Sequential heartbeat packet arrangement and methods thereof

• US 8,737,197 B2
• Filed: 02/25/2011
• Issued: 05/27/2014
• Est. Priority Date: 02/26/2010
• Status: Active Grant

• Current Assignee: Keysight Technologies Singapore Sales Pte Ltd (Keysight Technologies, Inc.)
• Original Assignee: Net Optics Incorporated (Keysight Technologies, Inc.)
• Inventors: Matityahu, Eldad, Shaw, Robert, Carpio, Dennis, Hui, Siuman, Lian, Wei
• Primary Examiner(s): Kizou, Hassan
• Assistant Examiner(s): DAYA, TEJIS A
• Application Number:
  US13/034,732
• Publication Number:
  US 20110211441A1
• Time in Patent Office: 1,187 Days
• Field of Search: 370/217
• US Class Current: 370/217
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H10N 50/85 Magnetic active materials

Abstract

An arrangement in a network tap for monitoring state of a monitoring system is provided. The arrangement includes a set of network ports that includes a set of input network ports for receiving data traffic and a set of output network ports for outputting the data traffic from the network tap. The arrangement also includes a monitoring port that is configured to receive the data traffic from the set of network ports and to forward the data traffic onward to the monitoring system. The arrangement further includes a logic component configured for executing a sequential heartbeat diagnostic test. The sequential heartbeat diagnostic test is configured for providing a first set of sequential heartbeat packets for testing and determining the state of the monitoring system. The arrangement yet also includes a logic component for activating one or more events when a failure condition exists for the state of the monitoring system.

Claims

1. An arrangement in a network tap for monitoring state of a monitoring system, comprising:

a set of network ports, said set of network ports including a set of input network ports for receiving data traffic and a set of output network ports for outputting said data traffic from said network tap;

a monitoring port, said monitoring port being configured to receive said data traffic from said set of network ports and to forward said data traffic onward to said monitoring system;

a logic component configured for executing a sequential heartbeat diagnostic test, wherein said sequential heartbeat diagnostic test is configured for providing a first set of sequential heartbeat packets for testing and determining said state of said monitoring system, wherein said logic component is a field programmable gate array (FPGA), wherein said FPGA includes a sequential heartbeat packet generator configured for generating and inserting said first set of sequential heartbeat packets into said date traffic flowing into said monitoring system, wherein said FPGA includes a set of counters, said set of counter being associated with said first set of sequential heartbeat packets, wherein said set of counters is compared against a set of failure conditions to determine said state of said monitoring system; and

a logic component for activating one or more events when a failure condition exists for said state of said monitoring system.

2. The arrangement of claim 1 wherein said FPGA is user-configurable.

3. The arrangement of claim 2 wherein said FPGA includes a sequential heartbeat detection configured for identifying and removing said first set of sequential heartbeat packets from said data traffic when said first sot of sequential heartbeat packets returns from said monitoring system.

6. The arrangement of claim 1 wherein said monitoring system is an intrusion prevention system.

7. The arrangement of claim 1 wherein said failure condition is handled by moving said network tap from a normal mode in which said network traffic flowing through said network tap is protected by said monitoring system to a bypass mode in which said network traffic flowing through said network tap is not protected by said monitoring system.

8. The arrangement of claim 1 wherein a first sequential heartbeat diagnostic test and a second sequential heartbeat diagnostic test are being executed simultaneously.

9. The arrangement of claim 1 wherein said failure condition is user-configurable.

10. The arrangement of claim 1 further including a switch, wherein said switch is configured for moving said network tap from a normal mode in which said network traffic flowing through said network tap is protected by said monitoring system to a bypass mode in which said network traffic flowing through said network tap is not protected by said monitoring system when said failure condition exist.

4. An arrangement in a network tap for monitoring state of a monitoring system, comprising:

a set of network ports, said set of network ports including a set of input network ports for receiving data traffic and a set of out network ports for outputting said data traffic from said network tap;

a monitoring port, said monitoring port being configured to receive said data traffic from said set of network ports and to forward said data traffic onward to said monitoring system;

a logic component configured for executing a sequential heartbeat diagnostic test, wherein said sequential heartbeat diagnostic test is configured for providing is first set of sequential heartbeat packets for testing and determining said state of said monitoring system; and

a logic component for activating one or more events when a failure condition exists for said state of said monitoring, system,

wherein said sequential heartbeat diagnostic test is user-configurable so that said sequential heartbeat diagnostic test is configurable to simulate different real world conditions that data traffic may experience flowing through a secured network environment.

5. The arrangement of claim 4 wherein said sequential heartbeat diagnostic test is Configurable utilizing at least one of a command line interface a web-based device, and a system interface.

11. A method for monitoring state of a monitoring system, comprising:

receiving network traffic from a set of network ports; and

executing a first sequential heartbeat diagnostic test for determining said state of said monitoring system, wherein said sequential heartbeat diagnostic test is user-configurable so that said sequential heartbeat diagnostic test is configurable to simulate different real world conditions that data traffic may experience flowing through a secured network environment and wherein said first sequential heartbeat diagnostic test includes

initializing a set of counters to zero, wherein a first counter of said set of counters is associated with a first diagnostic test condition of a set of diagnostic test conditions,

generating a plurality of sets of sequential heartbeat packets, wherein a first set of sequential heartbeat packets of said plurality of sets of heartbeat packets is associated with said first diagnostic test condition,

inserting said plurality of sets of sequential heartbeat packets into network traffic flowing between a network tap and said monitoring system,

sending said plurality of sets of sequential heartbeat packets to said monitoring system,

incrementing said set of counters by one,

receiving said network traffic from said monitoring system,

detecting and removing said first set of sequential heartbeat packets from said network traffic,

analyzing said network traffic flowing from said monitoring system to said network tap to determine if a failure condition exists, and

if a failure condition exists, triggering one or more events for handling said failure condition.

12. The method of claim 11 wherein said generating said plurality of sets of sequential heartbeat packets is performed by a sequential heartbeat packet generator.

13. The method of claim 11 wherein said detecting, and removing of said first set of sequential heartbeat packets is performed by a sequential heartbeat packet detector.

14. The method of claim 11 wherein said triggering one or more events for handling said failure condition includes moving said network tap from a normal mode in which said network traffic flowing through said network tap is protected by said monitoring system to a bypass mode in which said network traffic flowing through said network tap is not protected by said monitoring system.

15. The method of claim 11 further including executing a second sequential heartbeat diagnostic test while executing said first sequential heartbeat diagnostic test.

16. The method of claim 11 wherein said failure condition is user-configurable.

17. The method of claim 11 wherein said set of diagnostic test conditions is user-configurable.