Dynamic monitoring of network traffic

• US 8,619,614 B2
• Filed: 01/18/2012
• Issued: 12/31/2013
• Est. Priority Date: 02/04/2009
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Narayanaswamy, Krishna, Varadhan, Kannan
• Primary Examiner(s): Elpenord, Candal
• Application Number:
  US13/352,790
• Publication Number:
  US 20120113857A1
• Time in Patent Office: 713 Days
• Field of Search: 370/252, 370/254, 370/255, 370/389, 370/390, 370/392, 370/395.31, 370/395.32, 370/401, 370/412, 370428-429, 709/203, 709/224, 709/246
• US Class Current: 370/252
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

A device, connected to a monitoring appliance, may include a traffic analyzer to receive a data unit and identify a traffic flow associated with the data unit. The device may also include a traffic processor to receive the data unit and information regarding the identified traffic flow from the traffic analyzer, determine that the identified traffic flow is to be monitored by the monitoring appliance, change a port number, associated with the data unit, to a particular port number to create a modified data unit when the identified traffic flow is to be monitored by the monitoring appliance, and send the modified data unit to the monitoring appliance.

Claims

1. A device comprising:

one or more processors to;

determine that a traffic flow associated with received data is not identified,

store, based on the traffic flow not being identified, a copy of the data,

transmit the data from a first port of the device,

receive other data based on the transmitting of the data from the device,

identify the traffic flow associated with the data based on the other data,

determine that the identified traffic flow comprises a particular type of traffic flow to be monitored,

mirror the data, to form mirrored data, based on the identified traffic flow comprising the particular type of traffic flow,

modify the mirrored data to cause the mirrored data to be associated with a second port of the device,

the second port being different from the first port, and

transmit, via the second port, the mirrored data to a monitoring appliance that is configured to monitor the particular type of traffic flow.

2. The device of claim 1, where, when determining that the traffic flow is not identified, the one or more processors are to:

compare information included in the received data to one or more signatures of traffic flows stored in a memory associated with the device, and

determine that the traffic flow is not identified based on comparing the information included in the received data to the one or more signatures of traffic flows.

3. The device of claim 1, where, when determining that the traffic flow is not identified, the one or more processors are to:

perform a pattern matching algorithm on the data to identify a pattern,

determine that the identified pattern does not correspond to a signature of a traffic flow,

the signature of the traffic flow being stored in a memory associated with the device, and

determine that the traffic flow is not identified based on the identified pattern not corresponding to the signature of the traffic flow.

4. The device of claim 3, where the pattern matching algorithm comprises one of:

a deterministic finite automaton (DFA) algorithm,

a perl compatible regular expression (PCRE) algorithm, or

a regular expression algorithm.

5. The device of claim 1, where the one or more processors are further to:

identify the data as being associated with the particular traffic flow when the traffic flow is not determined, and

where, when identifying the traffic flow associated with the data based on the other data, the one or more processors are to;

confirm the identification of the data with the particular traffic flow based on the other data.

6. The device of claim 1, where, when modifying the mirrored data, the one or more processors are to:

determine that the data is associated with the monitoring appliance,

modify the mirrored data to cause the mirrored data to be associated with the second port based on the data being associated with the monitoring appliance.

7. The device of claim 1, where, when identifying the traffic flow associated with the data based on the other data, the one or more processor are to:

identify at least one of a pattern, an expression, or a string based on information included in the other data, and

determine that the identified at least one of the pattern, the expression, or the string corresponds to a signature of the traffic flow associated with the data.

8. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions which, when executed by at least one processor, cause the at least one processor to determine that a traffic flow associated with received data is not identified;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to store, based on the traffic flow not being identified, a copy of the data;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to transmit, via a first port, the data to a destination;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to receive other data after transmitting the data to the destination;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to determine that the other data is associated with a particular type of traffic flow;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to mirror the data, to form mirrored data, based on the other data being associated with the particular type of traffic flow;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to modify the mirrored data to cause the mirrored data to be associated with a second port of the device,

the second port being different from the first port; and

one or more instructions which, when executed by the at least one processor, cause the at least one processor to transmit the mirrored data to a monitoring appliance that is configured to monitor the particular type of traffic flow.

9. The non-transitory computer-readable medium of claim 8, where the instructions further comprise:

one or more instructions which, when executed by the at least one processor, cause the at least one processor to store information associated with a plurality of types of traffic flows,

the plurality of types of traffic flows including the particular type of traffic flow; and

where the one or more instructions to determine that the traffic flow is not identified include;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to determine that information included in the data does not match information associated with one of the plurality of types of traffic flows, and

one or more instructions which, when executed by the at least one processor, cause the at least one processor to determine that the traffic flow is not identified based on determining that the information included in the data does not match the information associated with the one of the plurality of types of traffic flows.

10. The non-transitory computer-readable medium of claim 8, where the one or more instructions to determine that the traffic flow is not identified include:

one or more instructions which, when executed by the at least one processor, cause the at least one processor to apply an algorithm to the data to identify one or more of a pattern, a particular string of data, or a particular expression, and

one or more instructions which, when executed by the at least one processor, cause the at least one processor to determine that the identified one or more of the pattern, the particular string of data, or the particular expression does not match information associated with a monitored type of traffic flow.

11. The non-transitory computer-readable medium of claim 10, where the algorithm comprises one of:

a deterministic finite automaton (DFA) algorithm,

a perl compatible regular expression (PCRE) algorithm, or

a regular expression algorithm.

12. The non-transitory computer-readable medium of claim 8, where the instructions further comprise:

one or more instructions which, when executed by the at least one processor, cause the at least one processor to identify the data as being associated with the particular type of traffic flow based on the traffic flow not being identified; and

one or more instructions which, when executed by the at least one processor, cause the at least one processor to confirm the identification of the type of traffic flow based on the other data being associated with the particular type of traffic flow.

13. The non-transitory computer-readable medium of claim 8, further comprising:

one or more instructions which, when executed by the at least one processor, cause the at least one processor to determine that the data is associated with the first port,

where the particular type of traffic flow is associated with the second port; and

where the one or more instructions to modify the mirrored data include;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to modify the mirrored data to cause the mirrored data to be associated with the second port based on the particular type of traffic flow being associated with the second port.

14. The non-transitory computer-readable medium of claim 8, where the instructions further comprise:

one or more instructions which, when executed by the at least one processor, cause the at least one processor to determine whether one or more monitoring appliances, of a plurality of monitoring appliances, are configured to monitor the particular type of traffic flow,

where the plurality of monitoring appliances includes the monitoring appliance; and

where the one or more instructions to form the mirrored data include;

one or more instructions which, when executed by the at least one processor, cause the at least one processor to form the mirrored data when the one or more monitoring appliances are configured to monitor the particular type of traffic flow.

15. A method comprising:

receiving, by a network device, first data;

determining, by the network device, that a traffic flow, associated with the first data, is not identified;

storing, by the network device, a copy of the first data based on determining that the traffic flow is not identified;

transmitting, by the network device and via a first port, the first data from the network device;

receiving, by the network device, second data after transmitting the first data;

identifying, by the network device, the traffic flow associated with the first data based on a traffic flow associated with the second data;

determining, by the network device, that the traffic flow associated with the second data is to be monitored;

modifying, by the network device, the copy of the first data to cause the copy of the first data to be associated with a second different port; and

transmitting, by the network device, the modified copy of the first data to a monitoring appliance based on determining that the traffic flow associated with the second data is to be monitored.

16. The method of claim 15, where said determining that the traffic flow associated with the first data is not identified includes:

determining that information included in a header of the first data does not match a signature of a traffic flow stored in a memory of the network device.

17. The method of claim 15, where said determining that the traffic flow associated with the first data is not identified includes:

performing a pattern matching algorithm on the first data to identify a pattern, and

determining that the identified pattern does not correspond to a signature of a traffic flow,

the signature of the traffic flow being stored in a memory of the network device.

18. The method of claim 17, where the pattern matching algorithm comprises one of:

a deterministic finite automaton (DFA) algorithm,

a perl compatible regular expression (PCRE) algorithm, or

a regular expression algorithm.

19. The method of claim 15, further comprising:

initially identifying the traffic flow associated with the first data as comprising a traffic flow to be monitored based on determining that the traffic flow associated with the first data is not identified; and

confirming that the traffic flow comprises the traffic flow to be monitored based on the other data being associated with the particular type of traffic flow.

20. The method of claim 15, where the monitoring appliance is configured to monitor the second different port, the method further comprising:

determining that the first data is associated with the first port; and

where said modifying the copy of the first data includes;

modifying the copy of the first data to cause the copy of the first data to be associated with the second different port based on the monitoring appliance being configured to monitor the second different port.