METHOD, APPARATUS AND SYSTEM FOR MONITORING NETWORK CONDITIONS VIA A STACKED TOPOLOGY OF NETWORK CAPTURED TRAFFIC DISTRIBUTION DEVICES

• US 20110080829A1
• Filed: 10/05/2010
• Published: 04/07/2011
• Est. Priority Date: 10/05/2009
• Status: Abandoned Application

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: VSS Monitoring Incorporated (NetScout Systems Incorporated)
• Inventors: Hinshaw, Jan Allen, Kucharczyk, David, Breslin, Terence M.
• Application Number:
  US12/898,583
• Publication Number:
  US 20110080829A1
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00

Abstract

Methods, systems, computer-readable media, and devices for monitoring a stacked topology of network captured traffic distribution devices and/or a device or network connected thereto are described. For example, a network captured traffic distribution device communicatively coupled to a plurality of network captured traffic distribution devices arranged in a stacked topology via a communication link may monitor a status of the stacked topology, a network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the stacked topology, and/or a network device communicatively coupled to the stacked topology. Configuration information included in the network captured traffic distribution device may be updated responsively to the monitoring.

Claims

1. A method comprising:

monitoring, by a network captured traffic distribution device communicatively coupled to a plurality of network captured traffic distribution devices arranged in a stacked topology via a plurality of communication links, a status of at least one of the stacked topology, a network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the stacked topology, and a network device communicatively coupled to the stacked topology;

detecting, by the network captured traffic distribution device, a change in the status of at least one of the stacked topology, a network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the stacked topology, and a network device communicatively coupled to the stacked topology; and

adjusting, by the network captured traffic distribution device, the configuration information included in the network captured traffic distribution device responsively to the detected change.

2. The method of claim 1, further comprising:

transmitting, by the network captured traffic distribution device, at least one of the detected change and the adjusted configuration information to an additional network captured traffic distribution device included in the stacked topology.

3. The method of claim 2, further comprising:

receiving the transmitted at least one of the detected change and the adjusted configuration information at the additional network captured traffic distribution device; and

adjusting, by the additional network captured traffic distribution device, the configuration information included in the additional network captured traffic distribution device responsively to the received at least one of the detected change and the adjusted configuration information.

4. The method of claim 1, wherein the monitored status relates to at least one of a level of congestion for the stacked topology, a network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the stacked topology, and a network device communicatively coupled to the stacked topology, an operational status of the stacked topology, a network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the stacked topology, and a network device communicatively coupled to the stacked topology, and a detected intrusion, by an unauthorized user, to at least one of the stacked topology of the network captured traffic distribution devices, the network communicatively coupled to the stacked topology, and the network device communicatively coupled to the stacked topology.

5. The method of claim 1, wherein the detected change is at least one of a communication link failure, a failure of the network captured traffic distribution device, a security breach, a suspected denial of service attack, a power failure, the addition of a network captured traffic distribution device to the stacked topology, the removal of a network captured traffic distribution device from the stacked topology, and a change in the status of a network device communicatively coupled to the stacked topology.

6. The method of claim 1, wherein the network captured traffic distribution device is configured to receive a traffic flow of captured data packets, determine a target destination of a captured data packet included in the received traffic flow of captured data packets, and determine a plurality of routes through the stacked topology from the network captured traffic distribution device to the target destination, the method further comprising:

updating, by the network captured traffic distribution device, the determined plurality of routes responsively to the detected change;

analyzing, by the network captured traffic distribution device, each of the updated plurality of determined routes;

selecting, by the network captured traffic distribution device, an optimum route from the plurality of determined routes based on the analysis; and

transmitting, by the network captured traffic distribution device, the captured data packet toward the target destination via the selected optimum route.

7. The method of claim 1, further comprising:

receiving, by the network captured traffic distribution device, a traffic flow of captured network traffic, wherein the traffic flow includes captured data packets and each data packet is associated with at least one characteristic;

determining, by the network captured traffic distribution device, the at least one characteristic of each data packet; and

performing, by the network captured traffic distribution device responsively to the one or more determined characteristics, at least one of filtering out a captured data packet from the traffic flow of captured network traffic, aggregating two or more captured data packets, determining a target destination of a captured data packet, determining a plurality of routes for transmission of a data packet through the stacked topology from the network captured traffic distribution device to a target destination, updating a determined plurality of routes responsively to the detected change, selecting an optimum route from the updated plurality of determined routes, truncating a captured data packet, adding information to a data packet, and subtracting information from a data packet.

8. The method of claim 7, wherein the at least one characteristic is at least one of a type of a data packet, a source of a data packet, a size of a data packet, an origin of a data packet, a speed at which a data packet is received, a format of a data packet, an encryption protocol used to encrypt a data packet, content included in a data packet, and a target destination of a data packet.

9. The method of claim 1, further comprising:

determining, by the network captured traffic distribution device, an additional network captured traffic distribution device included in the stacked topology that includes configuration information affected by the detected change; and

selectively transmitting, by the network captured traffic distribution device responsively to the determination, at least one of the detected change and the adjusted configuration information to the additional network captured traffic distribution device including configuration information affected by the change.

10. A network captured traffic distribution device, comprising:

a plurality of bi-directional ports configured to perform at least one of receiving captured network traffic and echoing received captured network traffic to one or more of the plurality of bi-directional ports;

an egress port configured to transmit received captured network traffic externally from the network captured traffic distribution device;

a stacking port configured to enable, via a communication link, the stacking of the network captured traffic distribution device with at least one additional network captured traffic distribution device in a stacked topology wherein the stacking includes an exchange of configuration information between the network captured traffic distribution device and the additional network captured traffic distribution device;

a processor configured to manage distribution of received captured network traffic through the network captured traffic distribution device, monitor a status of at least one of the stacked topology, the network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the stacked topology, and a network device communicatively coupled to the stacked topology, detect a change in the status of at least one of the stacked topology, the network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the stacked topology, and a network device communicatively coupled to the stacked topology, and adjust the configuration information stored in a memory responsively to a detected change; and

the memory configured to store configuration information associated with the network captured traffic distribution device and an adjustment to the configuration information.

11. The network captured traffic distribution device of claim 10, wherein the processor is further configured to determine a target destination of a captured data packet included in a received traffic flow of captured data packets, determine a plurality of routes through the stacked topology from the network captured traffic distribution device to the target destination, update the determined plurality of routes responsively to the detected change, analyze each of the updated plurality of determined routes, select an optimum route from the updated plurality of determined routes based on the analysis, and transmit the captured data packet toward the target destination via the selected optimum route.

12. The network captured traffic distribution device of claim 10, wherein the memory is further configured to store at least one of an Internet protocol (IP) address associated with the network captured traffic distribution device, configuration information for the network captured traffic distribution device, data regarding at least one of received captured network traffic and the management of received captured network traffic, a detected change in the status of at least one of the stacked topology, the network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the network captured traffic distribution device, and a network device communicatively coupled to the network captured traffic distribution device, and an adjustment to the configuration information included in the network captured traffic distribution device.

13. The network captured traffic distribution device of claim 10, wherein the stacking port is further configured to enable the network captured traffic distribution device to be stacked in at least one of a ring topology, a mesh topology, a star topology, a topology of single links, a topology of multiple links, a topology including one or more redundant links, and some combination thereof.

14. The network captured traffic distribution device of claim 10, wherein at least one of the bi-directional ports, the egress port, and the stacking port is compatible with at least one of a 10/100 Ethernet cable, a 1 gigabit Ethernet cable, a 10 gigabit Ethernet cable, a copper cable, and a fiber cable.

15. The network captured traffic distribution device of claim 10, wherein the processor is further configured to manage distribution of received captured network traffic through the stacked topology.

16. The network captured traffic distribution device of claim 10, wherein the configuration information includes instructions regarding at least one of determining a target destination for received captured network traffic, pre-calculating at least one route for the transmission of received captured network traffic from the network captured traffic distribution device through the stacked topology to a target destination, determining an optimum route for the transmission of captured network traffic from the network captured traffic distribution device through the stacked topology to a target destination, evaluating a current operating condition of the stacked topology, grooming received captured network traffic, load balancing a distribution of received captured network traffic through the stacked topology, removing information from one or more data packets included in received captured network traffic, truncating one or more data packets included in received captured network traffic, load spreading a distribution of received captured network traffic through the stacked topology, filtering received captured network traffic transmitted through the stacked topology according to a criterion, aggregating captured network traffic transmitted through the stacked topology, altering the content of received captured network traffic, truncating one or more data packets included in received captured network traffic, adding information to one or more data packets included in received captured network traffic, and subtracting information from one or more data packets included in received captured network traffic.

17. The network captured traffic distribution device of claim 10, wherein the stacking port is a monitor port.

18. A machine-readable media storing a set of instructions executable by a machine, wherein the execution of the instructions includes:

monitoring, by a network captured traffic distribution device communicatively coupled to a plurality of network captured traffic distribution devices arranged in a stacked topology via a plurality of communication links, a status of at least one of the stacked topology, the network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the network captured traffic distribution device, and a network device communicatively coupled to the network captured traffic distribution device;

detecting, by the network captured traffic distribution device, a change in the status of at least one of the stacked topology, the network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the network captured traffic distribution device, and a network device communicatively coupled to the network captured traffic distribution device;

adjusting, by the network captured traffic distribution device, the configuration information included in the network captured traffic distribution device responsively to the detected change; and

transmitting at least one of the detected change and the adjusted configuration information to an additional the network captured traffic distribution device included in the stacked topology.