EFFICIENT CAPTURE AND STREAMING OF DATA PACKETS

• US 20180069788A1
• Filed: 09/02/2016
• Published: 03/08/2018
• Est. Priority Date: 09/02/2016
• Status: Active Grant

• Current Assignee: Accedian Networks Inc. (Cisco Systems, Inc.)
• Original Assignee: Accedian Networks Inc. (Cisco Systems, Inc.)
• Inventors: Lizotte, Sylvain, Lamontagne, Marc-Andr, Glinas, Marc, Viens, Yanick
• Granted Patent: US 10,616,382 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 47/36 by determining packet size, e.g. maximum transfer unit [MTU]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

What is disclosed is a method for efficient capture and streaming of data packets in a network device comprises capturing data packets matching predetermined filters, packaging said data packets into samples, and aggregating one or more samples in a high speed bus payload. The method also comprises transferring said high speed bus payload to a CPU, extracting said samples from the high speed bus payload and storing said samples in a shared memory of the CPU, and accessing said samples from the shared memory for streaming to one or more client.

Claims

1. A method for efficient capture and streaming of data packets in a network device comprising:

capturing data packets matching predetermined filters;

packaging said data packets into samples;

aggregating one or more samples in a high speed bus payload;

transferring said high speed bus payload to a CPU;

extracting said samples from the high speed bus payload and storing said samples in a shared memory of the CPU; and

accessing said samples from the shared memory for streaming to one or more client.

2. The method of claim 1, wherein said packaging comprises adding a header to the data packet.

3. The method of claim 1, wherein said filter operates via a layer-2 filtering protocol.

4. The method of claim 1, wherein said filter operates via a layer-3 filtering protocol.

5. The method of claim 1, further comprising queuing and shaping said payloads before transmitting on the high speed bus.

6. The method of claim 1 wherein said high speed bus payload is an Ethernet payload.

7. The method of claim 6, wherein said aggregating is performed until the Ethernet payload has reached a predefined maximum transfer unit (MTU) size.

8. The method of claim 1, wherein said transferring is done via an Ethernet bus.

9. A network device comprising:

an input port configured to receive packets from a network;

an output port configured to deliver the packets to a target device connected thereto;

a flow server configured to;

analyze the packets to identify at least one target packet;

capture a copy of the at least one target packet;

create meta-data containing information related to the at least one target packet; and

create a sample comprising the meta-data and the copy of the at least one target packet; and

a flow client coupled to the flow server and configured to receive the sample from the flow server and store the sample in a database.

10. The network device of claim 9 wherein the flow server is configured to filter the packets using filtering rules and to identify the target packet based on filtered packets matching one or more criteria.

11. The network device of claim 10 wherein the flow server is configured to filter the packets using a layer-2 filtering protocol.

12. The network device of claim 10 wherein the flow server is configured to filter the packets using a layer-3 filtering protocol.

13. The network device of claim 9 wherein the flow server is further configured to:

analyze the packets to identify at least two target packets;

capture a copy of the at least two target packets;

create meta-data containing information related to the at least two target packets; and

create the sample comprising the meta-data and the copy of the at least two target packets.

14. The network device of claim 9 wherein the flow server is further configured to:

aggregate the sample in a high speed bus payload;

transferring the high speed bus payload to a CPU;

extract the sample from the high speed bus payload and store the sample in a shared memory of the CPU; and

access the sample from the shared memory to stream the sample to the flow client.

15. A non-transitory computer readable storage medium comprising instructions, which when executed by a processor, cause the processor to:

capture one or more data packets of a packet flow matching predetermined filters;

package the one or more data packets into a sample;

aggregate one or more samples in a high speed bus payload;

transfer said high speed bus payload to a CPU;

extract the one or more samples from the high speed bus payload;

store the one or more samples in a shared memory of the CPU; and

access the one or more samples from the shared memory for streaming to one or more client.

16. The computer readable storage medium of claim 15 comprising further instructions that cause the processor to shape the aggregated one or more samples based on space in the shared memory available to store the one or more samples.

17. The computer readable storage medium of claim 15 comprising further instructions that cause the processor to package meta-data into the sample.

18. The computer readable storage medium of claim 17 wherein the meta-data comprises information selected from the group consisting of a length of the captured one or more data packets, a length of the sample, an identification of a port that received the packet flow, and an identification of the packet flow.

19. The computer readable storage medium of claim 15 comprising further instructions that cause the processor to filter data packets in the packet flow using a layer-2 filtering protocol.

20. The computer readable storage medium of claim 15 comprising further instructions that cause the processor to filter data packets in the packet flow using a layer-3 filtering protocol.