Remote port mirroring

• US 9,455,935 B2
• Filed: 01/19/2016
• Issued: 09/27/2016
• Est. Priority Date: 06/08/2010
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Brocade Communications Systems, Inc. (Broadcom, Inc.)
• Inventors: Yu, Shunjia, Koganti, Phanidhar, Terry, John Michael, Chatwani, Dilip
• Primary Examiner(s): Sam, Phirin
• Assistant Examiner(s): Ghafoerkhan, Faiyazkhan
• Application Number:
  US15/000,964
• Publication Number:
  US 20160134563A1
• Time in Patent Office: 252 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04H 20/93 which locates resources of other pieces of information, e.g. URL [Uniform Resource Locator]
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4675 Dynamic sharing of VLAN information amongst network nodes configuration of the network or of network elements H04L41/08
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 49/208 Port mirroring

Abstract

A switch that facilitates remote port mirroring is described. The switch can include an encapsulation mechanism and a forwarding mechanism. The encapsulation mechanism can be configured to encapsulate a copy of a first packet in a second packet, thereby preserving header information (e.g., a VLAN identifier and/or a TRILL header) of the first packet. The forwarding mechanism can be configured to forward the first packet using header information of the first packet, and forward the second packet using header information of the second packet. The second packet can be received at a destination switch which extracts the first packet from the second packet, and sends the first packet on a port which is coupled to a network analyzer.

Claims

1. A switch, comprising:

one or more ports;

packet processing circuitry configured to;

generate a copy of a first packet, wherein a header of the copy of the first packet includes a first identifier of a first virtual local area network (VLAN); and

include a second identifier of a second VLAN in the header of the copy of the first packet, wherein the second identifier corresponds to mirrored traffic;

encapsulation circuitry configured to generate a second packet by encapsulating the copy of the first packet with a first encapsulation header; and

forwarding circuitry configured to identify a port associated with a destination address of the first encapsulation header from the one or more ports as an egress port for the second packet, wherein the destination address of the first encapsulation header corresponds to port mirroring.

2. The switch of claim 1, wherein encapsulation circuitry is further configured to generate a third packet by encapsulating the first packet with a second encapsulation header;

and

wherein the forwarding circuitry is further configured to identify a port associated with a destination address of the second encapsulation header from the one or more ports as an egress port for the third packet.

3. The switch of claim 2, wherein the packet processing circuitry is further configured to determine the destination address of the second encapsulation header based on a destination address of the header of the first packet.

4. The switch of claim 1, wherein the packet processing circuitry is further configured to learn a source address of the header of the first packet.

5. The switch of claim 1, wherein the packet processing circuitry is further configured to determine whether to generate the copy of the first packet based on one or more of:

an access control list, an ingress port, an egress port, a VLAN tag, a source identifier, and a destination identifier.

6. The switch of claim 1, wherein the destination address of the first encapsulation header is a multicast address of a multicast group.

7. The switch of claim 1, wherein the copy of the first packet indicates that the copy of the first packet is a mirrored packet.

8. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating port mirroring, the method comprising:

generating a copy of a first packet at a switch, wherein a header of the copy of the first packet includes a first identifier of a first virtual local area network (VLAN);

including a second identifier of a second VLAN in the header of the copy of the first packet, wherein the second identifier corresponds to mirrored traffic;

generating a second packet by encapsulating the copy of the first packet with a first encapsulation header; and

identifying a port associated with a destination address of the first encapsulation header from one or more ports of the switch as an egress port for the second packet, wherein the destination address of the first encapsulation header corresponds to port mirroring.

9. The computer-readable storage medium of claim 8, wherein the method further comprises:

generating a third packet by encapsulating the first packet with a second encapsulation header; and

identifying a port associated with a destination address of the second encapsulation header from the one or more ports as an egress port for the third packet.

10. The computer-readable storage medium of claim 9, wherein the method further comprises determining the destination address of the second encapsulation header based on a destination address of the header of the first packet.

11. The computer-readable storage medium of claim 8, wherein the method further comprises learning a source address of the header of the first packet.

12. The computer-readable storage medium of claim 8, wherein the method further comprises determining whether to generate the copy of the first packet based on one or more of:

an access control list, an ingress port, an egress port, a VLAN tag, a source identifier, and a destination identifier.

13. The computer-readable storage medium of claim 8, wherein the destination address of the first encapsulation header is a multicast address.

14. The computer-readable storage medium of claim 8, wherein the copy of the first packet indicates that the copy of the first packet is a mirrored packet.

15. A computer system for facilitating port

mirroring in a network, the computer system comprising:

one or more ports;

a processor; and

a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising;

generating a copy of a first packet, wherein a header of the copy of the first packet includes a first identifier of a first virtual local area network (VLAN);

including a second identifier of a second VLAN in the header of the copy of the first packet, wherein the second identifier corresponds to mirrored traffic;

generating a second packet by encapsulating the copy of the first packet with a first encapsulation header; and

identifying a port associated with a destination address of the first encapsulation header from the one or more ports as an egress port for the second packet, wherein the destination address of the first encapsulation header corresponds to port mirroring.

16. The computer system of claim 15, wherein the method further comprises:

generating a third packet by encapsulating the first packet with a second encapsulation header;

determining a destination address of the second encapsulation header based on a destination address of the header of the first packet; and

identifying a port associated with the destination address of the second encapsulation header from the one or more ports as an egress port for the third packet.

17. The computer system of claim 15, wherein the method further comprises learning a source address of the header of the first packet.

18. The computer system of claim 15, wherein the method further comprises determining whether to generate the copy of the first packet based on one or more of:

an access control list, an ingress port, an egress port, a VLAN tag, a source identifier, and a destination identifier.

19. The computer system of claim 15, wherein the destination address of the first encapsulation header is a multicast address of a multicast group.

20. The computer system of claim 15, wherein the copy of the first packet indicates that the copy of the first packet is a mirrored packet.