Port mirroring for sampling measurement of network flows
First Claim
1. A method, in a data processing system, for analyzing data traffic through a network, the method comprising:
- sampling data packets of a data flow through a normal port of a network forwarding device of the network, wherein the sampling is performed at least by configuring the network forwarding device to implement port mirroring of the normal port to a designated mirror port of the network forwarding device;
forwarding sampled data packets, copied to the mirror port by virtue of the port mirroring, to a collector computing device;
processing, by the collector computing device, the sampled data packets to analyze the data flow through the normal port of the network forwarding device; and
performing, by the collector computing device, an operation based on results of the analysis, wherein a number of mirror ports and a number of normal ports in the network forwarding device are configured according to a desired sampling size or desired sampling rate.
1 Assignment
0 Petitions
Accused Products
Abstract
Mechanisms are provided for analyzing data traffic through a network. The mechanisms sample data packets of a data flow through a normal port of a network forwarding device of the network. The sampling is performed at least by configuring the network forwarding device to implement port mirroring of the normal port to a designated mirror port of the network forwarding device. The mechanisms forward sampled data packets, copied to the mirror port by virtue of the port mirroring, to a collector computing device. The mechanisms process, by the collector computing device, the sampled data packets to analyze the data flow through the normal port of the network forwarding device. The mechanisms perform, by the collector computing device, an operation based on results of the analysis.
-
Citations
18 Claims
-
1. A method, in a data processing system, for analyzing data traffic through a network, the method comprising:
-
sampling data packets of a data flow through a normal port of a network forwarding device of the network, wherein the sampling is performed at least by configuring the network forwarding device to implement port mirroring of the normal port to a designated mirror port of the network forwarding device; forwarding sampled data packets, copied to the mirror port by virtue of the port mirroring, to a collector computing device; processing, by the collector computing device, the sampled data packets to analyze the data flow through the normal port of the network forwarding device; and performing, by the collector computing device, an operation based on results of the analysis, wherein a number of mirror ports and a number of normal ports in the network forwarding device are configured according to a desired sampling size or desired sampling rate. - View Dependent Claims (2, 3, 4, 5, 6, 8, 9)
-
-
7. A method, in a data processing system, for analyzing data traffic through a network, the method comprising:
-
sampling data packets of a data flow through a normal port of a network forwarding device of the network, wherein the sampling is performed at least by configuring the network forwarding device to implement port mirroring of the normal port to a designated mirror port of the network forwarding device; forwarding sampled data packets, copied to the mirror port by virtue of the port mirroring, to a collector computing device; processing, by the collector computing sampled data packets to analyze the data flow through the normal port of the network forwarding device; performing, by the collector computing device, an operation based on results of the analysis; and recovering original input port metadata associated with the sampled data packets based on data packet forwarding rules implemented in the network forwarding device of the network, wherein recovering original input port metadata for the sampled data packets comprises, for each sampled data packet; correlating packet header information of the sampled data packet with the forwarding rules to determine another device in the network from which the sampled data packet was received; and determining an input port of the network forwarding device through which the sampled data packet was received based on the determination of the another device.
-
-
10. A computer program product comprising a non-transitory computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a data processing system comprising a network forwarding device and a collector computing device, causes the data processing system to:
-
sample data packets of a data flow through a normal port of the network forwarding device, wherein the sampling is performed at least by configuring the network forwarding device to implement port mirroring of the normal port to a designated mirror port of the network forwarding device; forward sampled data packets, copied to the mirror port by virtue of the port mirroring, to the collector computing device; process, by the collector computing device, the sampled data packets to analyze the data flow through the normal port of the network forwarding device; and perform, by the collector computing device, an operation based on results of the analysis, wherein a number of mirror ports and a number of normal ports in the network forwarding device are configured according to a desired sampling size or desired sampling rate. - View Dependent Claims (11, 12, 13, 14, 15, 16)
-
-
17. A computer program product comprising a non-transitory computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a data processing system comprising a network forwarding device and a collector computing device, causes the data processing system to:
-
sample data packets of a data flow through a normal port of the network forwarding device, wherein the sampling is performed at least by configuring the network forwarding device to implement port mirroring of the normal port to a designated mirror port of the network forwarding device; forward sampled data packets, copied to the mirror port by virtue of the port mirroring, to the collector computing device; process, by the collector computing device, the sampled data packets to analyze the data flow through the normal port of the network forwarding device; perform, by the collector computing device, an operation based on results of the analysis; and recover original input port metadata associated with the sampled data packets based on data packet forwarding rules implemented in the network forwarding device of the network, wherein the computer readable program causes the data processing system to recover original input port metadata for the sampled data packets at least by, for each sampled data packet; correlating packet header information of the sampled data packet with the forwarding rules to determine another device in the network from which the sampled data packet was received; and determining an input port of the network forwarding device through which the sampled data packet was received based on the determination of the another device.
-
-
18. A system comprising:
-
a network forwarding device; and a collector computing device communicatively coupled to the network forwarding device, wherein the network forwarding device is configured to; sample data packets of a data flow through a normal port of the network forwarding device, wherein the sampling is performed at least by configuring the network forwarding device to implement port mirroring of the normal port to a designated mirror port of the network forwarding device; and forwarding sampled data packets, copied to the mirror port by virtue of the port mirroring, to the collector computing device, and wherein the collector computing devices is configured to; process the sampled data packets to analyze the data flow through the normal port of the network forwarding device; and perform, by the collector computing device, an operation based on results of the analysis, wherein a number of mirror ports and a number of normal ports in the network forwarding device are configured according to a desired sampling size or desired sampling rate.
-
Specification