Custom automatic remote monitoring for network devices

• US 8,305,923 B1
• Filed: 08/23/2010
• Issued: 11/06/2012
• Est. Priority Date: 01/30/2006
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Marvell International Limited (Marvell Technology Group Limited)
• Inventors: Orr, Michael
• Primary Examiner(s): Hsu, Alpus H
• Application Number:
  US12/861,294
• Time in Patent Office: 806 Days
• Field of Search: 370/252, 370/256, 370/389, 370/401, 707/665, 709/224, 726/13
• US Class Current: 370/252
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/0894 Packet rate

Abstract

A network device including a port configured to exchange packets of data with one or more networks. The network device further includes a rule storing circuit is configured to store a plurality of event classification rules. Each of the event classification rules describes at least one event characteristic for an event in the network device. At least one of the event classification rules includes a change in state of the at least one port of the network device. The change in state of the at least one port is generated by a change in spanning tree mode. The network device further includes an event classifier is configured to identify events having the at least one event characteristic described by any of the event classification rules, and a plurality of event counters configured to count the events identified by the event classifier for a respective one of the event classification rules.

Claims

1. A network device comprising:

at least one port configured to exchange packets of data with one or more networks;

a rule storing circuit configured to store a plurality of event classification rules, wherein;

each of the event classification rules describes at least one event characteristic for an event in the network device,

at least one of the event classification rules includes a change in state of the at least one port of the network device, and

the change in state of the at least one port is generated by a change in spanning tree mode;

an event classifier configured to identify events having the at least one event characteristic described by any of the event classification rules; and

a plurality of event counters, wherein each of the event counters is configured to count the events identified by the event classifier for a respective one of the event classification rules.

2. The network device of claim 1, wherein each of the event classification rules describes an event counter condition and a threshold action.

3. The network device of claim 2, further comprising an action circuit configured to initiate a respective threshold action for each of the event classification rules when a respective event counter meets a respective event counter condition.

4. The network device of claim 2, wherein the event counter condition describes at least one of the group consisting of:

an occurrence of a predetermined count of the event counter;

a predetermined change in a count of the event counter; and

a predetermined change in the count of the event counter during a predetermined interval.

5. The network device of claim 3, wherein the threshold action comprises at least one of the group consisting of:

implementing a further one of the event classification rules;

closing one or more ports;

changing logical attributes of one or more ports;

manifesting an alarm indication; and

dropping subsequent packets of data having the at least one of the event characteristics described by a respective event classification rule.

6. The network device of claim 1, wherein at least one of the event classification rules includes a conditional statement including an if-then-else statement.

7. The network device of claim 1, further comprising a user interface configured to allow a user to input the plurality of event classification rules.

8. The network device of claim 7, wherein the user interface is configured to provide an interactive interface for a user of a network device remote from the network device for interactively configuring the network device via a network without storing information about packet flows in the user interface.

9. The network device of claim 7, wherein the user interface comprises a web-based interface including a hypertext markup language (HTML) interface.

10. The network device of claim 1, wherein

at least one of the event classification rules describes a plurality of the event characteristics,

at least two of the event characteristics are selected from a group including a reboot of the network device, a change in state of a processor of the network device, a change in state of a memory of the network device, a change in an attribute of a network interface of the network device, a user login, and a user logout.

11. The network device of claim 10, wherein the group further includes a timeout.

12. The network device of claim 10, wherein the group further includes packet characteristics of the packets of data.

13. The network device of claim 12, wherein the packet characteristics comprise at least one of the group consisting of:

destination addresses of the packets of data;

source addresses of the packets of data;

types of the packets of data;

identifiers of network interfaces of the network device receiving the packets of data into the network device;

identifiers of the network interfaces of the network device transmitting the packets of data from the network device;

data rates of the packets of data;

quantities of data in the packets of data;

identifiers of network devices in paths of the packets of data; and

times of occurrence of the packets of data.

14. The network device of claim 10, wherein the change in state of one of the processor and the memory is generated by one of reboot events and reloading of programs of the network device.

15. The network device of claim 10, wherein the change in state of the at least one port is generated by one of a loss of connectivity with the one or more networks, and a resumption of connectivity with the one or more networks of the at least one port.

16. The network device of claim 10, wherein the attribute of the network interface includes one of a speed and a duplex mode of the network interface.

17. The network device of claim 10, wherein the event characteristics for the user login include one of a number of, a frequency, a duration, and a time of day of user logins.

18. The network device of claim 10, wherein the event characteristics for the user logout include one of a number of, a frequency, a duration, and a time of day of user logouts.