System and method for flow mirroring in a network switch

• US 20010055274A1
• Filed: 02/22/2001
• Published: 12/27/2001
• Est. Priority Date: 02/22/2000
• Status: Abandoned Application

• Current Assignee: Top Layer Networks, Inc. (Corero Network Security Plc)
• Original Assignee: Top Layer Networks, Inc. (Corero Network Security Plc)
• Inventors: Narayanaswamy, Krishna, Spinney, Barry A., Lindsay, Charles C., Ross, Theodore Langston, Hegge, Doug
• Application Number:
  US09/791,517
• Publication Number:
  US 20010055274A1
• Time in Patent Office: Days
• US Class Current: 370/229
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 49/208 Port mirroring
• CPC Class Codes: H04L 49/3036 Shared queuing
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A network switch has a plurality of mirror ports to which data is copied for purposes such as networking monitoring. Data flows are identified and copied to an appropriate mirror port in response to the type of flow, a mirroring policy set up by a network administrator, and a distribution mechanism. A monitoring device attached to each mirror port is able to monitor specific types of traffic. Because the data flows are distributed among a plurality of mirror ports and monitoring devices, the ports and devices are less likely to overflow and therefore are more likely to be able handle the copied data without dropping data packets. The mirror ports are collected into groups of such ports. A given port may only be a member of a single group at one time. The mirroring policy must identify the group to which a particular type of flow is copied.

Claims

1. A process for flow mirroring in an information network switch comprising:

a) receiving information at an ingress port;

b) determining whether said information is a part of a particular flow of information that is a member of a preselected group of flows of information; and

c) copying said information and forwarding one of the copies to a mirror port if said information is determined to be part of said particular flow.

2. A process for flow mirroring in a data packet network switch comprising:

a) receiving a data packet at an ingress port;

b) determining whether said data packet is a part of a preselected particular flow of data packets;

a) copying said data packet and forwarding one of the copies to a mirror port if said data packet is determined to be part of said particular flow.

3. The process of

claim 2

wherein, if said data packet is not determined to be part of said first particular flow, step (b) further comprises determining whether said data packet is part of a second particular flow of data packets and step (c) further comprises copying said data packet and forwarding one of the copies to a second mirror port if said data packet is determined to be part of said second particular flow.

4. The process of

claim 2

wherein said mirror port is one of a predefined group of several mirror ports.

5. The process of

claim 3

wherein said second mirror port is one of a predefined group of several mirror ports that do not include any mirror port to which a data packet determined to be part of said first particular flow would be forwarded according to step (c).

6. The process of

claim 2

wherein said particular flow is selected according to the destination of said flow.

7. The process of

claim 2

wherein said particular flow is selected according to the application of said flow.

8. The process of

claim 2

wherein said particular flow is selected during the normal switching operation of said data packet switch.

9. The process of

claim 2

wherein said predefined group of mirror ports is selected during the normal switching operation of said data packet switch.

10. The process of

claim 2

wherein all packets part of said flow are forwarded to said mirror port.

11. The process of

claim 2

wherein all packets part of a context are forwarded to said mirror port.

12. The process of

claim 4

wherein all packets part of said flow are forwarded to one mirror port among said predefined group of mirror ports, said one mirror port selected for said flow using a round-robin procedure of selection among said predefined group of ports for different flows received by said data packet switch.

13. The process of

claim 4

wherein all packets part of said flow are forwarded to one mirror port among said predefined group of mirror ports, said one mirror port selected for said flow using a procedure of selection among said predefined group of ports for different flows received by said data packet switch in which flows belonging to a particular application receive priority in a given interval over flows belonging to another application.

14. The process of

claim 13

wherein flows belonging to a particular application receive said priority based on the processing load presented by said flows at said mirror port.

15. The process of

claim 4

wherein all packets part of said flow are forwarded to a particular mirror port among said predefined group of mirror ports where special processing is provided for said flow at said particular mirror port.

16. The process of

claim 4

wherein all packets part of said flow are forwarded to one mirror port among said predefined group of mirror ports, said one mirror port selected for said flow using a procedure of selection among said predefined group of ports for different flows received by said data packet switch assigning an equal number of active flows at each mirror port of said group.

17. The process of

claim 4

wherein all packets part of said flow are forwarded to one mirror port among said predefined group of mirror ports, said one mirror port selected for said flow using a procedure of selection among said predefined group of ports for different flows received by said data packet switch based on average relative traffic levels seen at individual ones of said predefined group of mirror ports.

18. The process of

claim 4

wherein all packets part of said flow are forwarded to one mirror port among said predefined group of mirror ports, said one mirror port selected for said flow using a procedure of selection among said predefined group of ports for different flows received by said data packet switch wherein individual monitoring devices at each of said predefined group of mirror ports signal to said data packet switch when it is appropriate to send additional flows to their respective ports.

19. The process of

claim 18

comprising the further step of detecting failures among said monitoring devices.

20. The process of

claim 18

comprising the further step by one of said monitoring devices to signal to said data packet switch that a flow need no longer be monitored.

21. The process of

claim 18

comprising the further step of dynamically establishing at said data packet switch in response to information received from said monitoring devices admission and quality of service policies used by said data packet switch for existing flows and flows to be established.

22. A network switch, comprising:

at least one ingress port to receive data packets into the switch;

at least one egress port to transport data packets out of the switch;

a mirror port; and

a switch processor that routes said data packets on said at least one egress port, determines which of said received data packets are members of a group of at least one particular flow and to copy said member packets to said mirror port.

23. The network switch of

claim 22

further comprising:

a plurality of mirror ports, said switch processor to copy packets belonging to said flow to at least one of said plurality of mirror ports.

24. The network switch of

claim 22

, further comprising:

a plurality of mirror ports, said switch processor to copy packets belonging to said flow to a plurality of said mirror ports.

25. The network switch of

claim 22

further comprising a plurality of mirror ports, said plurality of mirror ports divided into a plurality of groups of mirror ports wherein said switch processor forwards packets to one of said plurality of groups of mirror ports.