Routing network traffic packets through a shared inline tool

• US 9,912,575 B2
• Filed: 11/18/2015
• Issued: 03/06/2018
• Est. Priority Date: 11/18/2015
• Status: Active Grant

• Current Assignee: Gigamon Incorporated (Elliott Capital Advisors LP)
• Original Assignee: Gigamon Incorporated (Elliott Capital Advisors LP)
• Inventors: Sufleta, Zbigniew, Lee, Hung Chuen Jason, Manchiraju-Venkata, Ramakrishna, Kishore, Tanmay, Xiu, Yan, Nguyen, Hung, Amarittapark, Sitti
• Primary Examiner(s): DAYA, TEJIS A
• Application Number:
  US14/945,347
• Publication Number:
  US 20170141996A1
• Time in Patent Office: 839 Days
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/26 Route discovery packet
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Introduced herein is a technology for a network switch device to route network packets through a inline tool, without introducing additional information to the network packets. The technology records an association between an input network port and a signature (e.g., source MAC address) of the network packet, before forwarding the packet to the inline tool. When receiving the packet back from the inline tool, the network device recognizes that the packet signature is associated with the input network port, and that the input network port is paired with a particular output network port. Thus, the network device identifies the output network port for sending the packet, without modifying contents of the packet.

Claims

1. A method comprising:

receiving, at a first input network port of a network device, a network packet from a source network node and destined for a destination network node, the destination and source network nodes being external to the network device;

recording an association between the first input network port and a signature of the network packet;

routing the network packet, without modifying contents of the network packet, through a first tool port of the network device to an external inline tool, after recording the association;

receiving the network packet from the external inline tool through a second tool port of the network device;

in response to receiving the network packet from the external inline tool, identifying a first output network port as a port through which to send the network packet, based on the association, and based on a pairing relationship between the first input network port and the first output network port that identifies the first output network port of the network device as being paired with the first input network port; and

sending the network packet to the destination network node through the first output network port of the network device.

2. The method of claim 1, wherein the signature of the network packet differentiates the network packet from network packets that are received from sources other than the source network node.

3. The method of claim 1, further comprising:

generating the signature of the network packet based on the contents of the network packet, the signature comprising a media access control (MAC) address of the source network node extracted from the network packet.

4. The method of claim 1, wherein each of a plurality of input network ports of the network device is paired with one of a plurality of output network ports of the network device, and for an individual pair of input and output network ports, the network device routes all network packets received from the input network port of the individual pair to the output network port of the individual pair.

5. The method of claim 1, further comprising:

in response to an exception signal, directly routing a network packet from the first input network port to the first output network port through a bypass relay, such that the network packet does not travel through the external inline tool;

wherein the network device includes a plurality of pairs of input and output network ports, one of the pairs including the first input network port and the first output network port.

6. The method of claim 1, wherein the network device includes a plurality of input network ports and a plurality of output network ports, and the method further comprises:

receiving, at the network device, a configuration instruction for pairing an individual input network port of the input network ports with an individual output network port of the output network ports, such that the network device routes all network packets received from the individual input network port to the individual output network port.

7. The method of claim 1, further comprising:

maintaining a lookup table that includes a plurality of entries, each of the entries recording an association between an input network port of the network device and a signature of a network packet that has been routed to the external inline tool by the network device.

8. The method of claim 1, further comprising:

in response to receiving the network packet from the source network node, adding to a lookup table an entry recording an association between the first input network port and a signature of the network packet; and

in response to a determination that a specified aging criterion is satisfied, removing the entry from the lookup table.

9. The method of claim 1, further comprising:

in response to receiving the network packet form the source network node, adding to a lookup table an entry recording an association between the first input network port and a signature of the network packet, and

setting a reference count of the entry as one if the entry was not already present in the lookup table; and

if the entry was already present in the lookup table, increasing the reference count of the entry by one.

10. The method of claim 9, further comprising:

in response to receiving the network packet form the external inline tool, decreasing the reference count of the entry by one; and

in response to a determination that the reference count of the entry is zero, removing the entry from the lookup table.

11. The method of claim 1, wherein the inline tool comprises an inline network monitoring tool that is part of a network path between the source and destination network nodes and that monitors network packets transmitted from the source network node to the destination network node.

12. A network device comprising:

a plurality of pairs of network ports through which to receive and transmit network packets between network nodes, the network nodes being external to the network device, wherein for each individual pair, the network device routes all network packets received from one network port of the individual pair to another network port of the individual pair;

a plurality of tool ports through which to communicate with an inline tool external to the network device;

a switching fabric coupled to each of the network ports and each of the tool ports;

and

a processing circuit coupled to the network ports and the tool ports, the processing circuit configured to control the network device to;

receive, at a first network port of the network device, a network packet from a source network node and destined for a destination network node;

generate a signature of the network packet based on the contents of the network packet;

add to a data structure an entry indicative of an association between the first network port and the signature of the network packet, before the network packet is routed to the inline tool;

route the network packet, without modifying contents of the network packet, through a first tool port of the network device to the inline tool;

receive the network packet from the inline tool through a second tool port of the network device;

in response to receiving the network packet from the inline tool, generate a signature of the network packet based on the contents of the network packet;

identify the generated signature with the signature of the entry in the data structure;

identify a second network port as being connected to the destination network node based on the association, and based on a fact that the first and second network ports belong to a pair; and

send the network packet to the destination network node through the second network port.

13. The network device of claim 12, wherein the signature of the network packet comprises a media access control (MAC) address of the source network node extracted from a data field of the network packet.

14. The network device of claim 12, further comprising:

a plurality of bypass relays, each of the bypass relays interconnecting a separate pair of the network ports, wherein the bypass relay for an individual pair directly routes network packets from a network port of the individual pair to another network port of the individual pair by bypassing the switching fabric and the inline tool when the switching fabric or the inline tool malfunctions.

15. The network device of claim 12, further comprising:

a configuration interface configured to receive an configuration instruction for pairing a first network port with a second network port, such that the network device routes all network packets received from the first network port to the second network port; and

a port pairing table for recording the pairing relationships between the network ports of the network device.

16. The network device of claim 12, further comprising:

a data structure including a plurality of entries, each of the entries recording an association between a network port of the network device and a signature of a network packet, and a timestamp indicative of when the network device receives the network packet; and

wherein the processing circuit is further configured to;

in response to a determination that a specified aging criterion is satisfied, remove the entry from the data structure.

17. The network device of claim 12, further comprising:

a data structure including a plurality of entries, each of the entries recording an association between a network port of the network device and a signature, and a reference count being indicative of a number of network packets that have the signature and are being routed by the network device to the inline tool; and

wherein the processing circuit is further configured to;

generate a signature of the network packet based on the contents of the network packet;

add to the data structure an entry indicative of an association between the first network port and the signature of the network packet, and set the reference count of the entry as one if the entry does not exist in the data structure; and

if the entry does exist in the data structure, increase the reference count of the entry by one.

18. The network device of claim 17, wherein the processing circuit is further configured to:

in response to receiving the network packet form the inline tool, decrease the reference count of the entry by one; and

in response to a determination that the reference count of the entry is zero, removing the entry from the data structure.

19. A non-transitory machine-readable medium storing machine-executable instructions, execution of which by a processing system causes the processing system to perform operations comprising:

receiving, at a first network port of a network device, a network packet from a source network node and destined for a destination network node, both the destination and source network nodes being external to the network device;

adding an entry in a data structure stored in the network device, the entry recording an association between the first network port and a signature of the network packet, before routing the network packet to an external inline tool;

routing the network packet to the external inline tool without modifying contents of the network packet;

receiving the network packet from the external inline tool;

in response to receiving the network packet from the external inline tool, identifying a second network port of the network device as a port which to send the network packet, based on the association between the first network port and the signature of the network packet and a pairing relationship between the first and second network ports; and

sending the network packet to the destination network node through the identified second network port.

20. The machine-readable medium of claim 19, wherein the signature of the network packet comprises a media access control (MAC) address of the source network node extracted from a field of the network packet.

21. The machine-readable medium of claim 19, wherein the instructions further causes the processing system to perform operations comprising:

setting up a pair of two network ports of the network device, such as the network device routes all network packets received from one network port of the pair to the other network port of the pair.

22. The machine-readable medium of claim 19, wherein the instructions further causes the processing system to perform operations comprising:

recording a timestamp of receiving the network packet in the entry; and

if a time period corresponding to the timestamp exceeds a maximum latency of the external inline tool, removing the entry.

23. The machine machine-readable medium of claim 19, wherein the instructions further causes the processing system to perform operations comprising:

recording a reference count in the entry, the reference count being indicative of a number of network packets that have the signature and are being routed by the network device to the external inline tool;

decreasing the reference count by one, in response to receiving the network packet from the external inline tool; and

removing the entry if the reference count is zero.