Sampling of network traffic based on CAM lookup

• US 20070047456A1
• Filed: 08/24/2005
• Published: 03/01/2007
• Est. Priority Date: 08/24/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Jorgensen, Steven, Greenlaw, Jonathan
• Granted Patent: US 8,050,185 B2
• Time in Patent Office: Days
• US Class Current: 370/250
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/7453 using hashing
• CPC Class Codes: H04L 49/208 Port mirroring
• CPC Class Codes: H04L 49/555 Error detection

Abstract

One embodiment disclosed relates to a method of sampling network traffic. A data packet is received by a network device. Information is extracted from fields in the data packet, and a look-up word is created using the extracted information. A content addressable memory is searched for entries matching the look-up word. If a match is found, then a sampling circuit is queried, and a response is received therefrom. The data packet may be sent to a destination port. In addition, if the response from the sampling circuit indicates that the data packet is chosen to be mirrored, then the data packet may be also sent to a mirror port. Other embodiments are also disclosed.

Claims

1. A method of sampling network traffic, the method comprising:

receiving a data packet by a network device;

extracting information from fields in the data packet;

creating a look-up word using the extracted information;

searching a content addressable memory for entries matching the look-up word; and

if a match is found, then querying a sampling circuit and receiving a response from the sampling circuit.

2. The method of claim 1, further comprising:

sending the data packet to a destination port; and

if the response from the sampling circuit indicates that the data packet is chosen to be mirrored, then sending the data packet to a mirror port.

3. The method of claim 1, wherein the content addressable memory comprises a binary content addressable memory.

4. The method of claim 1, wherein the content addressable memory comprises a ternary content addressable memory.

5. The method of claim 1, wherein the sampling circuit comprises a random sampling circuit.

6. The method of claim 1, wherein the sampling circuit comprises a non-random sampling circuit.

7. The method of claim 1, wherein the look-up word is formed using information extracted from at least one field in a MAC header.

8. The method of claim 1, wherein the data packet comprises an Internet Protocol (IP) packet, and wherein the look-up word is formed using information extracted from at least one field in an IP header.

9. A networking device comprising:

a plurality of ports for receiving packets into the networking device and for transmitting packets from the networking device;

an operating system for controlling the networking device;

a sampling circuit;

a content addressable memory; and

a mirroring module configured to extract information from header fields of the packet, to create a look-up word from the extracted information, to search the content addressable memory for any entries matching the look-up word, and to query the sampling circuit if a match is found.

10. The networking device of claim 9, wherein a response to the query is received by the mirroring module from the sampling circuit, and wherein if the response from the sampling circuit indicates that the packet is chosen to be mirrored, then the packet is sent to a mirror port.

11. The networking device of claim 9, wherein the content addressable memory comprises a binary content addressable memory.

12. The networking device of claim 9, wherein the content addressable memory comprises a ternary content addressable memory.

13. The networking device of claim 9, wherein the sampling circuit comprises a random sampling circuit.

14. The networking device of claim 9, wherein the sampling circuit comprises a non-random sampling circuit.

15. The networking device of claim 9, wherein the look-up word is formed using information extracted from at least one field in a MAC header.

16. The networking device of claim 9, wherein the data packet comprises an Internet Protocol (IP) packet, and wherein the look-up word is formed using information extracted from at least one field in an IP header.

17. An apparatus for mirroring of network traffic, the apparatus comprising:

a plurality of ports configured to receive and send data packets;

means for obtaining information from fields in the data packet;

means for generating creating a look-up word using the extracted information;

means for matching entries in a content addressable memory with the look-up word; and

means for querying a sampling circuit and receiving a response from the sampling circuit, if a match is found.

18. The apparatus of claim 17, further comprising:

means for transmitting the data packet to a destination port; and

means for transmitting the data packet to a mirror port if the response from the sampling circuit indicates that the data packet is chosen to be mirrored.

19. The apparatus of claim 17, wherein the look-up word is formed using information extracted from at least one field in a MAC header.

20. The apparatus of claim 17, wherein the data packet comprises an Internet Protocol (IP) packet, and wherein the look-up word is formed using information extracted from at least one field in an IP header.