 , wherein a PCAP stream received from a network access device of the plurality of network access devices includes a PCAP header and a plurality of PCAP packets as a payload of the PCAP stream, and wherein the PCAP header includes a first timestamp indicating time when a PCAP process of the network access device started.

Assignees

• Cisco Tech Inc

Inventors

• Bicket John
• Chambers Benjamin A

Classifications

• H04L49/25

  Routing or path finding in a switch fabric · CPC title

• H04L41/0246

  Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols · CPC title

• H04L43/028

  by filtering · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title