Mirroring of a random subset of network traffic

• US 8,155,118 B2
• Filed: 08/19/2005
• Issued: 04/10/2012
• Est. Priority Date: 08/19/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Jorgensen, Steven Glen, Greenlaw, Jonathan Edward, Albrecht, Alan R.
• Primary Examiner(s): Yao, Kwang B
• Assistant Examiner(s): Bokhari, Syed M
• Application Number:
  US11/208,330
• Publication Number:
  US 20070041332A1
• Time in Patent Office: 2,426 Days
• Field of Search: 370/360, 370/390, 370/392, 370/241, 370/409, 370/395, 370/359, 370/253, 370/244, 370/60, 370/229, 370/389, 707/3, 395/200, 709/224
• US Class Current: 370/390
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/022 by sampling

Abstract

One embodiment disclosed relates to a method of mirroring network traffic. A data packet is received by a network device, and an algorithm including randomization is applied to determine whether the data packet is selected to be mirrored. The packet is sent to a destination port, and if the data packet is selected to be mirrored, then the packet is also sent to a mirror port. Another embodiment of the invention relates to a networking device. The networking device includes at least a plurality of ports, a switching/routing engine, and a mirroring engine. The plurality of ports receive and transmit packets therefrom, and the switching/routing engine is coupled to the ports for transferring the packets therebetween. The mirroring engine is configured to apply an algorithm including randomization to select data packets for mirroring. Other embodiments are also disclosed.

Claims

1. A method of mirroring network traffic, the method comprising:

receiving a data packet by a network device;

categorizing the data packet into one of a plurality of monitoring classes, wherein each of the plurality of monitoring classes identifies a different type of data packet, wherein at least one of the plurality of monitoring classes is to be mirrored and at least another one of the plurality of monitoring classes is not to be mirrored, and wherein at least one of the plurality of monitoring classes has a different probability of being randomly selected for mirroring than at least another one of the plurality of monitoring classes;

in response to a determination that the data packet is categorized into a monitoring class to be mirrored, applying an algorithm including randomization to determine whether the data packet is selected to be mirrored, wherein the probability that the data packet is selected to be mirrored is based upon the monitoring class into which the data packet is categorized;

sending the data packet to a destination port; and

if the data packet is selected to be mirrored, then also sending the data packet to a mirror port.

2. The method of claim 1, further comprising applying the algorithm only if the packet is categorized into a monitoring class to be mirrored.

3. The method of claim 1, wherein applying the algorithm including randomization further comprises applying the algorithm including randomization to cause each monitoring class of the plurality of monitoring classes to be mirrored to have an independently-configurable probability of random selection for mirroring.

4. The method of claim 1, wherein categorizing the data packet into one of the plurality of monitoring classes further comprises examining a value of at least a portion of the data packet and categorizing the data packet into one of the plurality of monitoring classes based on the value.

5. The method of claim 1, wherein categorizing comprises categorizing the data packet into a first one of the monitoring classes of the plurality of monitoring classes if the data packet is addressed to a single destination and associating the data packet with a second one of the monitoring classes of the plurality of monitoring classes if the packet is addressed to multiple destinations.

6. The method of claim 1 wherein the data packet comprises a first data packet and further comprising:

receiving a second data packet by the network device;

randomly determining that the second data packet is not selected to be mirrored; and

sending the second data packet to the destination port without sending the second data packet to the mirror port.

7. A networking device comprising:

a plurality of ports for receiving and transmitting packets therefrom;

a switching/routing engine coupled to the ports for transferring the packets there between; and

a mirroring engine to categorize the packets into one of a plurality of monitoring classes, wherein each of the plurality of monitoring classes identifies a different type of packet, wherein at least one of the plurality of monitoring classes is to be mirrored and at least another one of the plurality of monitoring classes is not to be mirrored, wherein at least one of the plurality of monitoring classes has a different probability of being randomly selected for mirroring than at least another one of the plurality of monitoring classes, and to apply an algorithm including randomization to randomly select a subset of the packets categorized into a monitoring class to be mirrored for mirroring, wherein the probability that the data packet is selected to be mirrored is based upon the monitoring class into which the data packet is categorized, wherein some of the packets do not belong to the subset.

8. The networking device of claim 7, wherein the networking device is configured to determine whether the packets of the subset are of a type to be mirrored prior to including the packets of the subset in the subset.

9. The networking device of claim 7, wherein each monitoring class of the plurality of monitoring classes to be mirrored has an independently-configurable probability of random selection for mirroring.

10. The networking device of claim 7, wherein the mirroring engine is further to mirror only the selected subset of the packets and not mirror the unselected packets.

11. An apparatus for mirroring of network traffic, the method comprising:

a plurality of ports configured to receive and send data packets;

means for categorizing the data packets into one of a plurality of monitoring classes, wherein each of the plurality of monitoring classes identifies a different type of data packet, wherein at least one of the plurality of monitoring classes is to be mirrored and at least another one of the plurality of monitoring classes is not to be mirrored, and wherein at least one of the plurality of monitoring classes has a different probability of being randomly selected for mirroring than at least another one of the plurality of monitoring classes;

means for applying an algorithm including randomization to determine whether a data packet that has been categorized into a monitoring class to be mirrored is selected to be mirrored, wherein the probability that the data packet is selected to be mirrored is based upon the monitoring class into which the data packet is categorized; and

means for sending the data packet to a destination port and for sending the data packet to a monitoring port if the data packet is selected to be mirrored.

12. A networking device comprising:

a plurality of ports including a receiving port configured to receive a plurality of packets, one or more destination ports, and a mirror port; and

circuitry to forward the packets of the plurality to the destination ports, to categorize the packets into one of a plurality of monitoring classes, wherein each of the plurality of monitoring classes identifies a different type of packet, wherein at least one of the plurality of monitoring classes is to be mirrored and at least another one of the plurality of monitoring classes is not to be mirrored, wherein at least one of the plurality of monitoring classes has a different probability of being randomly selected for mirroring than at least another one of the plurality of monitoring classes, and to apply an algorithm including randomization to randomly select a subset of packets from the plurality of packets categorized into a monitoring class to be mirrored for mirroring, wherein the probability that the data packet is selected to be mirrored is based upon the monitoring class into which the data packet is categorized, and to forward the selected subset of packets to the mirror port, wherein some of the packets of the plurality do not belong to the subset.

13. The device of claim 12 wherein the circuitry is further configured to not forward packets of the plurality not belonging to the subset to the mirror port.

14. The device of claim 12 wherein at least one of the packets of the subset is a packet addressed to only a single destination.

15. The device of claim 12 wherein at least one of the packets of the subset does not comprise an indicator specifying that the packet is to be sent to more than one destination.