Steering of cloned traffic in a service function chain

• US 10,225,270 B2
• Filed: 08/02/2016
• Issued: 03/05/2019
• Est. Priority Date: 08/02/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Reddy, K. Tirumaleswar, Pignataro, Carlos M., Guichard, James, Wing, Daniel G., Geller, Michael D.
• Primary Examiner(s): Chen, Shin-Hon (Eric)
• Application Number:
  US15/226,758
• Publication Number:
  US 20180041524A1
• Time in Patent Office: 945 Days
• Field of Search: None
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/306 Route determination based on the nature of the carried application
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Aspects of the embodiments are directed to a service classifier configured for steering cloned traffic through a service function chain. The service classifier is configured to create a cloned data packet by creating a copy of a data packet; activate a mirror bit in a network service header (NSH) of the cloned data packet, the mirror bit identifying the cloned packet to a service function forwarder network element as a cloned packet; and transmit the cloned packet to the service function forwarder network element.

Claims

1. A computer-readable non-transitory medium comprising one or more instructions for steering cloned traffic in a service function chain, the instructions when executed on a processor are operable to:

create a plurality of cloned data packets by creating copies of a data packet;

activate a mirror bit in a network service header (NSH) of the cloned data packet, the mirror bit identifying the cloned packet to a service function forwarder network element as a cloned packet;

set an indicator in each of the cloned data packets, the indicator representing that the corresponding cloned data packet is to be dropped after processing by a service function forwarder;

identify a unique service path identifier for each cloned packet of the plurality of cloned packets; and

transmit each of the cloned packets to a corresponding service function forwarder network element simultaneously based on the service function path identifier.

2. The computer-readable non-transitory medium of claim 1, wherein the mirror bit is part of a base header of the NSH.

3. The computer-readable non-transitory medium of claim 1, the instructions further operable when executed to set a type length value (TLV) in the NSH to indicate that the cloned packet is a cloned packet to a service function forwarder network element.

4. The computer-readable non-transitory medium of claim 1, the instructions further operable when executed to set a service index (SI) in the NSH based on the length of a service function path.

5. The computer-readable non-transitory medium of claim 4, the instructions further operable when executed to set a service path identifier (SPI) in the NSH of the cloned packet.

6. The computer-readable non-transitory medium of claim 1, the instructions further operable when executed to:

receive a service function path for the plurality of cloned packets.

7. The computer-readable non-transitory medium of claim 6, the instructions further operable when executed to transmit each cloned packet to a corresponding service function forwarder network element based, at least in part, on the unique service path identifier.

8. The computer-readable non-transitory medium of claim 6, the instructions further operable when executed to determine that the data packet is to be cloned based, at least in part, on a determination that the data packet is to be analyzed for security or malware detection or for performance measurement.

9. The computer-readable non-transitory medium of claim 1, the instructions further operable when executed to transmit each cloned packet by one of unicast or multicast.

10. A service classifier network element of a service function chain, the service classifier network element comprising:

at least one memory element having instructions stored thereon;

at least one processors coupled to the at least one memory element and configured to execute the instructions to cause the service classifier network element to;

create a plurality of cloned data packets by creating copies of a data packet;

activate a mirror bit in a network service header (NSH) of the cloned data packet, the mirror bit identifying the cloned packet to a service function forwarder network element as a cloned packet;

set an indicator in each of the cloned data packets, the indicator representing that the corresponding cloned data packet is to be dropped after processing by a service function forwarder;

identify a unique service path identifier for each cloned packet of the plurality of cloned packets; and

transmit each of the cloned packets to a corresponding service function forwarder network element simultaneously based on the service function path identifier.

11. The service classifier network element of claim 10, wherein the mirror bit is part of a base header of the NSH.

12. The service classifier network element of claim 10, the instructions further operable when executed to set a type length value (TLV) in the NSH to indicate that the cloned packet is a cloned packet to a service function forwarder network element.

13. The service classifier network element of claim 10, the instructions further operable when executed to set a service index (SI) in the NSH based on the length of a service function path.

14. The service classifier network element of claim 13, the instructions further operable when executed to set a service path identifier (SPI) in the NSH of the cloned packet.

15. The service classifier network element of claim 10, the instructions further operable when executed to:

receive a service function path for the plurality of cloned packets.

16. The service classifier network element of claim 15, the instructions further operable when executed to transmit each cloned packet to a corresponding service function forwarder network element based, at least in part, on the unique service path identifier.

17. The service classifier network element of claim 15, the instructions further operable when executed to determine that the data packet is to be cloned based, at least in part, on a determination that the data packet is to be analyzed for security or malware detection.

18. The service classifier network element of claim 10, the instructions further operable when executed to transmit each cloned packet by one of unicast or multicast.

19. A method, comprising:

creating a plurality of cloned data packets by creating copies of a data packet;

activating a mirror bit in a network service header (NSH) of the cloned data packet, the mirror bit identifying the cloned packet to a service function forwarder network element as a cloned packet;

setting an indicator in each of the cloned data packets, the indicator representing that the corresponding cloned data packet is to be dropped after processing by a service function forwarder;

identifying a unique service path identifier for each cloned packet of the plurality of cloned packets; and

transmitting each of the cloned packets to a corresponding service function forwarder network element simultaneously based on the service function path identifier.

20. The method of claim 19, wherein the mirror bit is part of a base header of the NSH.