Method for time aware inline remote mirroring

• US 9,106,520 B2
• Filed: 02/28/2014
• Issued: 08/11/2015
• Est. Priority Date: 06/15/2010
• Status: Active Grant

• Current Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Original Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Inventors: Scott, Alistair, Bauer, Samuel M., Stevens, Michael
• Primary Examiner(s): Zaidi, Iqbal
• Application Number:
  US14/194,177
• Publication Number:
  US 20140177465A1
• Time in Patent Office: 529 Days
• Field of Search: 370/235, 370386-388, 370428-429, 3703951-427, 370352-355, 709223-224
• US Class Current: 1/1
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/50 Testing arrangements

Abstract

A method of monitoring packet traffic is provided. The method includes: at a first access point, capturing portions of traffic packets passing therethrough separated by time intervals; encapsulating the portions of traffic packets thereby forming encapsulated packets and adding timestamps to the encapsulated packets so as to preserve the portions of traffic packets and information related to the time intervals; transmitting the encapsulated packets over a network; decapsulating the encapsulated packets so as to obtain replay packets and the capture timestamps, wherein the replay packets include the portions of the traffic packets; and, transmitting the replay packets separated by the time intervals, wherein the timestamps are used to reproduce the time intervals so as to imitate the traffic packets passing through the first access point.

Claims

1. A method of monitoring traffic packets passing through a first access point, comprising:

at a mediator, receiving a request for providing to a remote device portions of the traffic packets passing through the first access point captured at the first access point;

registering the mediator so as to receive the portions of the traffic packets captured at the first access point;

at the mediator,

receive a request for providing to a remote device the portions of the traffic packets passing through the first access point captured at the first access point;

register so as to receive the portions of the traffic packets captured at the first access point;

receiving encapsulated packets from a network,

extracting timestamps from the encapsulated packets,

decapsulating the encapsulated packets so as to obtain the portions of the traffic packets captured at the first access point, and

forming replay packets, wherein the replay packets include the portions of the traffic packets; and

transmitting the replay packets from the mediator to the remote device, wherein the replay packets are separated by time intervals so as to imitate the traffic packets passing through the first access point, and wherein the time intervals are reproduced using the timestamps, wherein the reproduction of the time intervals comprises sequencing the replay packets based on sequence numbers of the encapsulated packets.

2. The method as defined in claim 1, wherein the decapsulating of the encapsulated packets includes decryption.

3. The method as defined in claim 2, wherein the request for providing the portions of the traffic packets includes a filter to select the packets to be captured.

4. The method as defined in claim 2, wherein reproduction of the time intervals includes de-jittering of the packets using a de-jitter buffer.

5. The method as defined in claim 1, wherein forming the replay packets includes reassembling fragments of the portions of the traffic packets.

6. A computer readable non-transitory tangible media comprising a set of instructions stored therein, wherein the set of instructions implements the method defined in claim 1 when executed by one or more processors.

7. A system configured to perform the method defined in claim 1.

8. A packet traffic monitoring system comprising:

a first probe for coupling with a first access point and programmed to capture portions of traffic packets passing therethrough separated by time intervals, and for encapsulating the portions of traffic packets thereby forming encapsulated packets and adding timestamps to the encapsulated packets so as to preserve the portions of traffic packets and information related to the time intervals, and for transmitting the encapsulated packets over a network; and

,

a mediator suitably programmed to;

receive a request for providing to a remote device the portions of the traffic packets passing through the first access point captured at the first access point;

register so as to receive the portions of the traffic packets captured at the first access point;

receive the encapsulated packets from the network,

decapsulate the encapsulated packets so as to obtain replay packets and the capture timestamps, wherein the replay packets include the portions of the traffic packets; and

transmit the replay packets separated by the time intervals, wherein the timestamps are used to reproduce the time intervals so as to imitate the traffic packets passing through the first access point; and

a second probe for connecting at a second access point different from the first access point, connected to a routing engine and wherein the mediator interleaves the replay packets associated with the first probe with replay packets associated with the second probe.

9. The system as defined in claim 8, wherein the routing engine is configured to receive the encapsulated packets from the first probe and provide said packets to the mediator, wherein the mediator is a device separate from the routing engine.

10. The system as defined in claim 8, wherein the first probe is programmed to encrypt the portions of traffic packets.