Method and system for simplified network wide traffic and/or flow monitoring in a data network

• US 8,542,681 B2
• Filed: 09/16/2010
• Issued: 09/24/2013
• Est. Priority Date: 02/13/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Andrews, Robert, Yadav, Navindra, Murthy, Shree, Pandian, Gnanaprakasam
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Ghafoerkhan, Faiyazkhan
• Application Number:
  US12/883,531
• Publication Number:
  US 20110010449A1
• Time in Patent Office: 1,104 Days
• Field of Search: None
• US Class Current: 370/390
• CPC Class Codes: H04L 12/4675 Dynamic sharing of VLAN information amongst network nodes configuration of the network or of network elements H04L41/08
• CPC Class Codes: H04L 12/4695 VTP [VLAN trunking protocol]
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events

Abstract

Method and system for providing dynamic network data traffic monitoring including monitoring a data network, detecting a change in the data network, initiating a span session based on the detected change in the data network, and dynamically modifying network configuration based on the detected change in the data network is disclosed.

Claims

1. A method of providing dynamic network data traffic monitoring, comprising:

transmitting a request to access a data network for a source to be monitored, the request to access the data network indicating that the source has migrated in the data network to become coupled to a network device;

receiving, responsive to the request to access the data network, information associated with a Virtual Local Area Network (VLAN) that has been automatically allocated for a Switched Port Analyzer (SPAN) session corresponding to the request to access the data network, the VLAN allocated for the SPAN session coupling the source and a destination that performs monitoring; and

sending, by a network device, a copy of traffic to and from the source to the destination in the SPAN session, wherein the allocated VLAN carries the copy of the traffic sent to the destination in the SPAN session.

2. The method of claim 1 wherein the step of receiving information associated with the VLAN includes the step of receiving a SPAN source information and a SPAN destination information.

3. The method of claim 2 further including the step of storing the SPAN source information and the SPAN destination information.

4. The method of claim 1 further comprising:

receiving information associated with a VLAN trunking protocol (VTP) configuration for the SPAN session.

5. The method of claim 4 further comprising:

configuring the VLAN to support a remote SPAN (RSPAN) session.

6. The method of claim 1 further comprising:

enabling a SPAN tunneling in the data network for the SPAN source and destination.

7. The method of claim 6 wherein the enabling the SPAN tunneling includes:

informing a tunnel source end-point and a tunnel destination end-point of the VLAN.

8. A system comprising:

a network device coupled to a data network; and

a controller unit coupled to the data network, the controller unit configured to;

detect a migration of a client terminal in the data network to become coupled to the network device;

in response to the detection of the migration of the client terminal, automatically initiate a Switched Port Analyzer (SPAN) session for monitoring the client terminal, the SPAN session coupling the network device to a destination that performs monitoring;

automatically allocate a Virtual Local Area Network (VLAN) for the SPAN session;

enable the network device to send a copy of traffic to and from the client terminal to the allocated VLAN; and

configure the data network to deliver the copy of traffic on the allocated VLAN to the destination that performs monitoring.

9. The system of claim 8 wherein the controller unit includes a memory, and the controller unit is further configured to store SPAN source and SPAN destination information in the memory.

10. The system of claim 9 wherein the controller unit is further configured to utilize a VLAN trunking protocol (VTP) to configure the data network to deliver the copy of traffic to the destination that performs monitoring.

11. The system of claim 10 wherein the controller unit is further configured to utilize the allocated VLAN to support a remote SPAN (RSPAN) session.

12. The system of claim 8 wherein the controller unit is further configured to enable a SPAN tunneling in the data network for the network device and the destination that performs monitoring.

13. The system of claim 12 wherein the controller unit is further configured to inform a tunnel source end-point and a tunnel destination end-point of the VLAN.

14. The system of claim 13 wherein the tunnel source end-point is the network device.

15. A method comprising:

detecting a migration of a source to be monitored in a data network such that the source becomes coupled to a network device;

in response to detecting the migration of the source, automatically initiating a Switched Port Analyzer (SPAN) session for monitoring the source, the SPAN session coupling the network device to a destination that performs monitoring;

automatically allocating a Virtual Local Area Network (VLAN) for the SPAN session, the VLAN to carry a copy of traffic to and from the source that is provided to the destination that performs monitoring; and

configuring the data network to deliver the copy of traffic on the allocated VLAN to the destination that performs monitoring.

16. The method of claim 15 wherein the step of automatically initiating further comprises providing a SPAN source and SPAN destination to the network device.

17. The method of claim 15 further comprising:

utilizing a VLAN trunking protocol (VTP) to configure the data network to deliver the copy of traffic to the destination that performs monitoring.

18. The method of claim 15 wherein the SPAN session is a remote SPAN (RSPAN) session.

19. The method of claim 15, further comprising:

identifying the source to be monitored by a source handle and the destination that performs monitoring by a destination handle, wherein the source handle and the destination handle each indicate at least a port, a Media Access Control (MAC) address or a user name.