Probes for predictive determination of congestion based on remarking/downgrading of packets

• US 8,018,862 B2
• Filed: 03/16/2007
• Issued: 09/13/2011
• Est. Priority Date: 03/16/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sheinfeld, Gil Mati, Ballantyne, Andrew John
• Primary Examiner(s): Sefcheck; Gregory B
• Application Number:
  US11/687,330
• Publication Number:
  US 20080225704A1
• Time in Patent Office: 1,642 Days
• Field of Search: None
• US Class Current: 370/248
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 43/12 Network monitoring probes

Abstract

In one embodiment, a technique for detecting the re-marking of a parameter in a network packet is provided. The technique involves sending a request packet that contains a first value of a type of service parameter effecting how the packet is to be handled relative to other packets and receiving a response packet to the request packet, the response packet containing an indication of a second value of the type of service parameter in the request packet as received by a network device that sent the response packet. The first and second values of the type of service parameter are compared. A determination that the request packet was re-marked is made if the first and second values of the type of service parameter do not match.

Claims

1. A method comprising:

sending an Internet Protocol (IP) request packet comprising a header portion and a payload portion, wherein the header portion contains a first type-of-service indication effecting how the IP packet is to be handled relative to other IP packets;

receiving an IP response packet to the IP request packet, the IP response packet containing an indication of a second type-of-service indication in the IP request packet as received by a network device that sent the IP response packet;

comparing the first and second type-of-service indications;

determining that the IP request packet was re-marked with a different type-of-service indication in the header portion of the IP request packet if the first and second type-of-service indications do not match; and

in response to determining that a threshold level of re-marking has been reached, automatically performing an operation to identify a network device that is re-marking the IP request packet, the operation comprising;

sending a first request with a first time-to-live indication to a first intermediate network device;

comparing a type-of-service indication sent with the first request to a type-of-service indication as received in the first request by the first intermediate device; and

determining that the IP request packet was re-marked by a second intermediate device that precedes the first intermediate device if the type-of-service indication sent with the first request does not match the type-of-service indication as received in the first request by the first intermediate device.

2. The method of claim 1, further comprising sending a notice to a network management system, wherein the notice identifies the network device that is re-marking the IP request packet.

3. The method of claim 2, wherein the network management system is configured to, upon receiving the notice, automatically notify a network administrator.

4. The method of claim 1, further comprising, in response to determining that the type-of-service indication sent with the first request matches the type-of-service indication as received in the first request by the first intermediate device:

sending a second request with a second time-to-live indication different than the first time-to-live indication to a second intermediate network device;

comparing a type-of-service indication sent with the second request to a type-of-service indication as received in the second request by the second intermediate device; and

determining that the IP request packet was re-marked with a different type-of-service indication in the header portion of the IP request packet prior to receipt by the second intermediate device if the type-of-service indication sent with the second request does not match the type-of-service indication as received in the second request by the second intermediate device.

5. The method of claim 1, wherein the request is designed to elicit an error response by targeting an invalid port of the network device that sends the error response.

6. The method of claim 1, further comprising creating a probe on a network device to send the IP request packet, receive the IP response packet and compare the first and second type-of-service indications.

7. The method of claim 1, wherein the IP request packet targets members of a multicast group.

8. The method of claim 1, further comprising storing information regarding re-marking of IP packets in a management information base (MIB).

9. The method of claim 8, further comprising sending information regarding re-marking of IP packets stored in the MIB to a network management system in response to a polling request from the network management system.

10. An apparatus, comprising:

an interface for establishing communication with a network; and

a controller configured to;

send an Internet Control Message Protocol (ICMP) request packet comprising a header portion and a payload portion and targeting a destination device on the network;

compare a first type-of-service indication as contained in the header portion of the ICMP request packet to a second type-of-service indication as received in the ICMP request packet by the destination device to determine where the ICMP request packet was re-marked with a different type-of-service indication in the header portion of the ICMP request packet; and

in response to determining that a threshold level of re-marking has been reached, automatically performing an operation to identify a network device that is re-marking the ICMP request packet, the operation comprising;

sending a first request with a first time-to-live indication to a first intermediate network device;

comparing a type-of-service indication sent with the first request to a type-of-service indication as received in the first request by the first intermediate device; and

determining that the IP request packet was re-marked by a second intermediate device that precedes the first intermediate device if the type-of-service indication sent with the first request does not match the type-of-service indication as received in the first request by the first intermediate device.

11. The apparatus of claim 10, wherein the controller is further configured to send results of the comparing to a network management system.

12. The apparatus of claim 10, wherein the controller is configured to send ICMP request packets targeting devices belonging to different multicast groups.

13. The apparatus of claim 11, wherein the network management system is configured to, upon receiving the results, automatically notify a network administrator.

14. The apparatus of claim 10, wherein the ICMP request packet is designed to elicit an error response by targeting an invalid port of the destination device.

15. The apparatus of claim 10, further comprising:

a management information base; and

wherein the controller is further configured to store information regarding re-marking of packets in a management information base (MIB).

16. A system, comprising:

at least one probe deployed on at least one network device in a network, the probe configured to;

detect re-marking of Internet Protocol (IP) packets with a different type-of-service indication in a header portion of the IP packets by comparing a type-of-service indication sent in an Internet Control Message Protocol (ICMP) request packet targeting a destination device to a type-of-service indication in the ICMP request packet as received by the destination device;

in response to determining that a threshold level of re-marking has been reached, automatically performing an operation to indicate one or more network devices that are re-marking the ICMP request packet, the operation comprising;

sending a first request with a first time-to-live indication to a first intermediate network device;

comparing a type-of-service indication sent with the first request to a type-of-service indication as received in the first request by the first intermediate device; and

determining that the IP request packet was re-marked by a second intermediate device that precedes the first intermediate device if the type-of-service indication sent with the first request does not match the type-of-service indication as received in the first request by the first intermediate device; and

a network management component configured to obtain the indication of re-marking of IP packets by the one or more network devices based on information received from the probe.

17. The system of claim 16, wherein the network management component is configured to poll the probe for the information.

18. The system of claim 16, wherein the probe is configured to automatically send the information when the threshold level of re-marking has been reached.

19. The system of claim 16, wherein the network management component is configured to notify an administrator of the network in response to obtaining the indication of re-marking of IP packets.

20. The system of claim 19, wherein the network management component is configured to notify the administrator by providing the administrator with a location in the network where the re-marking occurred.

21. The system of claim 16, wherein the information provides an indication of a network device that is re-marking IP packets.

22. An apparatus, comprising:

means for establishing communication with a network;

means for sending an Internet Control Message Protocol (ICMP) request packet targeting a destination device on the network and comparing a first type-of-service indication as sent in the ICMP request packet to a second type-of-service indication as received in the ICMP request packet by the destination device; and

means for, in response to determining that a threshold level of re-marking has been reached, automatically performing an operation to identify a network device that is re-marking the ICMP request packet, the operation comprising;

sending a first request with a first time-to-live indication to a first intermediate network device;

comparing a type-of-service indication sent with the first request to a type-of-service indication as received in the first request by the first intermediate device; and

determining that the IP request packet was re-marked by a second intermediate device that precedes the first intermediate device if the type-of-service indication sent with the first request does not match the type-of-service indication as received in the first request by the first intermediate device.