Efficient capture and streaming of data packets

• US 10,616,382 B2
• Filed: 09/02/2016
• Issued: 04/07/2020
• Est. Priority Date: 09/02/2016
• Status: Active Grant

• Current Assignee: Accedian Networks Inc. (Cisco Systems, Inc.)
• Original Assignee: Accedian Networks Inc. (Cisco Systems, Inc.)
• Inventors: Lizotte, Sylvain, Lamontagne, Marc-Andre, Gelinas, Marc, Viens, Yanick
• Primary Examiner(s): Wong, Xavier Szewai
• Application Number:
  US15/255,989
• Publication Number:
  US 20180069788A1
• Time in Patent Office: 1,313 Days
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 47/36 by determining packet size, e.g. maximum transfer unit [MTU]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

What is disclosed is a method for efficient capture and streaming of data packets in a network device comprises capturing data packets matching predetermined filters, packaging said data packets into samples, and aggregating one or more samples in a high speed bus payload. The method also comprises transferring said high speed bus payload to a CPU, extracting said samples from the high speed bus payload and storing said samples in a shared memory of the CPU, and accessing said samples from the shared memory for streaming to one or more client.

Claims

1. A method for efficient capture and streaming of data packets in a network device having an input port configured to receive packets from a network and an output port configured to deliver the packets to a target device connected thereto, the method comprising:

capturing, by a programmable processor, data packets matching predetermined filters that match flow filters defined for each port;

packaging said data packets into samples;

aggregating one or more samples in a high-speed bus payload;

transferring, from said programmable processor, said high speed bus payload to a Central Processing Unit (CPU);

extracting said samples from the high-speed bus payload and storing said samples in a shared memory of the CPU, the shared memory located in a kernel space of the CPU; and

accessing said samples from the shared memory for streaming to one or more client.

2. The method of claim 1, wherein said packaging comprises adding a header to the data packet.

3. The method of claim 1, wherein said filter operates via a layer-2 filtering protocol.

4. The method of claim 1, wherein said filter operates via a layer-3 filtering protocol.

5. The method of claim 1, further comprising queuing and shaping said payloads before transmitting on the high-speed bus.

6. The method of claim 1 wherein said high speed bus payload is an Ethernet payload.

7. The method of claim 1, wherein said transferring is done via an Ethernet bus.

8. A network device comprising:

an input port configured to receive packets from a network;

an output port configured to deliver the packets to a target device connected thereto;

a flow server having a packet capture engine in a programmable processor and a Central Processing Unit (CPU), the flow server is configured to;

analyze, by the programmable processor, the packets to identify at least one target packet; and

create meta-data containing information related to the at least one target packet, wherein the packet capture engine is configured to;

capture a copy of the at least one target packet that matches flow filters defined for each port;

create a sample comprising the meta-data and the copy of the at least one target packet; and

transfer the sample to the CPU; and

a flow client coupled to the flow server and configured to receive the sample from the flow server and store the sample in a database, wherein the sample is aggregated by the flow server in a high-speed bus payload and is transferred to the CPU.

9. The network device of claim 8 wherein the flow server is configured to filter the packets using filtering rules and to identify the target packet based on filtered packets matching one or more criteria.

10. The network device of claim 9 wherein the flow server is configured to filter the packets using a layer-2 filtering protocol.

11. The network device of claim 9 wherein the flow server is configured to filter the packets using a layer-3 filtering protocol.

12. The network device of claim 8 wherein the flow server is further configured to:

analyze the packets to identify at least two target packets;

capture a copy of the at least two target packets;

create meta-data containing information related to the at least two target packets; and

create the sample comprising the meta-data and the copy of the at least two target packets.

13. The network device of claim 8 wherein the flow server is further configured to:

extract the sample from the high-speed bus payload and store the sample in a shared memory of the CPU; and

access the sample from the shared memory to stream the sample to the flow client.

14. A non-transitory computer readable storage medium comprising instructions, which when executed by a processor, cause the processor to:

receive packets from a network through an input port;

deliver the packets to a target device connected thereto through an output port;

capture, by a programmable processor, one or more data packets of a packet flow matching predetermined filters defined for each port;

package the one or more data packets into a sample;

aggregate one or more samples in a high-speed bus payload;

transfer, from the programmable processor, said high speed bus payload to Central Processing Unit (CPU);

extract the one or more samples from the high-speed bus payload;

store the one or more samples in a shared memory of the CPU, the shared memory located in a kernel space of the CPU; and

access the one or more samples from the shared memory for streaming to one or more client.

15. The computer readable storage medium of claim 14 comprising further instructions that cause the processor to shape the aggregated one or more samples based on space in the shared memory available to store the one or more samples.

16. The computer readable storage medium of claim 14 comprising further instructions that cause the processor to package meta-data into the sample.

17. The computer readable storage medium of claim 16 wherein the meta-data comprises information selected from the group consisting of a length of the captured one or more data packets, a length of the sample, an identification of a port that received the packet flow, and an identification of the packet flow.

18. The computer readable storage medium of claim 14 comprising further instructions that cause the processor to filter data packets in the packet flow using a layer-2 filtering protocol.

19. The computer readable storage medium of claim 14 comprising further instructions that cause the processor to filter data packets in the packet flow using a layer-3 filtering.