Smart and selective mirroring to enable seamless data collection for analytics

• US 20200137115A1
• Filed: 10/31/2018
• Published: 04/30/2020
• Est. Priority Date: 10/31/2018
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Janakiraman, Ramsundar, Kudva, Varun
• Application Number:
  US16/177,297
• Publication Number:
  US 20200137115A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system may identify a resource deployed in a computer network. In response to encountering a packet that is part of a flow of packets between the resource and a server in the computer network, the system may determine whether to mirror the packet based at least in part on whether the packet carries a header of a specified protocol. In response to determining to mirror the packet, the system may mirror additional packets of the flow of packets between the resource and the server until at least one of: encountering a marker or determining that a specified amount of data in the flow of packets has been mirrored.

Claims

1. A computer-implemented method, comprising:

identifying a resource deployed in a computer network;

in response to encountering a packet that is part of a flow of packets between the resource and a server in the computer network, determining whether to mirror the packet based at least in part on whether the packet carries a header of a specified protocol; and

in response to determining to mirror the packet, mirroring additional packets of the flow of packets between the resource and the server until at least one of;

encountering a marker or determining that a specified amount of data in the flow of packets has been mirrored.

2. The computer-implemented method of claim 1, wherein the specified protocol comprises one of:

HyperText Transport Protocol (HTTP), HyperText Transport Protocol Secure (HTTPS), Server Message Block (SMB), Simple Mail Transfer Protocol (SMTP), or Authentication with Certificate Exchange.

3. The computer-implemented method of claim 1, wherein determining whether to mirror the packet comprises determining whether to mirror the packet based at least in part on a destination port of the server that is specified by the packet.

4. The computer-implemented method of claim 1, wherein the marker comprises a handshake state between the resource and the server.

5. The computer-implemented method of claim 4, wherein the handshake state between the resource and the server comprises a certificate exchange between the resource and the server.

6. The computer-implemented method of claim 4, wherein the handshake state between the resource and the server comprises a key exchange between the resource and the server.

7. The computer-implemented method of claim 4, wherein the handshake state between the resource and the server comprises the handshake state of a HTTPS to Secure Socket Layer (SSL) handshake.

8. The computer-implemented method of claim 4, wherein the handshake state between the resource and the server comprises a flow state of a deep packet inspection (DPI) library.

9. A system, comprising:

a memory storing instructions; and

one or more processors configured to execute the instructions to cause the system to;

identify a resource deployed in a computer network;

in response to encountering a packet that is part of a flow of packets between the resource and a server in the computer network, determine whether to mirror the packet based at least in part on whether the packet carries a header of a specified protocol; and

in response to determining to mirror the packet, mirror additional packets of the flow of packets between the resource and the server until at least one of;

encountering a marker or determining that a specified amount of data in the flow of packets has been mirrored.

10. The system of claim 9, wherein the specified protocol comprises one of:

HyperText Transport Protocol (HTTP), HyperText Transport Protocol Secure (HTTPS), Server Message Block (SMB), Simple Mail Transfer Protocol (SMTP), or Authentication with Certificate Exchange.

11. The system of claim 9, wherein to determine whether to mirror the packet the one or more processors are configured to determine whether to mirror the packet based at least in part on a destination port of the server that is specified by the packet.

12. The system of claim 9, wherein the marker comprises a handshake state between the resource and the server.

13. The system of claim 12, wherein the handshake state between the resource and the server comprises the handshake state of a HTTPS to Secure Socket Layer (SSL) handshake.

14. The system of claim 12, wherein the handshake state between the resource and the server comprises a certificate exchange between the resource and the server.

15. The system of claim 12, wherein the handshake state between the resource and the server comprises a key exchange between the resource and the server.

16. The system of claim 12, wherein the handshake state between the resource and the server comprises the handshake state of a HTTPS to Secure Socket Layer (SSL) handshake.

17. A non-transitory, computer readable medium storing instructions which, when executed by a processor, cause a computer to perform a method, the method comprising:

identifying a resource deployed in a computer network;

in response to encountering a packet that is part of a flow of packets between the resource and a server in the computer network, determining whether to mirror the packet based at least in part on whether the packet carries a header of a specified protocol; and

in response to determining to mirror the packet, mirroring additional packets of the flow of packets between the resource and the server until at least one of;

encountering a marker or determining that a specified amount of data in the flow of packets has been mirrored.

18. The non-transitory, computer readable medium of claim 17, wherein the specified protocol comprises one of:

HyperText Transport Protocol (HTTP), HyperText Transport Protocol Secure (HTTPS), Server Message Block (SMB), Simple Mail Transfer Protocol (SMTP), or Authentication with Certificate Exchange.

19. The non-transitory, computer readable medium of claim 17, wherein determining whether to mirror the packet comprises determining whether to mirror the packet based at least in part on a destination port of the server that is specified by the packet.

20. The non-transitory, computer readable medium of claim 20, wherein the marker comprises a handshake state between the resource and the server.