METHOD, DEVICE AND MEDIUM FOR DETERMINING OPERATIONS PERFORMED ON A PACKET

• US 20120166637A1
• Filed: 02/15/2012
• Published: 06/28/2012
• Est. Priority Date: 05/25/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: White, David C. Jr., Ottamalika, Iqlas Maheen, Challa, Madhusudan
• Granted Patent: US 8,769,091 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 69/00 Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass networks security protocols H04L9/40; wireless communication networks H04W

Abstract

A system for tracing operations executed by a network device on a packet wherein a network device may capture a packet and determine whether the packet is a candidate for tracing; if the packet is a candidate for tracing the network device may set a trace option identifier within the packet indicating that the packet is to be tagged in association with operations performed on or in association with the packet by the network device. The network device may tag the packet with one or more tags in response to the trace option identifier, export the packet with the trace option identifier, generate a report based on the tags and send the report to a network management station.

Claims

1. A method, comprising:

capturing, by a processing device, a packet;

determining, by the processing device, the packet is a candidate for tracing;

setting, by the processing device, a trace option identifier within the packet indicating that the packet is selected for tagging in association with an operation performed by a network device corresponding to the packet;

adding, by the processing device, the tag to the packet based on the trace option identifier;

exporting, by the processing device, the packet with the trace option identifier; and

generating, by the processing device, a report based on the tag.

2. The method of claim 1, further comprising adding, by the processing device, a network management device identifier to the packet.

3. The method of claim 2, further comprising sending, by the processing device, the report to a network management device identified by the network management identifier.

4. The method of claim 1, further comprising adding, by the processing device, a trace level identifier to the packet identifying one or more operations to trace.

5. The method of claim 4, wherein the trace level identifier identifies a category of operations to trace.

6. The method of claim 5, wherein the adding the tag to the packet is further based on the trace level identifier.

7. The method of claim 1, wherein the determining the packet is a candidate for tracing further comprises filtering, by the processing device, the packet based on a packet order within a flow of packets or data in a header of the packet, or a combination thereof.

8. The method of claim 1, wherein the generating the report based on the tag further comprises including, by the processing device, a line of text corresponding to configuration information associated with the network device, wherein the line of text correlates to the operation.

9. An apparatus, comprising;

a processing device; and

a memory coupled to the processing device comprising instructions executable by the processing device, the processing device operable when executing the instructions to;

receive a packet comprising a trace option identifier;

determine that the packet is to be tagged in association with an operation performed by a network device corresponding to the packet responsive to the trace option identifier;

tag the packet with a tag based on the trace option identifier; and

generate a report based on the tag.

10. The apparatus of claim 9, wherein the processing device is further operable to remove the tag and forward the packet to a subsequent network device including the trace option identifier.

11. The apparatus of claim 9, wherein the processing device is further operable to:

identify a network management device based on a network management device identifier in the packet; and

send the report to the network management device.

12. The apparatus of claim 9, wherein the processing device is further operable to identify the operation based on a trace level identifier included in the packet.

13. The apparatus of claim 12, wherein the trace level identifier identified a category of operations.

14. The apparatus of claim 9, further comprising removing the tag prior to generating the report.

15. One or more computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

receive a packet;

inspect the packet to determine if the packet includes a trace option identifier;

if the packet does not include a trace option identifier, then set a trace option identifier within the packet, wherein the trace option identifier is configured to indicate that a network device is to add a tag to the packet in association with an operation performed by the network device wherein the operation corresponds to the packet;

add the tag to the packet based on the trace option identifier; and

generate a report based on the tag.

16. The one or more computer readable storage media of claim 15, wherein the software when executed is further operable to add a network management device identifier to the packet.

17. The one or more computer readable storage media of claim 16, wherein the software when executed is further operable to send the report to a network management device identified by the network management identifier.

18. The one or more computer readable storage media of claim 15, wherein the software when executed is further operable to export the packet with the trace option identifier.

19. The one or more computer readable storage media of claim 15, wherein the software when executed is further operable to add a trace level identifier to the packet identifying one or more operations to trace.

20. The one or more computer readable storage media of claim 19, wherein the trace level identifier identifies a category of operations to trace.