Methods, systems, and computer readable media for packet monitoring in a virtual environment

Patent metadata

Field	Value
Publication number	US-9967165-B2
Application number	US-201514960865-A
Country	US
Kind code	B2
Filing date	Dec 7, 2015
Priority date	Dec 7, 2015
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

Methods, systems, and computer readable media for packet monitoring in a virtual environment are disclosed. According to one method, the method occurs at a virtual tap controller implemented using at least one processor. The method includes sending, to a virtual tap in a virtual environment implemented using at least one computing platform, at least one summarization rule for generating summary packet information about packet traffic associated with the virtual environment. The method also includes receiving, from the virtual tap, the summary packet information generated using the at least one summarization rule. The method further includes generating, using the summary packet information, at least one processing rule for copying or forwarding packet data associated with the virtual environment and sending, to the virtual tap, the at least one processing rule.

First claim

What is claimed is:

1. A method for packet monitoring in a virtual environment, the method comprising:
at a virtual tap controller implemented using at least one processor:
sending, to a virtual tap in a virtual environment implemented using at least one computing platform, at least one summarization rule for generating summary packet information about packet traffic associated with the virtual environment;
receiving, from the virtual tap, the summary packet information generated using the at least one summarization rule;
generating, using the summary packet information, at least one processing rule for copying or forwarding packet data associated with the virtual environment; and
sending, to the virtual tap, the at least one processing rule, wherein generating the at least one processing rule includes using the summary packet information to identify a virtual machine (VM) or a virtualization container contributing to a network condition and generating the at least one processing rule for instructing the virtual tap to copy or forward packet data associated with the VM or the virtualization container.

2. The method of claim 1 comprising:
implementing, by the virtual tap, the at least one summarization rule or the at least one processing rule dynamically using a software hook or a representational state transfer (REST) application programming interface (API).

3. The method of claim 1 comprising:
receiving, from the virtual tap, the packet data associated with the virtual environment; and
performing at least one action using the packet data.

4. The method of claim 3 wherein the at least one action includes sending a command to a virtual machine (VM) associated with the virtual environment, wherein the command instructs the VM to terminate, start, restart, stop, or pause.

5. The method of claim 1 wherein the at least one processing rule instructs the virtual tap to send the packet data after an amount of time elapses, after an amount of packet data reaches or exceeds a threshold, after a condition is detected, or after a request from the virtual tap controller.

6. The method of claim 1 wherein the at least one summarization rule instructs the virtual tap to send the summary packet information after an amount of time elapses, after an amount of packet data reaches or exceeds a threshold, after a condition is detected, or after a request from the virtual tap controller.

7. The method of claim 1 wherein the virtual tap and the virtual tap controller are implemented using the at least one computing platform.

8. The method of claim 1 wherein the virtual tap is implemented using the at least one computing platform and the virtual tap controller is implemented using a separate computing platform.

9. A system for packet monitoring in a virtual environment, the system comprising:
at least one processor; and
a virtual tap controller implemented using the at least one processor, wherein the virtual tap controller is configured to send, to a virtual tap in a virtual environment implemented using at least one computing platform, at least one summarization rule for generating summary packet information about packet traffic associated with the virtual environment, to receive, from the virtual tap, the summary packet information generated using the at least one summarization rule, to generate, using the summary packet information, at least one processing rule for copying or forwarding packet data associated with the virtual environment, and to send, to the virtual tap, the at least one processing rule, wherein generating the at least one processing rule includes using the summary packet information to identify a virtual machine (VM) or a virtualization container contributing to a network condition, wherein the at least one processing rule instructs the virtual tap to copy or forward packet data associated with the VM or the virtualization container.

10. The system of claim 9 wherein the virtual tap is configured to implement the at least one summarization rule or the at least one processing rule dynamically using a software hook or a representational state transfer (REST) application programming interface (API).

11. The system of claim 9 wherein the virtual tap controller is configured to receive, from the virtual tap, the packet data associated with the virtual environment and to perform at least one action using the packet data.

12. The system of claim 11 wherein the at least one action includes sending a command to a virtual machine (VM) associated with the virtual environment, wherein the command instructs the VM to terminate, start, restart, stop, or pause.

13. The system of claim 9 wherein the at least one processing rule instructs the virtual tap to send the packet data after an amount of time elapses, after an amount of packet data reaches or exceeds a threshold, after a condition is detected, or after a request from the virtual tap controller.

14. The system of claim 9 wherein the at least one summarization rule instructs the virtual tap to send the summary packet information after an amount of time elapses, after an amount of packet data reaches or exceeds a threshold, after a condition is detected, or after a request from the virtual tap controller.

15. The system of claim 9 wherein the virtual tap and the virtual tap controller are implemented using the at least one computing platform.

16. The system of claim 9 wherein the virtual tap is implemented using the at least one computing platform and the virtual tap controller is implemented using a separate computing platform.

17. A non-transitory computer readable medium having stored thereon executable instructions embodied in the computer readable medium that when executed by at least one processor of a virtual tap controller cause the virtual tap controller to perform steps comprising:
at a virtual tap controller implemented using at least one processor:
sending, to a virtual tap in a virtual environment implemented using at least one computing platform, at least one summarization rule for generating summary packet information about packet traffic associated with the virtual environment;
receiving, from the virtual tap, the summary packet information generated using the at least one summarization rule;
generating, using the summary packet information, at least one processing rule for copying or forwarding packet data associated with the virtual environment; and
sending, to the virtual tap, the at least one processing rule, wherein generating the at least one processing rule includes using the summary packet information to identify a virtual machine (VM) or a virtualization container contributing to a network condition and generating the at least one processing rule for instructing the virtual tap to copy or forward packet data associated with the VM or the virtualization container.

18. The non-transitory computer readable medium of claim 17 having stored thereon executable instructions embodied in the computer readable medium that when executed by at least one processor of the at least one computing platform cause the virtual tap to perform steps comprising:
implementing the at least one summarization rule or the at least one processing rule dynamically using a software hook or a representational state transfer (REST) application programming interface (API).

Assignees

• Ixia
• Keysight Tech Singapore Holdings Pte Ltd

Inventors

• Arora Deepesh Satish
• Majumder Anirban

Classifications

• H04L43/026

  using flow identification · CPC title

• H04L43/062

  related to network traffic · CPC title

• H04L43/00

  Arrangements for monitoring or testing data switching networks · CPC title

• H04L43/0876 Primary

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title