Virtual private network connection quality analysis

Patent metadata

Field	Value
Publication number	US-9942787-B1
Application number	US-201615077634-A
Country	US
Kind code	B1
Filing date	Mar 22, 2016
Priority date	Mar 22, 2016
Publication date	Apr 10, 2018
Grant date	Apr 10, 2018

Abstract

A first network packet directed from one VPN endpoint to a second VPN endpoint is received at an intermediary network processing component. Metadata indicating that the first network packet is a candidate for monitoring is stored. In response to determining that a second packet received at the intermediary comprises an acknowledgement to the first packet, a traffic quality metric is stored at a location accessible to a VPN traffic analyzer. The VPN traffic analyzer responses to a traffic quality query using the metrics collected at the intermediary.

First claim

What is claimed is:

1. A system, comprising:
a network intermediary device associated with an isolated virtual network established on behalf of a client of a provider network; and
a traffic analyzer executed at one or more computing devices;
wherein the network intermediary device is configured to:
identify a first inbound packet as a candidate for monitoring, wherein the first inbound packet is transmitted via a first virtual private network (VPN) connection established at the request of the client, wherein the first inbound packet is directed from outside the provider network to a compute instance within the isolated virtual network, and wherein the first inbound packet is (a) encrypted outside the provider network and (b) decrypted at the network intermediary device;
in response to determining, based at least in part on an examination of one or more network protocol headers, that a first outbound packet from the compute instance comprises an acknowledgement corresponding to the first inbound packet, cause one or more metrics associated with a first monitored packet group to be stored at a persistent storage repository, wherein the one or more metrics include a latency metric computed at the network intermediary device, and wherein the first monitored packet group comprises the first inbound packet and the first outbound packet; and

wherein the traffic analyzer is configured to:
in response to receiving, via a programmatic interface, a traffic quality query pertaining to the first virtual private network connection,
obtain, from the persistent storage repository, respective metrics associated with one or more monitored packet groups including the first monitored packet group; and
generate a response to the traffic quality query based at least in part on the respective metrics.

2. The system as recited in claim 1 , wherein the network intermediary is configured to:
in response to determining that an acknowledgement with respect to a particular packet of a second monitored packet group has not been received within a selected time interval, cause a packet loss metric to be modified.

3. The system as recited in claim 1 , wherein the response comprises a time series of values, including at least one value obtained by applying an aggregation function to a particular metric over a particular time interval.

4. The system as recited in claim 1 , wherein the traffic analyzer is configured to:
transmit an indication of one or more packet categories for which monitoring is approved by the client to the network intermediary device; and

wherein, to identify the first inbound packet as a candidate for monitoring, the network intermediary device is configured to determine whether the first inbound packet belongs to the one or more packet categories.

5. The system as recited in claim 1 , wherein the network intermediary device comprises a protocol processing engine of a virtual private gateway configured for the isolated virtual network, wherein the protocol processing engine executes at a second compute instance.

6. A method, comprising:
identifying, at a first network processing component of a provider network, a first packet as a candidate for monitoring, wherein the first packet is associated with a first virtual private network (VPN) connection established at the request of a client, wherein the first packet is transmitted along a path between a first endpoint located within the provider network and a second endpoint outside the provider network, wherein the path includes the first network processing component, and wherein the first packet is encrypted prior to its transmission along at least a portion of the path;
in response to determining, at the first network processing component, based at least in part on an examination of one or more network protocol headers, that a second packet comprises an acknowledgement with respect to the first packet, causing one or more metrics associated with a first monitored packet group to be stored at a repository, wherein the first monitored packet group comprises the first packet and the second packet; and
transmitting, by a traffic analyzer of the provider network, an indication of traffic quality associated with the first VPN connection, wherein the indication is based at least in part on respective metrics associated with one or more monitored packet groups including the first monitored packet group.

7. The method as recited in claim 6 , wherein the first network processing component comprises a virtual private gateway configured for a first isolated virtual network of the provider network, wherein the first endpoint comprises a first compute instance of the first isolated virtual network.

8. The method as recited in claim 7 , wherein the virtual private gateway is implemented at least in part at a second compute instance.

9. The method as recited in claim 8 , further comprising:
configuring, by a control-plane component of the provider network prior to said identifying the first packet, a second isolated virtual network comprising the second compute instance.

10. The method as recited in claim 6 , further comprising:
providing, by the traffic analyzer to a client, an indication of a set of packet categories which can be monitored for traffic quality analysis, wherein the set of packet categories includes a first category to which the first packet belongs; and
determining, by the first network processing component that the first packet belongs to the first category.

11. The method as recited in claim 10 , wherein the first category comprises one or more of: (a) an ICMP echo packet, (b) a TCP connection establishment packet, or (c) a TCP connection teardown packet.

12. The method as recited in claim 6 , wherein the indication of traffic quality comprises one or more of: (a) a latency indicator, or (b) a packet loss indicator.

13. The method as recited in claim 6 , wherein the indication of traffic quality comprises metrics aggregated based at least in part on one or more of: (a) a direction of traffic flow with respect to the provider network, or (b) a packet transfer sub-path location with respect to a provider network boundary.

14. The method as recited in claim 6 , further comprising:
receiving, by the traffic analyzer, a query from a client via a programmatic interface, wherein the query indicates one or more of (a) a time interval with respect to which a traffic quality indication is to be provided or (b) an address range with respect to which a traffic quality indication is to be provided; and
selecting, by the traffic analyzer, the one or more monitored packet groups based at least in part on the query.

15. The method as recited in claim 6 , further comprising:
identifying, at the first network processing component, a third packet as a candidate for monitoring, wherein the third packet is associated with the first virtual private network (VPN) connection;
in response to determining, at the first network processing component, that an acknowledgement with respect to the third packet has not been received within a selected time interval, cause a packet loss metric to be updated at the repository.

16. A non-transitory computer-accessible storage medium storing program instructions that when executed on one or more processors:
receive a particular network packet directed from a first endpoint of a virtual private virtual network (VPN) connection to a second endpoint of the VPN connection, wherein at least one endpoint of the first and second endpoints comprises a guest virtual machine established at a provider network on behalf of a cl

Assignees

• Amazon Tech Inc

Inventors

• Tillotson Paul John

Classifications

• H04W72/085

  Electricity · mapped topic

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04W24/08 Primary

  Testing, {supervising or monitoring} using real traffic · CPC title

• H04W24/04

  Arrangements for maintaining operational condition · CPC title