Dynamic monitoring of network traffic

• US 8,102,783 B1
• Filed: 02/04/2009
• Issued: 01/24/2012
• Est. Priority Date: 02/04/2009
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Narayanaswamy, Krishna, Varadhan, Kannan
• Primary Examiner(s): Yao, Kwang B
• Assistant Examiner(s): Elpenord, Candal
• Application Number:
  US12/365,520
• Time in Patent Office: 1,084 Days
• Field of Search: 370/252, 370/231.1, 370/242, 370465-466, 370/230.1, 370/392, 370/235, 370/255, 709/224
• US Class Current: 370/252
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

A device, connected to a monitoring appliance, may include a traffic analyzer to receive a data unit and identify a traffic flow associated with the data unit. The device may also include a traffic processor to receive the data unit and information regarding the identified traffic flow from the traffic analyzer, determine that the identified traffic flow is to be monitored by the monitoring appliance, change a port number, associated with the data unit, to a particular port number to create a modified data unit when the identified traffic flow is to be monitored by the monitoring appliance, and send the modified data unit to the monitoring appliance.

Claims

1. A device connected to a monitoring appliance configured to monitor a particular type of traffic flow that is associated with one of a plurality of ports of the device, the device comprising:

a traffic analyzer to;

identify a traffic flow, associated with a received data unit; and

a traffic processor to;

receive the data unit and information regarding the identified traffic flow from the traffic analyzer, determine that the identified traffic flow comprises the particular type of traffic flow to be monitored by the monitoring appliance based on the information, mirror the data unit, to form a mirrored data unit, based on the identified traffic flow comprising the particular type of traffic flow, determine that the data unit is associated with another one of the plurality of ports, change a port number associated with the mirrored data unit, to a particular port number based on the information and determining that the data unit is associated with the other one of the plurality of ports, where the particular port number is associated with the one of the plurality of ports, send the mirrored data unit to the monitoring appliance, and send the data unit to the other one of the plurality of ports.

2. The device of claim 1, further comprising:

a memory that includes an entry that identifies the identified traffic flow and identifies the particular port number.

3. The device of claim 2, where the traffic processor is to determine that the identified traffic flow is to be monitored by the monitoring appliance when the memory includes the entry that identifies the identified traffic flow.

4. The device of claim 2, where the traffic processor is to replace the port number in a header of the mirrored data unit with the particular port number identified in the entry of the memory.

5. The device of claim 2, where the memory is user-configurable.

6. The device of claim 1, where the traffic flow is associated with network traffic that includes a plurality of layered traffic flows, and

where the traffic analyzer is further to:

separate traffic flows of the plurality of layered traffic flows, and

send each of the separated traffic flows to the traffic processor.

7. The device of claim 6, where the data unit is associated with one of the separated traffic flows;

and

where the traffic processor is further to convert a format of the one of the separated traffic flows to another format prior to sending the mirrored data unit to the monitoring appliance.

8. The device of claim 1, where the traffic analyzer includes a database of signatures associated with different types of traffic flows;

and

where, when identifying the traffic flow associated with the data unit, the traffic analyzer is to;

identify a pattern associated with the traffic flow, and

compare the pattern to the signatures in the database to determine whether the traffic flow matches one of the different types of traffic flows.

9. The device of claim 1, where, when identifying the traffic flow associated with the data unit, the traffic analyzer is to identify the traffic flow based on information from a plurality of data units that includes the data unit.

10. The device of claim 1, where, when identifying the traffic flow associated with the data unit, the traffic analyzer is to identify the traffic flow based on information from only the data unit.

11. The device of claim 1, where the device includes at least one of a firewall, an intrusion detection system, a switch, or a router.

12. A method performed by a device that is connected to a monitoring appliance configured to monitor a particular type of traffic flow associated with a particular port number, the method comprising:

storing, as entries in a memory, information identifying a plurality of traffic flows and a corresponding plurality of port numbers, the plurality of port numbers including the particular port number, where each one of the entries stores information identifying one of the plurality of traffic flows and a corresponding one of the plurality of port numbers;

identifying a traffic flow associated with a data unit received by the device;

determining that the identified traffic flow is to be monitored by the monitoring appliance based on information associated with the identified traffic flow matching the one of the plurality of traffic flows in the memory;

mirroring the data unit, to form a mirrored data unit, in response to determining that the traffic flow is to be monitored;

determining that the data unit is associated with one of the plurality of port numbers other than the particular port number;

replacing a port number associated with the mirrored data unit, with the corresponding one of the plurality of port numbers from the memory to create a modified mirrored data unit in response to determining that the data unit is associated with the one of the plurality of port numbers other than the particular port number;

sending the modified mirrored data unit to the monitoring appliance; and

sending the data unit to a port associated with the one of the plurality of port numbers.

13. The method of claim 12, where replacing the port number, associated with the mirrored data unit, with the corresponding one of the plurality of port numbers includes overwriting the port number in a header of the mirrored data unit with the corresponding one of the plurality of port numbers from the memory.

14. The method of claim 12, where the traffic flow is associated with network traffic that includes a plurality of layered traffic flows, and

where the method further comprises demultiplexing traffic flows of the plurality of layered traffic flows.

15. The method of claim 14, where determining that the information associated with the identified traffic flow matches the one of the plurality of traffic flows in the memory includes determining whether information associated with each of the demultiplexed traffic flows matches any of the plurality of traffic flows in the memory.

16. The method of claim 14, further comprising:

converting a format of one of the demultiplexed traffic flows to another format.

17. The method of claim 12, further comprising:

providing a database of signatures associated with different types of traffic flows; and

where identifying the traffic flow associated with the data unit includes;

identifying a pattern, an expression, or a string associated with the traffic flow, and

comparing the pattern, the expression, or the string to the signatures in the database to determine whether the traffic flow matches one of the different types of traffic flows.

18. The method of claim 12, where identifying the traffic flow associated with the data unit includes identifying the traffic flow based on information from a plurality of data units associated with the traffic flow.

19. The method of claim 12, where identifying the traffic flow associated with the data unit includes identifying the traffic flow based on information from only the data unit.

20. A system, comprising:

a device to;

receive network traffic, where the network traffic includes a plurality of different traffic flows tunneled via a common transport protocol, separate the plurality of different traffic flows from the network traffic to create a plurality of separate traffic flows, determine that a monitoring appliance, connected to the device, is to monitor one of the plurality of separate traffic flows, where the monitoring appliance is to monitor a particular type of traffic flow associated with a particular port number;

mirror the one of the plurality of separate traffic flows based on determining that the monitoring appliance is to monitor the one of the plurality of separate traffic flows, replace a port number, associated with the mirrored one of the plurality of separate traffic flows, with the particular port number to create a modified mirrored traffic flow, send the modified mirrored traffic flow to the monitoring appliance, and send the one of the plurality of separate traffic flows to a port associated with the port number.

21. The system of claim 20, where the device includes at least one of a firewall, an intrusion detection system, a switch, or a router.

22. The system of claim 20, where the device is further to:

store, as entries in a memory, information identifying a plurality of traffic flows and a corresponding plurality of port numbers, where one of the entries stores information identifying one of the plurality of traffic flows and a corresponding one of the plurality of port numbers, and

where the one of the plurality of separate traffic flows corresponds to the one of the plurality of traffic flows, and the particular port number corresponds to the one of the plurality of port numbers.

23. The system of claim 20, further comprising:

a database of signatures associated with different types of traffic flows; and

where the device is further to;

identify, for each of the plurality of separate traffic flows, at least one of a pattern, an expression, or a string associated with the separate traffic flow, and

compare, for each of the separate traffic flows, at least one of the pattern, the expression, or the string to the signatures in the database to determine whether the separate traffic flow matches one of the different types of traffic flows.

24. The system of claim 20, where, when replacing the port number, the device is further to:

overwrite the port number in a header of a data unit, associated with the mirrored one of the plurality of separate traffic flows, with the particular port number.

25. The system of claim 20, where the device is further to:

convert a format of the modified mirrored traffic flow to another format prior to sending the modified mirrored traffic flow to the monitoring appliance.