Mirroring of a random subset of network traffic

• US 20070041332A1
• Filed: 08/19/2005
• Published: 02/22/2007
• Est. Priority Date: 08/19/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Albrecht, Alan, Jorgensen, Steven, Greenlaw, Jonathan
• Granted Patent: US 8,155,118 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/022 by sampling

Abstract

One embodiment disclosed relates to a method of mirroring network traffic. A data packet is received by a network device, and an algorithm including randomization is applied to determine whether the data packet is selected to be mirrored. The packet is sent to a destination port, and if the data packet is selected to be mirrored, then the packet is also sent to a mirror port. Another embodiment of the invention relates to a networking device. The networking device includes at least a plurality of ports, a switching/routing engine, and a mirroring engine. The plurality of ports receive and transmit packets therefrom, and the switching/routing engine is coupled to the ports for transferring the packets therebetween. The mirroring engine is configured to apply an algorithm including randomization to select data packets for mirroring. Other embodiments are also disclosed.

Claims

1. A method of mirroring network traffic, the method comprising:

receiving a data packet by a network device;

applying an algorithm including randomization to determine whether the data packet is selected to be mirrored;

sending the data packet to a destination port; and

if the data packet is selected to be mirrored, then also sending the data packet to a mirror port.

2. The method of claim 1, wherein applying the algorithm comprises sending a query to a random sampling circuit and receiving a response from the random sampling circuit.

3. The method of claim 1, wherein the network device comprises a networking switch having a plurality of ports.

4. The method of claim 1, wherein the networking device comprises a router.

5. The method of claim 1, further comprising:

receiving the data packet from the mirror port by a network analyzer coupled thereto.

6. The method of claim 1, further comprising applying the algorithm only if the packet is of a type to be mirrored.

7. The method of claim 1, further comprising categorizing the data packet into a monitoring class, wherein each monitoring class has an independently-configurable probability of random selection for mirroring.

8. A networking device comprising:

a plurality of ports for receiving and transmitting packets therefrom;

a switching/routing engine coupled to the ports for transferring the packets therebetween; and

a mirroring engine configured to apply an algorithm including randomization to select data packets for mirroring.

9. The networking device of claim 8, further comprising a random sampling circuit coupled to the mirroring engine, and the mirroring engine is configured to send a query to the random sampling circuit and receive a response from the random sampling circuit.

10. The networking device of claim 8, wherein the network device comprises a networking switch having a plurality of ports.

11. The networking device of claim 8, wherein the networking device comprises a router.

12. The networking device of claim 8, further comprising a network analyzer coupled to the mirror port and configured to receive and analyze the mirrored data packets.

13. The networking device of claim 8, wherein the networking device is configured to apply the algorithm including randomization only if the packet is of a type to be mirrored.

14. The networking device of claim 8, wherein the networking device is configured to categorize the data packet into a monitoring class, and wherein each monitoring class has an independently-configurable probability of random selection for mirroring.

15. An apparatus for mirroring of network traffic, the method comprising:

a plurality of ports configured to receive and send data packets;

means for applying an algorithm including randomization to determine whether a data packet is selected to be mirrored;

means for sending the data packet to a destination port and for sending the data packet to a monitoring port if the data packet is selected to be mirrored.