Method and system for identifying matching packets
First Claim
1. A method, comprising:
- receiving, by a device, a first subset of a first plurality of packets,the first plurality of packets being associated with a first location in a network;
receiving, by the device, a second subset of a second plurality of packets,the second plurality of packets being associated with a second location in the network, andthe second location being different than the first location;
parsing, by the device, each packet in the first subset and the second subset to extract invariant header fields from an outermost header until a minimal set of invariant header fields is obtained, for each packet, that uniquely identifies each packet throughout the network within a particular time period,the particular time period being long enough in duration to allow each packet to traverse the network, but short enough in duration to minimize a likelihood of a same packet signature from being computed for different packets;
determining, by the device, a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset;
comparing, by the device, packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset;
determining, by the device, a latency between the first location and the second location in the network based on matching packets in the first subset and the second subset; and
adjusting, by the device and based on the latency, a filter associated with capturing packets at the first location or the second location.
2 Assignments
0 Petitions
Accused Products
Abstract
In a method of identifying matching packets at different locations in a network, a first plurality of packets is received at a first location in the network, and a first subset thereof is selected in accordance with a filter. A second plurality of packets is received at a second location in the network, and a second subset thereof is selected in accordance with the same filter. Each packet in the first and second subsets is parsed to extract invariant header fields from an outermost IP header inwards, until a minimal set of invariant header fields is obtained for that packet, or until it is determined that a minimal set is not obtainable for that packet. A packet signature is computed from the minimal set for each packet having a minimal set, and the packet signatures arc compared to identify matching packets in the first and second subsets.
37 Citations
20 Claims
-
1. A method, comprising:
-
receiving, by a device, a first subset of a first plurality of packets, the first plurality of packets being associated with a first location in a network; receiving, by the device, a second subset of a second plurality of packets, the second plurality of packets being associated with a second location in the network, and the second location being different than the first location; parsing, by the device, each packet in the first subset and the second subset to extract invariant header fields from an outermost header until a minimal set of invariant header fields is obtained, for each packet, that uniquely identifies each packet throughout the network within a particular time period, the particular time period being long enough in duration to allow each packet to traverse the network, but short enough in duration to minimize a likelihood of a same packet signature from being computed for different packets; determining, by the device, a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset; comparing, by the device, packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset; determining, by the device, a latency between the first location and the second location in the network based on matching packets in the first subset and the second subset; and adjusting, by the device and based on the latency, a filter associated with capturing packets at the first location or the second location. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A device, comprising:
one or more processors to; receive a first subset of a first plurality of packets, the first plurality of packets being associated with a first location in a network; receive a second subset of a second plurality of packets, the second plurality of packets being associated with a second location in the network, and the second location being different than the first location; parse each packet in the first subset and the second subset to extract invariant header fields from an outermost header until a minimal set of invariant header fields is obtained, for each packet, that uniquely identifies each packet throughout the network within a particular time period, the particular time period being long enough in duration to allow each packet to traverse the network, but short enough in duration to minimize a likelihood of a same packet signature from being computed for different packets; determine a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset; compare packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset; determine a latency between the first location and the second location in the network based on matching packets in the first subset and the second subset; and adjust, based on the latency, a filter associated with capturing packets at the first location or the second location. - View Dependent Claims (11, 12, 13, 14)
-
15. A system, comprising:
one or more devices to; receive a first subset of a first plurality of packets, the first plurality of packets being associated with a first location in a network; receive a second subset of a second plurality of packets, the second plurality of packets being associated with a second location in the network, and the second location being different than the first location; parse each packet in the first subset and the second subset to extract invariant header fields from an outermost header until a minimal set of invariant header fields is obtained, for each packet, that uniquely identifies each packet throughout the network within a particular time period, the particular time period being long enough in duration to allow each packet to traverse the network, but short enough in duration to minimize a likelihood of a same packet signature from being computed for different packets; determine a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset; compare packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset; determine a latency between the first location and the second location in the network based on matching packets in the first subset and the second subset; and adjust, based on the latency, a filter associated with capturing packets at the first location or the second location. - View Dependent Claims (16, 17, 18, 19, 20)
Specification