METHOD, APPARATUS AND SYSTEM FOR FILTERING CAPTURED NETWORK TRAFFIC

• US 20110087772A1
• Filed: 10/05/2010
• Published: 04/14/2011
• Est. Priority Date: 10/05/2009
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: VSS Monitoring Incorporated (NetScout Systems Incorporated)
• Inventors: Hinshaw, Jan Allen, Kucharczyk, David, Breslin, Terence M.
• Granted Patent: US 9,148,358 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00

Abstract

Methods, systems, computer-readable media, and devices for filtering captured network traffic received by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are described. Methods, systems, computer-readable media, and devices for applying a plurality of filters to received captured network traffic by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are also described. Applying a plurality of filters to the received captured traffic may generate a plurality of filtered captured traffic sets. In some instances, filtered captured network traffic sets that have similar target destinations may be aggregated together and transmitted toward the target destination.

Claims

1. A method comprising:

receiving instructions, at a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology, to filter received captured network traffic according to one or more criterion;

receiving captured network traffic by the network captured network traffic distribution device;

filtering, by the network captured network traffic distribution device, the received captured network traffic responsively to the received instructions;

determining, by the network captured network traffic distribution device, a target destination of filtered captured network traffic; and

transmitting, by the network captured network traffic distribution device, the filtered captured network traffic toward the determined target destination.

2. The method of claim 1, wherein the determination of the target destination of the filtered captured network traffic is based on the criterion used to filter the received captured network traffic.

3. The method of claim 1, wherein the criterion for filtering the received captured network traffic is at least one of a type of received captured network traffic, a source of the received captured network traffic, a size of a data packet included in the captured network traffic, an origin of the received captured network traffic, a rate at which the received captured network traffic is received, and the target destination of the received captured network traffic.

4. The method of claim 1, wherein the network captured traffic distribution device includes a plurality of input ports and the received instructions include applying a filter to all captured network traffic received via an input port of the plurality of input ports.

5. The method of claim 1, further comprising:

transmitting the received filtering instructions from the network captured traffic distribution device to at least one additional network captured traffic distribution device included in the stacked topology.

6. The method of claim 1, wherein the instructions are received via a graphic user interface (GUI).

7. The method of claim 1, wherein the target destination is at least one of a monitoring device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an Internet protocol television (IPTV) analyzer, an application analyzer, a voice analyzer, and a forensic analyzer.

8. The method of claim 1, wherein the received network traffic is received via at least one of a traffic capture device positioned at a traffic capture point located between two communication nodes and a mirror port of a network switch.

9. A method comprising:

receiving captured network traffic at a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology;

applying, by the network captured traffic distribution device, a plurality of filters to the captured network traffic;

generating, by the network captured traffic distribution device, a plurality of filtered captured network traffic sets from the filtered captured network traffic;

determining, by the network captured network traffic distribution device, a target destination of each filtered captured network traffic set;

determining, by the network captured traffic distribution device, whether any of the sets of filtered captured network traffic have a similar target destination;

aggregating, by the network captured traffic distribution device, filtered captured network traffic sets with the similar target destination; and

transmitting, by the network captured traffic distribution device, aggregated filtered captured network traffic toward the target destination determined for the aggregated filtered captured network traffic.

10. The method of claim 9, wherein the target destination is at least one of a monitoring device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an Internet protocol television (IPTV) analyzer, an application analyzer, a voice analyzer, and a forensic analyzer.

11. The method of claim 9, wherein the received network traffic is received via at least one of a traffic capture device positioned at a traffic capture point located between two communication nodes and a mirror port of a network switch.

12. An apparatus comprising:

a plurality of bi-directional ports configured to receive instructions to filter received captured network traffic according to one or more criterion and perform at least one of receiving captured network traffic and echoing received captured network traffic to one or more of the plurality of bi-directional ports;

an egress port configured to transmit received captured network traffic to an external device;

a stacking port configured to enable, via a communication link, the stacking of the network captured traffic distribution device with at least one additional network captured traffic distribution device in a stacked topology wherein the stacking includes an exchange of configuration information between the network captured traffic distribution device and the additional network captured traffic distribution device; and

a processor configured to filter the received captured network traffic responsively to the received instructions and manage distribution of received captured network traffic through the network captured traffic distribution device.

13. The apparatus of claim 12, wherein the stacking port is configured to enable the network captured traffic distribution device to be stacked in at least one of a ring topology, a mesh topology, a star topology, a topology of single links, a topology of multiple links, a topology including one or more redundant links, and some combination thereof.

14. The apparatus of claim 12, wherein at least one of the bi-directional ports, the egress port, and the stacking port is compatible with at least one of a 10/100 Ethernet cable, a 1 gigabit Ethernet cable, a 10 gigabit Ethernet cable, a copper cable, and a fiber cable.

15. The apparatus of claim 12, wherein the processor is further configured to enable peer-to-peer communication between the network captured traffic distribution device and the additional stacked network captured traffic distribution device.

16. The apparatus of claim 12, wherein the processor is further configured to manage distribution of received captured network traffic through the stacked topology.

17. The apparatus of claim 12, further comprising:

an application specific integrated circuit configured to distribute the captured traffic through the network captured traffic distribution device.

18. The apparatus of claim 12, wherein the configuration information includes instructions regarding at least one of determining a target destination for received captured network traffic, pre-calculating at least one route for the transmission of received captured network traffic from an origin through the stacked topology to a target destination, determining an optimum route for the transmission of captured network traffic from an origin through the stacked topology to a target destination, load balancing a distribution of received captured traffic through the stacked topology, load spreading a distribution of received captured traffic through the stacked topology, grooming received captured network traffic, filtering received network traffic transmitted through the stacked topology according to a criterion, aggregating received network traffic transmitted through the stacked topology, and evaluating a current operating condition of the stacked topology.

19. The apparatus of claim 12, wherein the stacking port is a monitor port.