System, method and apparatus for traffic mirror setup, service and security in communication networks

• US 20060059163A1
• Filed: 08/19/2005
• Published: 03/16/2006
• Est. Priority Date: 08/20/2004
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Enterasys Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Graham, Richard W., Frattura, David E., Roese, John
• Granted Patent: US 8,819,213 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

The present invention provides method and systems for dynamically mirroring network traffic. The mirroring of network traffic may comprise data that may be considered of particular interest. The network traffic may be mirrored by a mirror service portal from a mirror sender, referred to as a mirror source, to a mirror receiver, referred to as a mirror destination, locally or remotely over various network segments, such as private and public networks and the Internet. The network traffic may be mirrored to locations not involved in the network communications being mirrored. The present invention provides various techniques for dynamically mirroring data contained in the network traffic from a mirror source to a mirror destination.

Claims

1. A method for dynamically mirroring network traffic, the method comprising:

monitoring an operational characteristic of a network for a criterion; and

dynamically initiating traffic mirroring upon detection of the criterion in the monitored operation characteristic of the network.

2. The method of claim 1, wherein the traffic mirroring is dynamically initiated in response to a policy based upon the detected criterion.

3. The method of claim 1, wherein the traffic mirroring is dynamically initiated in response to a trigger based upon the detected criterion.

4. The method of claim 1, wherein the operation characteristic comprises network usage.

5. The method of claim 1, wherein the operational characteristic comprises network traffic.

6. The method of claim 1, wherein the criterion comprises an aspect of the monitored operation characteristic.

7. The method of claim 1, wherein the criterion comprises an event in the monitored operation characteristic.

8. The method of claim 1, wherein only a portion of the monitored traffic is mirrored.

9. The method of claim 1, further comprising providing additional data related to the mirrored traffic.

10. The method of claim 1, further comprising buffering mirrored traffic.

11. The method of claim 1, wherein dynamically initiating traffic mirroring comprises making policy changes to the network based on requirements for traffic mirroring.

12. The method of claim 1, wherein dynamically initiating traffic mirroring further comprises establishing a mirror service portal.

13. The method of claim 12, wherein establishing a mirror service portal comprises identifying available mirror destinations for the mirror service portal.

14. The method of claim 13, wherein the mirror service portal is established based on defined/established parameters

15. The method of claim 14, wherein the defined/established parameters comprise the bandwidth limitations of the mirror service portal.

16. The method of claim 15, wherein the defined/established parameters comprise the desired quality of service for the mirror service portal.

17. The method of claim 15, wherein the defined/established parameters comprise the security requirements of the mirror service portal.

18. The method of claim 15, wherein the defined/established parameters comprise the requirements of a destination for the mirror service portal.

19. The method of claim 12, wherein establishing a mirror service portal comprises:

establishing a mirror source for mirroring traffic;

establishing a mirror destination for receiving mirrored traffic;

communicating, by the mirror source, the mirrored traffic to the mirror destination.

20. The method of claim 19, wherein the mirrored traffic is communicated using a tunneling protocol.

21. A medium for use with an electronic device holding instructions executable by the electronic device for performing a method, the method comprising:

monitoring network traffic for a criterion; and

dynamically initiating traffic mirroring upon detection of a criterion in the monitored network traffic.

22. A system for dynamically mirroring network traffic, the system comprising:

a mirror source for providing mirrored traffic;

a mirror destination for receiving mirrored traffic from the source;

wherein a mirror service portal between the source and the destination is established upon a criterion being met.

23. The system of claim 22, wherein the mirror service portal is established using a tunneling protocol

24. The system of claim 23, wherein the tunneling protocol comprises a protocol selected from one of Mac-in-Mac tunneling;

IEEE 802.1 backbone provider bridging;

Internet Protocol in Internet Protocol Tunneling;

Generic Router Encapsulation Tunneling;

Point to Point Protocol;

Layer 2 tunneling protocol version 2;

Layer 2 tunneling protocol version 3;

IP Security tunnels;

or GPRS tunneling protocol.

25. A network device for dynamically mirroring network traffic, the device comprising:

a traffic monitor function for monitoring network traffic; and

a mirror source function for receiving a unit of network traffic when a criterion is met and mirroring the unit of data to a destination point.

26. The network device of claim 25 further comprising a network interface for communicating the traffic unit to a mirror destination.

27. The network device of claim 25, further comprising a media tapping function.