Method to associate input and output interfaces with packets read from a mirror port

• US 20020075809A1
• Filed: 12/20/2000
• Published: 06/20/2002
• Est. Priority Date: 12/20/2000
• Status: Active Grant

• Current Assignee: InMon Corp.
• Original Assignee: InMon Corp.
• Inventors: Phaal, Peter
• Granted Patent: US 7,245,587 B2
• Time in Patent Office: Days
• US Class Current: 370/245
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

The network monitoring system includes a monitor device coupling to a network switch through a mirror port interface of the network switch. The network switch supports a number of regular port interfaces connected to different network components and the mirror port connected to the monitor device. The mirror port mirrors all network traffic of any selected regular port interfaces of the network switch. When the monitor device receives a data packet from the network switch, the monitor device extracts the network address information from such as the source and destination address from the data packet. The monitor device then examines internal lookup tables to determine whether there are corresponding physical port interface for the network address information. If the corresponding physical port interfaces for the network address information are not available in the lookup table, the monitor device interrogates the network switch for the corresponding physical port interface. The network address information is placed in a first-in-first-out buffer temporarily until the network switch responses to the monitor device'"'"'s request. Finally, the monitor device uses the physical port interface to perform further network analysis functions.

Claims

1. A method to monitor a network switch by a monitor device, said network switch having a plurality of regular ports and a mirror port, said mirror port being able to mirror network traffic for at least one of said regular ports, said network switch coupling to said monitor device through said mirror port, said network traffic comprising data packets forwarded between two of the plurality of regular ports, comprising:

(1) selecting at least one of said regular ports;

(2) mirroring a data packet of the selected port to said mirror port;

(3) forwarding said data packet to a monitor device;

(4) extracting the network address information of said data packet in said monitor device;

(5) determining port information of said network address information; and

(6) performing network analysis of said network switch.

2. The method to monitor a network switch according to claim 1, wherein said port information refers to physical information of said network address information in said network switch.

3. The method to monitor a network switch according to claim 2, wherein said determining step comprising:

interrogating said network switch to obtain said port information using said network address information.

4. The method to monitor a network switch according to claim 3, wherein said interrogating step comprising:

sending a first request to said network switch requesting a port index corresponding to said network address information; and

sending a second request to said network switch requesting said port information corresponding to said port index.

5. The method to monitor a network switch according to claim 4, wherein said first request and said second request are SNMP requests.

6. The method to monitor a network switch according to claim 1, wherein at least two of steps 1 to 6 perform independently and concurrently.

7. The method to monitor a network switch according to claim 5, wherein said determining step comprising:

placing said data packet in a first-in-first-out buffer waiting for responses from said network switch.

8. The method to monitor a network switch according to claim 7, wherein said determining step further comprising:

releasing said data packet from said first-in-first-out buffer after said network switch responds to said SNMP requests.

9. The method to monitor a network switch according to claim 7, wherein said determining step further comprising:

releasing said data packet from said first-in-first-out buffer after a predetermined period of time.

10. The method to monitor a network switch according to claim 1, further comprising:

maintaining at least one lookup table correlating said network address information with said port information.

11. The method to monitor a network switch according to claim 1, wherein said network address information comprises source address of said data packet.

12. The method to monitor a network switch according to claim 1, wherein said network address information comprises destination address of said data packet.

13. The method to monitor a network switch according to claim 1, wherein said network switch is a routing switch.

15. The method to monitor a network switch according to claim 14, wherein said port information refers to physical information of said network address information in said network switch.

16. The method to monitor a network switch according to claim 15, said network switch having a plurality of regular ports and a mirror port, said mirror port being able to mirror network traffic for at least one of said regular ports, said network switch coupling to said monitor device through said mirror port, wherein the data packets are forwarded from said network switch to said monitor device through said mirror port.

17. The method to monitor a network switch according to claim 16, wherein said network address information of said data packets comprises source addresses.

18. The method to monitor a network switch according to claim 16, wherein said network address information of said data packets comprises destination addresses.

19. The method to monitor a network switch according to claim 16, said network switch comprising a plurality of regular ports, wherein said data packets are forwarded to said monitor device by passively tapping at least one of said regular ports.

20. The method to monitor a network switch according to claim 16, wherein said determining step comprising:

interrogating said network switch to obtain said port information using said network address information.

21. The method to monitor a network switch according to claim 20, wherein said interrogating step comprising:

sending a first request to said network switch requesting a port index corresponding to said network address information; and

sending a second request to said network switch requesting said port information corresponding to said port index.

22. The method to monitor a network switch according to claim 21, wherein said first request and said second request are SNMP requests.

23. The method to monitor a network switch according to claim 22, wherein said determining step comprising:

placing said data packets in a first-in-first-out buffer waiting for responses from said network switch.

24. The method to monitor a network switch according to claim 23, wherein said determining step further comprising:

releasing said data packet from said first-in-first-out buffer after said network switch responds to said SNMP requests.

25. The method to monitor a network switch according to claim 23, wherein said determining step further comprising:

releasing said data packet from said first-in-first-out buffer after a predetermined period of time.

26. The method to monitor a network switch according to claim 14, further comprising:

maintaining at least one lookup table correlating said network address information with said port information.

27. The method to monitor a network switch according to claim 14, wherein said network switch is a routing switch.

14. A method to monitor a network switch by a monitor device, comprising:

(1) obtaining at least a portion of data packets being handled by said network switch to said monitor device, wherein each of said data packets comprises network address information;

(2) extracting, in said monitor device, said network address information of said data packets;

(3) determining the port information of said network address information; and

(4) performing network analysis of said network switch using said port information.