Method and system of using counters to monitor a system port buffer

• US 8,531,960 B2
• Filed: 05/02/2011
• Issued: 09/10/2013
• Est. Priority Date: 03/21/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Berly, Mark, Gourlay, Douglas Alan, Khoo, Danny Tak Hong, Sabasteanski, John
• Primary Examiner(s): Zhu, Alvin
• Application Number:
  US13/099,286
• Publication Number:
  US 20110205893A1
• Time in Patent Office: 862 Days
• Field of Search: 370/412, 370/413, 370/414, 370/415, 370/416, 370/417, 370/418
• US Class Current: 370/235
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 49/90 Buffering arrangements
• CPC Class Codes: H04L 49/9063 Intermediate storage in different physical parts of a node or terminal
• CPC Class Codes: H04L 49/9078 using an external memory or storage device

Abstract

Methods and systems for using counters to monitor port buffers are described. In one embodiment, the method includes receiving data packets into a system port buffer having different queues. Also, counters are associated with the queues. Further, the method includes scanning the counters, in which the counters count the number of dropped data packets associated with an individual queue of the different queues. Moreover, the method includes determining if the number of dropped data packets for an individual queue is greater than a predetermined number. If the number of dropped data packets is greater than the predetermined number, then a message is generated.

Claims

1. A non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

monitor a counter associated with a packet buffer queue, wherein the counter is configured to count and record number of a dropped data packets of the packet buffer queue;

forward incoming data packets to a network analysis module (NAM);

determine that the number of dropped packets for the packet buffer queue exceeds a predetermined number;

terminate forwarding based on the determination;

access the NAM to determine a source of a data packet forwarded from the packet buffer queue that immediately precedes the termination of forwarding; and

identify that the source of the immediately preceding data packet is a same source of the dropped data packets by inferring that the immediately preceding data packet originates from a same source as the source of the dropped packets.

2. The non-transitory computer readable storage media of claim 1, wherein when the software is executed is further operable to generate a message if the number of dropped packets is greater than the predetermined number, wherein the forwarding to the NAM is terminated responsive to the message.

3. The non-transitory computer readable storage media of claim 1, wherein when the software is executed is further operable to automatically execute a corrective action corresponding to the immediately preceding data packet.

4. The non-transitory computer readable storage media of claim 3, wherein the corrective action is configured to reduce the number of packets dropped by the packet buffer queue.

5. The non-transitory computer readable storage media of claim 1 wherein when the software is executed is further operable to:

forward the incoming data packets to the NAM via a Switched Port Analyzer (SPAN) session, wherein terminating forwarding the data packets comprises disabling the SPAN session.

6. The non-transitory computer readable storage media of claim 2 wherein when the software is executed is further operable to determine network traffic enqueued in the buffer at the time of buffer overflow based on the message.

7. A method comprising:

forwarding incoming data packets to a network analysis module (NAM);

determining that a number of dropped packets for a first packet buffer queue exceeds a predetermined number;

identifying a second packet buffer queue that is not overloaded wherein if the second packet buffer queue is identified then;

forwarding subsequent incoming data packets to the second packet buffer queue;

accessing source information for the subsequent incoming data packet; and

identifying that the source of the subsequent incoming data packet is a same source of the dropped data packets by inferring that the immediately preceding data packet originates from a same source as the source of the dropped packets;

wherein if the second packet buffer queue is not identified then terminating forwarding of the data packets to the NAM based on the determination that the number of dropped packets for a first packet buffer queue exceeds the predetermined number.

8. The method of claim 7, wherein if the second packet buffer queue is not identified further comprising:

accessing the NAM for determining a source of a data packet forwarded from the packet buffer queue that immediately precedes the termination of forwarding; and

inferring that the source of the immediately preceding data packet is a same source of the dropped data packets.

9. The method of claim 8, further comprising:

forwarding the incoming data packets to the NAM via a Switched Port Analyzer (SPAN) session, wherein terminating forwarding the data packets comprises disabling the SPAN session.

10. The method of claim 7, further comprising generating a message responsive to determining that the number of dropped packets for a first packet buffer queue exceeds the predetermined number, wherein the message is a SYSLOG or a Simple Network Management Protocol trap, or combinations thereof.

11. The method of claim 7, further comprising forwarding the incoming data packets to the NAM or the second packet buffer queue, or combinations thereof via a Switched Port Analyzer (SPAN) session, wherein terminating forwarding the data packets to the NAM comprises disabling the SPAN session.

12. The method of claim 7, further comprising wherein if the second packet buffer queue is identified then:

accessing information from the subsequent incoming data packet to determine the source of the subsequent incoming data packet.

13. The method of claim 10, further comprising forwarding the message to a network management station configured to respond to the message by taking a responsive action corresponding to the identified source.

14. An apparatus comprising:

one or more processors; and

a memory coupled to the one or more processors comprising instructions executable by the processors, the processors when executing the instructions configured to;

monitor a counter associated with a packet buffer queue, wherein the counter is configured to count and record number of dropped data packets of the packet buffer queue;

forward incoming data packets to a network analysis module (NAM);

determine that a number of dropped packets for the packet buffer queue exceeds a predetermined number;

terminate forwarding based on the determination;

access the NAM for determining a source of a data packet forwarded from the packet buffer queue that immediately precedes the termination of forwarding; and

identify that the source of the immediately preceding data packet is a same source of the dropped data packets by inferring that the immediately preceding data packet originates from a same source as the source of the dropped packets.

15. The apparatus of claim 14, wherein the processors when executing the instructions configured to read source data corresponding to the immediately preceding data packet received from the NAM to identify the source of the immediately preceding data packet and identify the source of the dropped data packets.

16. The apparatus of claim 14, wherein the processors when executing the instructions configured to read source data corresponding to the immediately preceding data packet directly from the NAM to identify the source of the immediately preceding data packet and identify the source of the dropped data packets.

17. The apparatus of claim 14, wherein the processors when executing the instructions configured to generate a message if the number of dropped packets is greater than the predetermined number, wherein the forwarding to the NAM is terminated responsive to the message.

18. The apparatus of claim 14, wherein the processors when executing the instructions configured to generate a message if the number of dropped packets is greater than the predetermined number, wherein the message is sent to a user terminal.

19. The apparatus of claim 14, wherein the forwarding comprises utilizing a Switched Port Analyzer feature.

20. The apparatus of claim 14, wherein the predetermined number is zero.