Monitoring server load balancing

• US 9,270,566 B2
• Filed: 08/13/2012
• Issued: 02/23/2016
• Est. Priority Date: 10/09/2007
• Status: Expired due to Fees

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Brocade Communications Systems, Inc. (Broadcom, Inc.)
• Inventors: Wang, Bing, Cheung, David
• Primary Examiner(s): LIU, JUNG
• Application Number:
  US13/584,534
• Publication Number:
  US 20130173784A1
• Time in Patent Office: 1,289 Days
• Field of Search: 370230-240, 370/241, 370/241.1, 370/253, 370/389, 370/390, 370/396, 370/395.41, 370/395.43, 370/395.5, 370/419, 370/428, 370/479
• US Class Current: 1/1
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/1014 based on the content of a request

Abstract

Embodiments described herein discuss an approach to implementing load-balancing across multiple monitoring servers. One such embodiment describes a network monitoring device. The network monitoring device includes an ingress port, for receiving mirrored network packets, and a number of egress ports. The egress ports are associated with a number of monitoring servers, and used to forward the mirrored network packets to the monitoring servers. A packet classifier, coupled to the ingress port, examines the mirrored network packets, and determines which of the monitoring servers should receive the packets.

Claims

1. A network monitoring device, comprising:

an ingress port configured to receive network packets, wherein the received network packets are copies of network traffic;

a plurality of egress ports, each associated with one of a plurality of monitoring servers; and

a packet classifier coupled to the ingress port;

wherein a plurality of monitoring groups are configured for the network monitoring device, each monitoring group from the plurality of monitoring groups including one or more monitoring servers from the plurality of monitoring servers, wherein each monitoring group from the plurality of monitoring groups is associated with a networking protocol; and

wherein the packet classifier is configured to;

determine that a plurality of network packets from among the received network packets is associated with a particular network protocol;

determine, based upon the particular network protocol, a particular monitoring group from the plurality of monitoring groups; and

distribute the plurality of network packets between multiple monitoring servers associated with the particular monitoring group, wherein the distributing includes, for each particular network packet from the plurality of network packets;

selecting a monitoring server from the multiple monitoring servers based on information included in a header of the particular network packet; and

forwarding the particular network packet from the network monitoring device using an egress port from the plurality of egress ports that is associated with the selected monitoring server.

2. The network monitoring device of claim 1, wherein the packet classifier is further configured to identify a set of network packets from the received network packets that belong to a same flow, and wherein selecting a monitoring server includes selecting the same monitoring server for the identified set of network packets.

3. The network monitoring device of claim 1, further comprising one or more programmable memories coupled to the packet classifier, the one or more programmable memories storing information used by the packet classifier to forward the particular network packet from the network monitoring device.

4. The network monitoring device of claim 1, wherein the packet classifier is further configured to select the monitoring server from the multiple monitoring servers by generating a hash value from the information provided by the header associated with the particular network packet.

5. The network monitoring device of claim 4, wherein the packet classifier is further configured to select the monitoring server from the multiple monitoring servers by comparing the generated hash value against a range of hash values corresponding to the multiple monitoring servers associated with the particular monitoring group.

6. The network monitoring device of claim 4, wherein a range of hash values is divided into a plurality of sub-ranges, wherein each sub-range is assigned to a monitoring server from the multiple monitoring servers, and wherein the selected monitoring server is associated with a sub-range that includes the generated hash value.

7. The network monitoring device of claim 4, wherein the packet classifier is further configured to select the monitoring server from the multiple monitoring servers by determining that the generated hash values matches a hash value assigned to the selected monitoring server.

8. The network monitoring device of claim 1, wherein the packet classifier is further configured to perform status checks for each of the multiple monitoring servers associated with the particular monitoring group.

9. The network monitoring device of claim 8, wherein the packet classifier is further configured to select the monitoring server from the multiple monitoring server based on results of the status checks.

10. The network monitoring device of claim 1, further comprising a plurality of additional ingress ports configured to receive additional network packets from sources that are different than a source associated with the ingress port, wherein the additional network packets are copies of network traffic.

11. A method comprising:

determining that each network packet in a plurality of network packets received at an ingress port of a network monitoring device is associated with a particular network protocol, wherein the plurality of network packets are copies of network traffic;

determining, based upon the particular network protocol, a particular monitoring group from a plurality of monitoring groups configured for the network monitoring device, the plurality of monitoring groups including one or more monitoring servers from a plurality of monitoring servers, the plurality of monitoring servers each being associated with one of a plurality of egress ports included in the network monitoring device, wherein each monitoring group from the plurality of monitoring groups is associated with a network protocol; and

distributing the plurality of network packets between multiple monitoring servers associated with the particular monitoring group, wherein the distributing includes, for each particular network packet from the plurality of network packets;

selecting a monitoring server from the multiple monitoring servers based on information included in a header of the particular network packet; and

forwarding the particular network packet from the network monitoring device using an egress port from the plurality of egress ports that is associated with the selected monitoring server.

12. The method of claim 11, further comprising identifying a set of network packets from the received network packets that belong to a same flow, and wherein selecting a monitoring server includes selecting the same monitoring server for the identified set of network packets.

13. The method of claim 11, wherein forwarding the particular network packet further includes using data stored in one or more programmable memories.

14. The method of claim 11, further comprising:

receiving additional network packets at a plurality of additional ingress ports included by the network monitoring device, wherein the additional ingress ports are configured to receive the additional network packets from sources that are different than a source associated with the ingress port, and wherein the additional network packets are copies of network traffic.

15. The method of claim 11, wherein selecting a monitoring server from the multiple monitoring servers further includes:

generating a hash value using the information included in the header of the particular network packet; and

selecting the monitoring server from the multiple monitoring servers based on comparing the hash value against a range of hash values corresponding to the multiple monitoring servers associated with the particular monitoring group.

16. The method of claim 11, further comprising:

performing status checks for each of the multiple monitoring servers associated with the particular monitoring group.

17. The method of claim 11, further comprising:

configuring a new monitoring group for the network monitoring device, wherein configuring the new monitoring group includes;

associating one or more new monitoring servers from the plurality of monitoring servers with the new monitoring group, wherein the one or more new monitoring servers are each newly associated with an egress port from the plurality of egress ports; and

associating a network protocol with the new monitoring group.

18. The method of claim 11, further comprising:

configuring a new monitoring group for the network monitoring device, wherein configuring includes;

associating one or more monitoring servers from the plurality of monitoring servers with the new monitoring group; and

associating a network protocol with the new monitoring group.

19. The method of claim 18, wherein configuring the new monitoring group further comprises assigning a range of hash values to the one or more monitoring servers associated with the new monitoring group.

20. The method of claim 11, wherein the network monitoring device is further configured with a default monitoring group, the default monitoring group including one or more monitoring servers from the plurality of monitoring servers.

21. The method of claim 20, further comprising:

determining that a second plurality of network packets received at the ingress port of the network monitoring device is associated with a second network protocol, wherein the second plurality of network packets are copies of network traffic;

based upon determining that the second network protocol is not associated with a monitoring group from the plurality of monitoring groups, selecting the default monitoring group; and

distributing the second plurality of network packets between multiple monitoring servers associated with the default monitoring group.

22. The method of claim 15, wherein the range of hash values are divided into a plurality of sub-ranges, wherein each sub-range is assigned to a monitoring server from the multiple monitoring servers, and wherein the selected monitoring server is associated with a sub-range that includes the generated hash value.

23. The method of claim 15, wherein each value from the range of hash values is assigned to a corresponding monitoring server from the multiple monitoring servers, and wherein the generated hash value matches a hash value from the range of hash values that is assigned to the selected monitoring server.

24. The method of claim 16, wherein selecting a monitoring server from the multiple monitoring servers is further based on results of the status checks.

25. A non-transitory computer-readable storage medium storing a plurality of computer-executable instructions executable by one or more processors, the plurality of instructions comprising:

instructions causing at least one processor from the one or more processors to determine that a plurality of network packets received at an ingress port of a network monitoring device is associated with a particular network protocol, wherein the received network packets are copies of network traffic;

instructions causing at least one processor from the one or more processors to determine, based upon the particular network protocol, a particular monitoring group from a plurality of monitoring groups configured for the network monitoring device, the plurality of monitoring groups including one or more monitoring servers from a plurality of monitoring servers, the plurality of monitoring servers each being associated with one of a plurality of egress ports included in the network monitoring device, wherein each monitoring group form the plurality of monitoring groups is associated with a network protocol; and

instructions causing at least one processor from the one or more processors to distribute the plurality of network packets between multiple monitoring servers associated with the particular monitoring group, wherein the distributing includes, for each particular network packet from the plurality of network packets;

selecting a monitoring server from the multiple monitoring servers based on information included in a header of the particular network packet; and

forwarding the particular network packet from the network monitoring device using an egress port from the plurality of egress ports that is associated with the determined selected monitoring server.