PACKET CAPTURE FOR ERROR TRACKING

• US 20130347103A1
• Filed: 06/21/2012
• Published: 12/26/2013
• Est. Priority Date: 06/21/2012
• Status: Abandoned Application

• Current Assignee: Breakingpoint Systems Incorporated (Keysight Technologies, Inc.)
• Original Assignee: Breakingpoint Systems Incorporated (Keysight Technologies, Inc.)
• Inventors: Veteikis, Mark, Moriarty, Michael
• Application Number:
  US13/529,970
• Publication Number:
  US 20130347103A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 1/0061 Error detection codes
• CPC Class Codes: H04L 1/24 Testing correct operation
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation

Abstract

A method of tracking network traffic anomalies in a computing system, comprises receiving an ingress network packet at a configurable logic device (CLD), associating a timestamp with the packet, identifying at least one anomaly based on the contents of the packet, and storing the anomalous packet and the timestamp in a persistent memory.

Claims

1. A method of tracking network traffic anomalies in a computing system, comprising:

receiving an ingress network packet at a configurable logic device (CLD);

associating a timestamp with the packet;

identifying at least one anomaly based on the contents of the packet; and

storing the anomalous packet and the timestamp in a persistent memory.

2. The method of claim 1, further comprising:

parsing the ingress network packet to identify at least one checksum; and

identifying an anomaly where the at least one checksum is invalid in relation to the contents of the packet.

3. The method of claim 2, wherein the invalid checksum is an Ethernet checksum.

4. The method of claim 1, further comprising:

continuously capturing all ingress network packets in a limited depth buffer within a memory address space of the CLD;

when the CLD identifies an anomalous packet, store the contents of the buffer and an association with the anomalous packet in the persistent memory.

5. The method of claim 1, further comprising:

when the CLD identifies an anomalous packet, capture a predetermined number of ingress network packets in a buffer within a memory address space of the CLD; and

store the contents of the buffer and an association with the anomalous packet in the persistent memory.

6. The method of claim 1, wherein the CLD is a field programmable gate array.

7. A tangible, non-transitory computer-readable media comprising a configuration file that when loaded by a configurable logic device (CLD) configures the CLD to:

receive an ingress network packet at a configurable logic device (CLD);

associate a timestamp with the packet;

identify at least one anomaly based on the contents of the packet; and

store the anomalous packet and the timestamp in a persistent memory.

8. The memory of claim 7, wherein the configuration file further configures the CLD to:

parse the ingress network packet to identify at least one checksum; and

identify an anomaly where the at least one checksum is invalid in relation to the contents of the packet.

9. The memory of claim 8, wherein the invalid checksum is an Ethernet checksum.

10. The memory of claim 7, wherein the configuration file further configures the CLD to:

continuously capture all ingress network packets in a limited depth buffer within a memory address space of the CLD;

when the CLD identifies an anomalous packet, store the contents of the buffer and an association with the anomalous packet in the persistent memory.

11. The memory of claim 7, wherein the configuration file further configures the CLD to:

when the CLD identifies an anomalous packet, capture a predetermined number of ingress network packets in a buffer within a memory address space of the CLD; and

store the contents of the buffer and an association with the anomalous packet in the persistent memory.

12. The memory of claim 7, wherein the CLD is a field programmable gate array.

13. A computing system comprising a configurable logic device (CLD) configured to:

receive an ingress network packet at a configurable logic device (CLD);

associate a timestamp with the packet;

identify at least one anomaly based on the contents of the packet; and

store the anomalous packet and the timestamp in a persistent memory.

14. The system of claim 13, wherein CLD is further configured to:

parse the ingress network packet to identify at least one checksum; and

identify an anomaly where the at least one checksum is invalid in relation to the contents of the packet.

15. The system of claim 14, wherein the invalid checksum is an Ethernet checksum.

16. The system of claim 13, wherein CLD is further configured to:

continuously capture all ingress network packets in a limited depth buffer within a memory address space of the CLD;

when the CLD identifies an anomalous packet, store the contents of the buffer and an association with the anomalous packet in the persistent memory.

17. The system of claim 13, wherein CLD is further configured to:

when the CLD identifies an anomalous packet, capture a predetermined number of ingress network packets in a buffer within a memory address space of the CLD; and

store the contents of the buffer and an association with the anomalous packet in the persistent memory.

18. The system of claim 13, wherein the CLD is a field programmable gate array.