Duplicating network traffic through transparent VLAN flooding

• US 9,294,367 B2
• Filed: 09/18/2013
• Issued: 03/22/2016
• Est. Priority Date: 07/11/2007
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Foundry Networks LLC (Broadcom, Inc.)
• Inventors: Natarajan, Hari, Sahle, Eskinder, Helfinstine, Charles, Oskuie, Chris
• Primary Examiner(s): O CONNOR, BRIAN T
• Application Number:
  US14/030,782
• Publication Number:
  US 20140022916A1
• Time in Patent Office: 916 Days
• Field of Search: 370/250, 370/329, 370/389, 370/390, 370/392, 370/394
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4645 Details on frame tagging routing of packets H04L45/00; support for virtual LAN H04L49/354
• CPC Class Codes: H04L 12/465 wherein a single frame includes a plurality of VLAN tags
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 45/32 Flooding denial of service attacks H04L63/1458
• CPC Class Codes: H04L 49/10 characterised by the switching fabric construction
• CPC Class Codes: H04L 49/111 Switch interfaces, e.g. port details
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]

Abstract

An approach to duplicating network traffic is described. In one approach, a method of creating multiple copies of network traffic is detailed. The method involves receiving network traffic, producing a duplicate copy of the network traffic, and forwarding the duplicate copy to a monitoring port. The monitoring port forwards copies to a number of indicated ports.

Claims

1. A method comprising:

determining, based on contents of a packet received at a network device, that the received packet is to be sent to one or more monitoring devices, wherein the network device includes a virtual local area network (VLAN), the VLAN including a receiving port and a plurality of I/O ports, the receiving port and the plurality of I/O ports of the VLAN corresponding to ports of the network device, wherein Media Access Control (MAC) learning has been disabled for the receiving port;

generating a duplicate packet from the received packet;

causing the duplicate packet to be sent to the receiving port of the VLAN; and

upon receiving the duplicate packet at the receiving port of the VLAN, causing a copy of the duplicate packet to be sent to each of one or more of the plurality of I/O ports of the VLAN.

2. The method of claim 1, wherein determining that the packet is to be sent to one or more monitoring devices includes determining that information included in the packet matches a defined parameter.

3. The method of claim 1, wherein determining that the packet is to be sent to one or more monitoring devices includes determining that information included in the packet matches a specified networking protocol.

4. The method of claim 1, wherein determining that the packet is to be sent to one or more monitoring devices includes determining that information included in the packet matches a specified recipient network address.

5. The method of claim 1, wherein determining that the packet is to be sent to one or more monitoring devices includes determining that information included in the packet matches a specified sender network address.

6. The method of claim 1, further comprising using an access control list (ACL) to determine to which of the plurality of I/O ports the duplicate packet is copied.

7. The method of claim 6, further comprising:

identifying a type of the packet;

wherein causing a copy of the duplicate packet to be sent to each of one or more of the plurality of I/O ports includes selecting one or more ports from the plurality of I/O ports using the ACL.

8. The method of claim 6, wherein causing a copy of the duplicate packet to be sent to each of one or more of the plurality of I/O ports includes selecting one or more ports from the plurality of I/O ports, wherein the one or more selected ports are determined from the ACL to be ports associated with devices for analyzing network traffic.

9. The method of claim 1, wherein generating the duplicate packet includes using port mirroring to duplicate the packet.

10. The method of claim 1, wherein each of the plurality of I/O ports is configured to connect to a corresponding monitoring device.

11. The method of claim 1, wherein causing a copy of the duplicate packet to be sent to each of one or more of the plurality of I/O ports includes causing a copy of the duplicate packet to be sent to each of the plurality of I/O ports.

12. A non-transitory computer-readable medium storing a plurality of instructions executable by one or more processors of a network device, the network device including a virtual local area network (VLAN), the VLAN including a receiving port and a plurality of I/O ports, the receiving port and the plurality of I/O ports of the VLAN corresponding to ports of the network device, wherein Media Access Control (MAC) learning has been disabled for the receiving port;

and

wherein the plurality of instructions comprise;

instructions for causing at least one processor from the one or more processors to determine, based on contents of a packet received at the network device, that the received packet is to be sent to one or more monitoring devices;

instructions for causing at least one processor from the one or more processors to generate a duplicate packet from the received packet; and

instructions for causing at least one processor from the one or more processors to cause the duplicate packet to be sent to the receiving port of the VLAN of the network device; and

upon receiving the duplicate packet at the receiving port of the VLAN;

instructions for causing at least one processor from the one or more processors to cause a copy of the duplicate packet to be sent to each of one or more of the plurality of I/O ports of the VLAN.

13. The non-transitory computer-readable medium of claim 12, wherein the instructions for causing at least one processor from the one or more processors to generate the duplicate packets include instructions for causing at least one processor from the one or more processors to use port mirroring for generating the duplicate packet.

14. The non-transitory computer-readable medium of claim 12, wherein each of the plurality of I/O ports is configured to connect to a monitoring device.

15. The non-transitory computer-readable medium of claim 12, wherein the instructions for causing at least one processor from the one or more processors to cause a copy of the duplicate packet to be sent to one or more of the plurality of I/O ports include instructions for causing at least one processor from the one or more processors to send a copy to each of the plurality of I/O ports.

16. The non-transitory computer-readable medium of claim 12, wherein instructions for causing at least one processor from the one or more processors to determine that the packet is to be sent to one or more monitoring devices include instructions for causing at least one processor from the one or more processors to determine that information included in the packet matches a defined parameter.

17. A network device, comprising:

a plurality of ports, comprising a first port configured as a receiving port for a VLAN configured for the network device, the plurality of ports further comprising a set of ports configured as I/O ports of the VLAN, wherein Media Access Control (MAC) learning has been disabled for the receiving port;

wherein the network device is configured to;

determine, based on contents of a packet received at the network device, that the received packet is to be sent to one or more monitoring devices;

generate a duplicate packet from the received packet;

cause the duplicate packet to be sent to the receiving port of the VLAN of the network device; and

upon receiving the duplicate packet at the receiving port of the VLAN, cause a copy of the duplicate packet to be sent to each of one or more of the I/O ports of the VLAN.

18. The network device of claim 17, wherein the network device is configured to determine that the packet is to be sent to one or more monitoring devices by determining that information included in the packet matches a defined parameter.

19. The network device of claim 17, wherein the network device is configured to determine that the packet is to be sent to one or more monitoring devices by determining that information included in the packet matches a specified networking protocol.

20. The network device of claim 17, wherein the network device is configured to determine that the packet is to be sent to one or more monitoring devices includes determining that information included in the packet matches a specified recipient network address.

21. The network device of claim 17, wherein the network device is configured to determine that the packet is to be sent to one or more monitoring devices by determining that information included in the packet matches a specified sender network address.

22. The network device of claim 17, wherein the network device is further configured to use an access control list (ACL) to determine to which of the I/O ports the duplicate packet is copied.

23. The network device of claim 22, wherein the network device is further configured to:

identify a type of the duplicate packet; and

select one or more ports from the plurality of I/O ports to which copies of the duplicate packet arc sent using the ACL.

24. The network device of claim 22, wherein the network device is configured to cause a copy of the duplicate packet to be sent to each of the plurality of I/O ports by selecting one or more ports from the plurality of I/O ports, wherein the one or more selected ports are determined from the ACL to be ports associated with devices for analyzing network traffic.

25. The network device of claim 17, wherein the network device is configured to generate the duplicate packet using port mirroring.

26. The network device of claim 25, wherein the network device is configured to generate the duplicate packet using port mirroring.

27. The network device of claim 17, wherein each of the plurality of I/O ports is configured to connect to a corresponding monitoring device.

28. The network device of claim 17, wherein the network device is configured to cause a copy of the duplicate packet to be sent to each of the plurality of I/O ports.