Automatic target selection

• US 10,057,143 B2
• Filed: 05/24/2017
• Issued: 08/21/2018
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Gigamon Incorporated (Elliott Capital Advisors LP)
• Original Assignee: Gigamon Incorporated (Elliott Capital Advisors LP)
• Inventors: Rao, Anil
• Primary Examiner(s): Faroul, Farah
• Application Number:
  US15/604,564
• Publication Number:
  US 20170257288A1
• Time in Patent Office: 454 Days
• Field of Search: None
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of identifying targets for monitoring includes: obtaining a user-defined filter map, the user-defined filter map having one or more filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic; and determining a set of one or more targets by a processing unit based at least in part on the user-defined filter map, wherein the processing unit comprises a target selection module configured to access a list of available targets from a database, and select the one or more targets from the list of available targets based at least in part on the user-defined filter map.

Claims

1. A method comprising:

obtaining, by a processing device, a user-defined filter map, the user-defined filter map including a plurality of filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic on a network that includes a plurality of targets;

determining, by the processing device, a subset of the plurality of targets on the network, wherein the subset is to be monitored by the network system based on the user-defined filter map, wherein said determining includes identifying, by the processing device, the targets of the plurality of targets whose ingress/egress traffic can potentially result in a match with the filter rules; and

selecting, for monitoring by the network system, the targets identified in said identifying, and excluding from monitoring by the network system each of the plurality of targets that was not identified in said identifying.

2. The method of claim 1, wherein the filter rules include information regarding one or more of a switch port, a MAC address, a VLAN identifier, an ethertype, an IP address, or a wildcard.

3. The method of claim 1, wherein the plurality of targets include a virtual machine (VM).

4. The method of claim 1, comprising:

obtaining an exclusion set that contains targets to be excluded from monitoring by the network system.

5. The method of claim 4, wherein determining the subset of the plurality of targets includes excluding the targets contained in the exclusion set.

6. The method of claim 4, comprising:

obtaining an inclusion set that contains targets to be monitored by the network system;

determining that the exclusion set and the inclusion set are not compatible with the user-defined filter map; and

generating a warning flag.

7. The method of claim 1, comprising:

obtaining an inclusion set that contains targets to be monitored by the network system.

8. The method of claim 7, wherein determining the subset of the plurality of targets includes including the targets contained in the inclusion set.

9. The method of claim 1, wherein determining the subset of the plurality of targets includes identifying an intersection of plurality of the filter rules.

10. The method of claim 1, wherein the user-defined filter map includes user-defined rules having associated actions, the associated actions including one or more of packet manipulation, packet forwarding, or packet dropping;

and the method further comprising identifying that the identified targets match the network traffic and performing the actions associated with the user-defined rules.

11. The method of claim 1, wherein the plurality of targets include a virtual Network Interface Card (vNIC).

12. An apparatus comprising:

a non-transitory medium storing a user-defined filter map, the user-defined filter map including a plurality of filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic on a network that includes a plurality of targets;

a processing device configured to determine a subset of the plurality of targets on the network, wherein the subset is to be monitored by the network system, based on the user-defined filter map, wherein determining the subset includes identifying the plurality of targets whose ingress/egress traffic can potentially result in a match with the filter rules; and

the processing device further configured to select, for monitoring by the network system, the targets identified in said identifying, and exclude from monitoring by the network system each of the plurality of targets that was not identified in said identifying.

13. The apparatus of claim 12, wherein the filter rules include information regarding one or more of a switch port, a MAC address, a VLAN identifier, an ethertype, an IP address, or a wildcard.

14. The apparatus of claim 12, wherein the plurality of targets include a virtual machine (VM).

15. The apparatus of claim 12, wherein the processing device is configured to obtain an exclusion set that contains targets to be excluded from monitoring by the network system.

16. The apparatus of claim 15, wherein determining the subset of the plurality of targets includes excluding the targets contained in the exclusion set.

17. The apparatus of claim 15, wherein the processing device is configured to execute instructions to perform operations comprising:

obtaining an inclusion set that contains targets to be monitored by the network system;

determining that the exclusion set and the inclusion set are not compatible with the user-defined filter map; and

generating a warning flag.

18. The apparatus of claim 12, wherein the processing device is configured to obtain an inclusion set that contains targets to be monitored by the network system.

19. The apparatus of claim 18, wherein determining the subset of the plurality of targets includes including the targets contained in the inclusion set.

20. The apparatus of claim 12, wherein determining the subset of the plurality of targets includes identifying an intersection of the plurality of filter rules.

21. The apparatus of claim 12, wherein the user-defined filter map includes user-defined rules having associated actions, the associated actions including one or more of packet manipulation, packet forwarding, and packet dropping;

and the processing device further configured to identify that the identified targets match the network traffic and performing the actions associated with the user-defined rules.

22. The apparatus of claim 12, wherein the plurality of targets include a virtual Network Interface Card (vNIC).

23. A system comprising:

a network interface;

one or more processors; and

a memory storing instructions, execution of which by the one or more processors causes the system to;

receive a user-defined filter map via the network interface, the user-defined filter map including a plurality of filter rules for matching against network traffic when the user-defined filter map is used by a software defined network (SDN) to process the network traffic on a network that includes a plurality of targets;

determine a subset of the plurality of targets on the network, wherein the subset is to be monitored by the SDN, based on the user-defined filter map, wherein determining the subset includes identifying the plurality of targets whose ingress/egress traffic can potentially result in a match with the filter rules; and

select, for monitoring by the SDN, the targets identified in said identifying, and exclude from monitoring by the network system each of the plurality of targets that was not identified in said identifying.

24. The system of claim 23, wherein execution of the instructions by the one or more processors further causes the system to:

obtain an exclusion set that contains targets to be excluded from monitoring by the SDN; and

determine the subset of the plurality of target, wherein the subset excludes the targets contained in the exclusion set.

25. The system of claim 23, wherein execution of the instructions by the one or more processors further causes the system to:

obtain an inclusion set that contains targets to be monitored by the SDN; and

determine the subset of the plurality of targets, wherein the subset includes the targets contained in the inclusion set.

26. The system of claim 23, wherein execution of the instructions by the one or more processors further causes the system to:

obtain an exclusion set that contains targets to be excluded from monitoring by the SDN;

obtain an inclusion set that contains targets to be monitored by the SDN;

determine that the exclusion set and the inclusion set are not compatible with the user-defined filter map; and

generate a warning flag.

27. The system of claim 23, wherein the user-defined filter map includes user-defined rules having associated actions, the associated actions including one or more of packet manipulation, packet forwarding, and packet dropping;

and the processing device further configured to identify that the identified targets match the network traffic and performing the actions associated with the user-defined rules.