Measuring performance of a network using mirrored probe packets

• US 9,954,751 B2
• Filed: 05/29/2015
• Issued: 04/24/2018
• Est. Priority Date: 05/29/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Zhang, Ming, Lu, Guohan, Yuan, Lihua, Zhu, Yibo
• Primary Examiner(s): Mirza, Adnan
• Application Number:
  US14/726,245
• Publication Number:
  US 20160352601A1
• Time in Patent Office: 1,061 Days
• Field of Search: 709225
• CPC Class Codes: H04L 41/0645 by additionally acting on or stimulating the network after receiving notifications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408

Abstract

Functionality is described herein for measuring the performance of a network. The functionality operates by generating a probe packet and injecting the probe packet into the network. The probe packet is configured, using one or more layers of encapsulation, to target a particular network component of interest in the network, or to target a particular collection of network components in the network. A switch to which the probe packet is addressed operates by: (a) generating mirrored information that is associated with the probe packet; (b) decapsulating the probe packet (with respect to its outermost encapsulation) to produce a new probe packet; and (c) passing the new probe packet to a downstream network component, in accordance with a destination address associated with the new probe packet. The functionality uses the mirrored information that has been collected in the above manner to detect various anomalies in the network.

Claims

1. A method for measuring performance of a network, the method comprising:

providing an innermost probe packet, the innermost probe packet having an innermost destination address;

generating a first probe packet, the first probe packet including;

a first destination address that identifies a first network component in the network; and

the innermost probe packet, which is encapsulated in the first probe packet through at least one layer of encapsulation;

sending the first probe packet to the first network component of the network based at least on the first destination address associated with the first probe packet;

at the first network component, generating first mirrored information, the first mirrored information comprising a copy of at least some content of the first probe packet;

providing the first mirrored information to a collection and analysis (CA) system;

decapsulating the first probe packet to produce a second probe packet, the second probe packet including a second destination address; and

sending the second probe packet to a second network component that is associated with the second destination address.

2. The method of claim 1, further comprising:

at the CA system, collecting one or more instances of mirrored information produced by one or more respective network components in the network, in response to injection of one or more probe packets into the network, the one or more probe packets including the first probe packet; and

providing information regarding a network-related behavior based on said one or more instances of mirrored information.

3. The method of claim 2, wherein the network-related behavior corresponds to packet loss that has occurred at least one network component within the network.

4. The method of claim 2, wherein the network-related behavior corresponds to roundtrip latency associated with at least one link within the network.

5. The method of claim 2, wherein the network-related behavior corresponds to looping behavior, in which an individual probe packet is routed through the same network component more than once.

6. The method of claim 2, wherein the network-related behavior corresponds to an imbalance in packet distribution by a load balancing mechanism.

7. The method of claim 1,

wherein the second probe packet corresponds to the innermost probe packet, and, as such, the second destination address corresponds to the innermost destination address, and

the method further comprises sending the innermost probe packet to the second network component via one or more additional network components.

8. The method of claim 7, further comprising:

using the first probe packet to investigate the first network component or the second network component for occurrence of packet loss.

9. The method of claim 1, further comprising, at the second network component:

generating second mirrored information, the second mirrored information comprising a copy of at least some content of the second probe packet;

providing the second mirrored information to the CA system;

decapsulating the second probe packet to produce a third probe packet, the third probe packet including a third destination address that identifies a third network component; and

sending the third probe packet to the third network component, based at least on the third destination address.

10. The method of claim 9,

wherein the third probe packet corresponds to the innermost probe packet, and, as such, the third destination address corresponds to the innermost destination address, and

wherein the third network component corresponds to the first network component.

11. The method of claim 10, further comprising, at the first network component and upon receiving the third probe packet:

generates third mirrored information, the third mirrored information providing a copy of at least some content of the third probe packet; and

provides the third mirrored information to the CA system.

12. The method of claim 11,

wherein a link couples the first network component to the second network component,

wherein a first instance of time information identifies a time of receipt, by the CA system, of the first mirrored information,

wherein another instance of time information identifies a time of receipt, by the CA system, of the third mirrored information, and

the method further comprising generating a roundtrip latency measure associated with the link based at least on the first instance of time information and the another instance of time information.

13. The method of claim 1, further comprising:

triggering the first network component to perform decapsulation upon receiving the first probe packet via a specified address; and

triggering the first network component to perform mirroring upon detecting status information in the first probe packet that indicates that mirroring is to be performed.

14. The method of claim 1, further comprising:

collecting preliminary-phase instances of mirrored information in a preliminary phase of measurement,

wherein the first probe packet targets a particular part of the network that has generated anomalous behavior, as reflected in the preliminary-phase instances of mirrored information.

21. The method of claim 1, further comprising:

at the first network component, sending the first mirrored information to the CA system in a mirrored packet that is separate from the first probe packet and that includes the copy of the at least some content of the first probe packet.

15. One or more computing devices comprising:

logic configured to produce a first probe packet that includes;

a first destination address that identifies a first network component in a network;

an innermost probe packet directly or indirectly encapsulated in the first probe packet, the innermost probe packet specifying an innermost destination address; and

status information to indicate that the first probe packet is to be mirrored by the first network component by copying at least some information from the first probe packet into a mirrored packet; and

logic configured to send the first probe packet to the first network component of the network.

16. The one or more computing devices of claim 15, wherein the first probe packet includes a second probe packet encapsulated in the first probe packet, the second probe packet including:

a second destination address that identifies a second network component in the network; and

the innermost probe packet encapsulated in the second probe packet.

17. The one or more computing devices of claim 16, wherein the first probe packet encapsulates a set of probe packets having respective destination addresses that, when followed, specifies a path in which at least one network component is encountered twice.

18. A hardware switch comprising:

a receiving component configured to receive a packet, the received packet having a destination address that identifies the hardware switch

logic configured to determine whether the received packet is a probe packet;

a mirroring component configured to;

when the received packet is determined to be a probe packet;

generate mirrored information comprising a copy of at least some content of the probe packet; and

provide the mirrored information to a collection and analysis (CA) system;

a decapsulation component configured to decapsulate the probe packet to produce another packet, which is encapsulated in the probe packet, and which specifies another destination address; and

a sending component configured to send the another packet to the another destination address.

19. The hardware switch of claim 18, wherein the another packet that is produced encapsulates yet another packet.

20. The hardware switch of claim 18, wherein the probe packet encapsulates a set of probe packets having respective destination addresses that, when followed, specifies a path in which at least one network component is encountered twice.