CAPTURE AND REGENERATION OF A NETWORK DATA USING A VIRTUAL SOFTWARE SWITCH

• US 20090290501A1
• Filed: 05/25/2009
• Published: 11/26/2009
• Est. Priority Date: 05/23/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Solera Networks, Inc. (Gen Digital Inc.)
• Inventors: Brown, James, Levy, Joseph H., Tveit, Paal, Edginton, Brian, Wood, Matthew Scott, Shillingford, Steve
• Granted Patent: US 8,004,998 B2
• Time in Patent Office: Days
• US Class Current: 370/250
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 49/70 Virtual switches

Abstract

Methods and a system of capture and regeneration of a network data using a virtual software switch are disclosed. In an embodiment, a method includes capturing a network data using a virtual software switch, a processor, and a memory. The network data is captured to perform a network visibility analysis and the network data is communicated to at least one port of the virtual software switch. The method includes forming a stored network data in a memory. The method also includes regenerating the stored network data to form a reconstructed data.

Claims

1. A method, comprising:

capturing a network data using a virtual software switch, a processor, and a memory, wherein the network data is communicated to at least one port of the virtual software switch;

forming a stored network data in a memory;

regenerating the stored network data to form a reconstructed data; and

performing a network visibility analysis using the reconstructed data.

13. The method of claim 2, further comprising:

matching the payload data with an entry of a library of known artifacts; and

determining a type of the payload data based on a match with the entry of the library of known artifacts.

2. The method of claim 1, further comprising:

aggregating a payload data from the network data, wherein the network data is comprised of different packets; and

generating an extracted artifact of a network data using the aggregated payload data.

3. The method of claim 2, further comprising:

communicating the reconstructed data at a variable communication rate.

4. The method of claim 2, further comprising:

communicating the reconstructed data at an upper threshold rate.

5. The method of claim 2, further comprising:

communicating the reconstructed data at an lower threshold rate.

6. The method of claim 2, further comprising:

communicating the reconstructed data at an intermittent rate.

7. The method of claim 3, further comprising:

controlling an ingress location filter of a virtual software switch

8. The method of claim 7, further comprising:

regulating an egress location filter of a virtual software switch to control a flow of network data.

9. The method of claim 7, further comprising:

applying an access control list to at least one of the control of the ingress location filter and the regulation of the egress location filter of the virtual software switch.

10. The method of claim 2, wherein the memory is comprised of a virtual storage device communicatively coupled to the virtual software switch.

11. The method of claim 10, further comprising:

trunking the reconstructed data of the virtual software switch to a remote location.

12. The method of claim 11, wherein the reconstructed data is communicated to at least one of a physical network and a virtual network.

14. The method of claim 2, wherein the extracted artifact is comprised of at least one of a word processing document, a spreadsheet document, a database, an image, a video, a multimedia file, an email, an instant message communication, an audio file, a compressed file, an executable file, a web page, a raw data, a metadata, and a presentation.

15. The method of claim 1, wherein a machine is caused to perform the method of claim 1 when a set of instructions are executed by the machine, wherein the set of instructions is embodied by the method of claim 1 in a form of a machine-readable medium.

16. The system of claim 13, wherein the reconstructed data is formed using a variable communication rate.

17. The system of claim 16, wherein the variable communication rate is comprised of at least one of a real time, an upper rate, a lower rate, and a customizable rate.

18. The system of claim 17, further comprising:

a transfer control module to filter the network data using at least one of an ingress location and an egress location of the virtual software switch.

13-1. A system, comprising:

a virtual software switch to capture a network data using a processor and a memory, wherein the network data is captured to perform a network visibility analysis and the network data is communicated to at least one port of the virtual software switch;

an additional memory to store the network data; and

a regeneration module to form a reconstructed data using the stored network data.

14-2. The system of claim 13, further comprising:

a virtual appliance to aggregate a payload data from the network data, wherein the network data is comprised of different packets; and

an extraction module to form an extracted artifact using the aggregated payload data.

15-3. The system of claim 14, wherein the extracted artifact is comprised of at least one of a word processing document, a spreadsheet document, a database, an image, a video, a multimedia file, an email, an instant message communication, an audio file, a compressed file, an executable file, a web page, a raw data, a metadata, and a presentation.

19. A method, comprising:

capturing a network data using a virtual software switch, a processor, and a memory, wherein the network data is captured to perform a network visibility analysis and the network data is communicated to at least one port of the virtual software switch;

aggregating a payload data from the network data, wherein the network data is comprised of different packets;

generating an extracted artifact using the aggregated payload data, wherein the extracted artifact is comprised of at least one of a word processing document, a spreadsheet document, a database, an image, a video, a multimedia file, an email, an instant message communication, an audio file, a compressed file, an executable file, a web page, a raw data, a metadata, and a presentation;

forming a stored network data in a virtual storage device communicatively coupled to the virtual software switch; and

regenerating the stored network data to form a reconstructed data, wherein the reconstructed data is formed using a variable communication rate comprised of at least one of a real time, an upper rate, a lower rate, and a customizable rate, and wherein the reconstructed data is communicated to at least one of a physical network and a virtual network.

20. The method of claim 19, further comprising:

filtering the network data using at least one of an ingress location and an egress location of the virtual software switch, wherein an access control list is used to control a filter of at least one of the ingress location and the egress location;

matching the payload data with an entry of a library of known artifacts;

determining a type of the payload data based on a match with the entry of the library of known artifacts; and

communicating the network data between the virtual software switch and a remote port using a network trunk.