Method for time aware inline remote mirroring

• US 8,705,395 B2
• Filed: 05/10/2011
• Issued: 04/22/2014
• Est. Priority Date: 06/15/2010
• Status: Active Grant

• Current Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Original Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Inventors: Scott, Alistair, Bauer, Sam, Stevens, Michael
• Primary Examiner(s): Ngo, Ricky
• Assistant Examiner(s): Zaidi, Iqbal
• Application Number:
  US13/104,708
• Publication Number:
  US 20110305149A1
• Time in Patent Office: 1,078 Days
• Field of Search: 370/235, 370386-388, 370428-429, 3703951-427, 370352-355, 709223-224
• US Class Current: 370/252
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/50 Testing arrangements

Abstract

A method of monitoring packet traffic is provided. The method includes: at a first access point, capturing portions of traffic packets passing therethrough separated by time intervals; encapsulating the portions of traffic packets thereby forming encapsulated packets and adding timestamps to the encapsulated packets so as to preserve the portions of traffic packets and information related to the time intervals; transmitting the encapsulated packets over a network; decapsulating the encapsulated packets so as to obtain replay packets and the capture timestamps, wherein the replay packets include the portions of the traffic packets; and, transmitting the replay packets separated by the time intervals, wherein the timestamps are used to reproduce the time intervals so as to imitate the traffic packets passing through the first access point.

Claims

1. A method of monitoring packet traffic, comprising:

at a first access point, capturing portions of traffic packets passing therethrough separated by time intervals;

encapsulating the portions of traffic packets thereby forming encapsulated packets and adding capture timestamps to the encapsulated packets to preserve the portions of traffic packets and information related to the time intervals;

transmitting the encapsulated packets over a network through a low bandwidth channel in a high bandwidth channel, wherein forming the low bandwidth channel comprises, for each encapsulated packet, detecting a gap of a predefined duration between packets in the high-bandwidth channel and inserting the encapsulated packet into the gap;

decapsulating the encapsulated packets to obtain replay packets and the capture timestamps, wherein the replay packets include the portions of the traffic packets; and

,

transmitting the replay packets separated by the time intervals, wherein the capture timestamps are used to reproduce the time intervals

to imitate the traffic packets passing through the first access point.

2. The method as defined in claim 1 wherein the time intervals between the traffic packets are non-periodic intervals.

3. The method as defined in claim 1 wherein the portions of the traffic packets are encrypted within the encapsulated packets.

4. The method as defined in claim 1 wherein the replay packets are transmitted to a packet analyzer.

5. The method as defined in claim 4 further comprising analyzing the portions of the traffic packets at the packet analyzer.

6. The method as defined in claim 4 further comprising capturing portions of traffic packets passing through a second access point and transmitting the corresponding replay packets to the packet analyzer.

7. The method as defined in claim 1 wherein at the capturing step, the traffic packets are selected using remotely-configured filters.

8. The method as defined in claim 1 wherein encapsulating the portions of traffic packets includes fragmentation thereof.

9. A packet traffic monitoring system comprising:

a first probe for coupling with a first access point and programmed to capture portions of traffic packets passing therethrough separated by time intervals, and for encapsulating the portions of traffic packets thereby forming encapsulated packets and adding timestamps to the encapsulated packets to preserve the portions of traffic packets and information related to the time intervals, and for transmitting the encapsulated packets over a network through a low bandwidth channel in a high bandwidth channel, wherein forming the low bandwidth channel at the first probe comprises, for each encapsulated packet, detecting a gap of a predefined duration between packets in the high-bandwidth channel and inserting the encapsulated packet into the gap; and

,

a mediator suitably programmed to;

receive the encapsulated packets from the network,

decapsulate the encapsulated packets to obtain replay packets and the capture timestamps, wherein the replay packets include the portions of the traffic packets; and

,

transmit the replay packets separated by the time intervals, wherein the timestamps are used to reproduce the time intervals to imitate the traffic packets passing through the first access point.

10. The system as defined in claim 9 further comprising a routing engine for receiving the encapsulated packets from the first probe and providing said packets to the mediator.

11. The system as defined in claim 9 further comprising a second probe for connecting at a second access point different from the first access point, connected to the routing engine and wherein the mediator interleaves the replay packets associated with the first probe with replay packets associated with the second probe.

12. The system as defined in claim 9 wherein the first probe is programmed to encrypt the portions of traffic packets.