Distributed network troubleshooting using simultaneous multi-point packet capture

• US 10,250,450 B2
• Filed: 12/20/2016
• Issued: 04/02/2019
• Est. Priority Date: 06/29/2016
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Balakrishnan, Neelima, Ghodke, Ninad, Mehta, Rishi, Agrawal, Banit, Bolla, Ramya, Li, Siming
• Primary Examiner(s): Nguyen, Minh Trang T
• Application Number:
  US15/385,569
• Publication Number:
  US 20180006908A1
• Time in Patent Office: 833 Days
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Some embodiments provide a method for performing a multi-point capture of packets in a network. The method identifies multiple nodes for the multi-point capture in the network. The method configures each node of the multiple nodes to capture a set of packets. The method receives multiple captured packet sets from the multiple nodes. The method analyzes the multiple captured packet sets.

Claims

1. A method for performing a multi-point capture of packets in a network, the method comprising:

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a staggered start time by exchanging a number of packets with each node and computing a round-trip time for each node based on the exchanged packets for each node, wherein each node waits for the staggered start time before beginning a capture;

receiving a plurality of captured packet sets from the plurality of nodes; and

analyzing the plurality of captured packet sets.

2. The method of claim 1 further comprising receiving a configuration for the capture from an administrator of the network.

3. The method of claim 2, wherein the configuration comprises a packet filter, wherein configuring each node comprises configuring the node to only capture packets that match the packet filter.

4. The method of claim 3, wherein the packet filter identifies a source node and a destination node, wherein identifying the plurality of nodes comprises identifying a set of paths between the source node and the destination node.

5. The method of claim 2, wherein the configuration comprises a packet constraint, wherein each node is configured to only capture a portion of each packet, wherein the captured portion is defined by the packet constraint.

6. The method of claim 2 further comprising monitoring for events occurring in the network, wherein identifying the configuration is performed upon detecting a particular event.

7. The method of claim 1, wherein identifying the plurality of nodes is based on a network topology defined for the network.

8. The method of claim 7, wherein the network is a logical network, wherein the network topology is defined as a mapping of nodes of the logical network to nodes of the physical network.

9. The method of claim 8, wherein the identified plurality of nodes is from the logical network, wherein configuring each node of the plurality of nodes comprises:

based on the mapping of the network topology, identifying a corresponding node from the physical network; and

configuring the corresponding node from the physical network.

10. The method of claim 1, wherein the plurality of nodes comprises a first node on a first physical machine and a second node on a different second physical machine.

11. The method of claim 1, wherein the plurality of nodes comprises a first node and a second node on a same physical machine.

12. The method of claim 11, wherein the first and second nodes operate at different layers of a network stack operating on the physical machine.

13. The method of claim 1, wherein configuring each node comprises identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture.

14. A method for performing a multi-point capture of packets in a network, the method comprising:

receiving a configuration for the capture from an administrator of the network, wherein the configuration for the capture comprises a session length;

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a batch duration based on the session length and a set of properties of the particular node;

receiving a plurality of captured packet sets from the plurality of nodes by receiving a plurality of subsets of the set of captured packets, wherein each subset comprises packets captured during the batch duration; and

analyzing the plurality of captured packet sets.

15. The method of claim 14, wherein the set of properties of the particular node comprises an amount of memory.

16. A method for performing a multi-point capture of packets in a network, the method comprising:

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture, wherein identifying the staggered start time for a particular node comprises identifying the staggered start time based on previous communications with the particular node;

receiving a plurality of captured packet sets from the plurality of nodes; and

analyzing the plurality of captured packet sets.

17. A non-transitory machine readable medium storing a program which when executed by at least one processing unit performs a multi-point capture of packets in a network, the program comprising sets of instructions for:

receiving a configuration for the multi-point capture from an administrator of the network, wherein the configuration for the capture comprises a session length;

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a batch duration based on the session length and a set of properties of the particular node;

receiving, from the plurality of nodes, a plurality of captured packet sets comprising subsets of the set of captured packets, wherein each subset comprises packets captured during the batch duration; and

analyzing the plurality of captured packet sets.

18. The non-transitory machine readable medium of claim 17, wherein:

the configuration further comprises a packet filter that identifies a source node and a destination node;

the set of instructions for identifying the plurality of nodes comprises a set of instructions for identifying a set of paths between the source node and the destination node; and

the set of instructions for configuring each node comprises a set of instructions for configuring the node to only capture packets that match the packet filter.

19. The non-transitory machine readable medium of claim 17, wherein:

the configuration further comprises a packet constraint;

each node is configured to only capture a portion of each packet; and

the captured portion is defined by the packet constraint.

20. The non-transitory machine readable medium of claim 17, wherein the set of instructions for configuring each node comprises a set of instructions for identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture.

21. A non-transitory machine readable medium storing a program which when executed by at least one processing unit performs a multi-point capture of packets in a network, the program comprising sets of instructions for:

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture, the identified staggered start time for at least one particular node identified by exchanging a number of packets with each node and computing a round-trip time for each node based on the exchanged packets;

receiving a plurality of captured packet sets from the plurality of nodes; and

analyzing the plurality of captured packet sets.

22. A non-transitory machine readable medium storing a program which when executed by at least one processing unit performs a multi-point capture of packets in a network, the program comprising sets of instructions for:

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture, the identified staggered start time for at least one particular node identified based on previous communications with the particular node;

receiving a plurality of captured packet sets from the plurality of nodes; and

analyzing the plurality of captured packet sets.