TECHNIQUES FOR USER-DEFINED TAGGING OF TRAFFIC IN A NETWORK VISIBILITY SYSTEM

• US 20160285763A1
• Filed: 09/09/2015
• Published: 09/29/2016
• Est. Priority Date: 03/23/2015
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Brocade Communications Systems, Inc. (Broadcom, Inc.)
• Inventors: Seth, Vishal, Laxman, Latha, Narasimhan, Arvindsrinivasan Lakshmi
• Granted Patent: US 9,866,478 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Techniques for enabling user-defined tagging of traffic in a network visibility system are provided. In one embodiment, a data plane component of the network visibility system can receive a data packet tapped from a source network. The data plane component can further match the data packet with an entry in a rule table, where the entry includes one or more match parameters, and in response to the matching can tag the data packet with a zone identifier defined in the entry. The data plane component can then forward the tagged data packet to an analytic server for analysis.

Claims

1. A method comprising:

receiving, by a data plane component of a network visibility system, a data packet tapped from a source network;

matching, by the data plane component, the data packet with an entry in a rule table, the entry including one or more match parameters;

in response to the matching, tagging, by the data plane component, the data packet with a zone identifier defined in the entry; and

forwarding, by the data plane component, the data packet to an analytic server for analysis.

2. The method of claim 1 wherein the zone identifier is a user-defined identifier that is used by the analytic server for categorizing the data packet.

3. The method of claim 1 wherein the zone identifier identifies a physical circuit of the source network from which the data packet originated.

4. The method of claim 3 wherein the zone identifier further identifies whether the data packet was traveling in an upstream or downstream direction on the physical circuit.

5. The method of claim 1 wherein the data packet is a GPRS Tunneling Protocol (GTP) packet.

6. The method of claim 5 wherein tagging the data packet with the zone identifier comprises adding the zone identifier to an inner VLAN ID field of the GTP packet.

7. The method of claim 1 wherein the one or more match parameters include an ingress port of the data plane component.

8. The method of claim 7 wherein the one or more match parameters further include a source IP address prefix or a destination IP address prefix.

9. The method of claim 8 wherein the source network is a 3G or 4G/LTE wireless network, and wherein the source IP address prefix or destination IP address prefix corresponds to one or more gateway GPRS support nodes (GGSNs) or serving gateways (SGWs) in the source network.

10. The method of claim 1 wherein the entry is generated by a control plane component of the network visibility system and is communicated to the data plane component upon initialization.

11. The method of claim 10 wherein the entry is generated based on a user-defined configuration file that is maintained on the control plane component.

12. The method of claim 1 wherein the data plane component is a network switch or router, and wherein the rule table is resident on an ingress line card of the network switch or router.

13. A non-transitory computer readable storage medium having stored thereon program code executable by a data plane component of a network visibility system, the program code causing the data plane component to:

receive a data packet tapped from a source network;

match the data packet with an entry in a rule table, the entry including one or more match parameters;

in response to the matching, tagging the data packet with a zone identifier defined in the entry; and

forwarding the data packet to an analytic server for analysis.

14. The non-transitory computer readable storage medium of claim 13 wherein the zone identifier is a user-defined identifier that is used by the analytic server for categorizing the data packet.

15. The non-transitory computer readable storage medium of claim 13 wherein the zone identifier identifies a physical circuit of the source network from which the data packet originated.

16. The non-transitory computer readable storage medium of claim 13 wherein the data packet is a GPRS Tunneling Protocol (GTP) packet, and wherein tagging the data packet with the zone identifier comprises adding the zone identifier to an inner VLAN ID field of the GTP packet.

17. A device operable to act as a data plane component in a network visibility system, the device comprising:

a processor; and

a non-transitory computer readable medium having stored thereon program code that, when executed by the processor, causes the processor to;

receive a data packet tapped from a source network;

match the data packet with an entry in a rule table, the entry including one or more match parameters;

in response to the matching, tagging the data packet with a zone identifier defined in the entry; and

forwarding the data packet to an analytic server for analysis.

18. The device of claim 17 wherein the zone identifier is a user-defined identifier that is used by the analytic server for categorizing the data packet.

19. The device of claim 17 wherein the zone identifier identifies a physical circuit of the source network from which the data packet originated.

20. The device of claim 17 wherein the data packet is a GPRS Tunneling Protocol (GTP) packet, and wherein tagging the data packet with the zone identifier comprises adding the zone identifier to an inner VLAN ID field of the GTP packet.