Duplicating network traffic through transparent VLAN flooding

• US 9,479,415 B2
• Filed: 02/12/2016
• Issued: 10/25/2016
• Est. Priority Date: 07/11/2007
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Foundry Networks LLC (Broadcom, Inc.)
• Inventors: Natarajan, Hari, Sahle, Eskinder, Helfinstine, Charles, Oskuie, Chris
• Primary Examiner(s): O'Connor, Brian
• Application Number:
  US15/043,421
• Publication Number:
  US 20160164768A1
• Time in Patent Office: 256 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4645 Details on frame tagging routing of packets H04L45/00; support for virtual LAN H04L49/354
• CPC Class Codes: H04L 12/465 wherein a single frame includes a plurality of VLAN tags
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 45/32 Flooding denial of service attacks H04L63/1458
• CPC Class Codes: H04L 49/10 characterised by the switching fabric construction
• CPC Class Codes: H04L 49/111 Switch interfaces, e.g. port details
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]

Abstract

Provided are methods, non-transitory computer-readable medium, and network devices for duplicating network traffic through transparent VLAN flooding. In some implementations, a network device comprises a plurality of ports. The plurality of ports may include a first port configured as a receiving port for a VLAN configured for the network device. The plurality of ports may further include a set of ports configured as I/O ports of the VLAN. MAC learning may be disabled for the receiving port. In some implementations, the network device is configured to determine, based on contents of a packet received at the receiving port, that the packet is to be sent to one or more monitoring devices. The network device may further be configure to, upon receiving the packet at the receiving port of the VLAN, cause a copy of the packet to be sent to each of one or more I/O ports of the VLAN.

Claims

1. A method comprising:

determining, based on contents of a packet received at a network device, that the received packet is to be sent to one or more monitoring devices, wherein the network device includes a virtual local area network (VLAN), the VLAN including a receiving port and a plurality of I/O ports, the receiving port and the plurality of I/O ports of the VLAN corresponding to ports of the network device, wherein Media Access Control (MAC) learning has been disabled for the receiving port, and wherein the packet is received at the receiving port of the VLAN; and

upon receiving the packet at the receiving port of the VLAN, causing a copy of the packet to be sent to each of one or more of the plurality of I/O ports of the VLAN.

2. The method of claim 1, wherein the packet is a duplicate packet received from an in-line tap.

3. The method of claim 1, wherein the packet is received from a network traffic source.

4. The method of claim 1, wherein determining that the packet is to be monitored includes determining that information included in the packet matches a defined parameter.

5. The method of claim 1, wherein causing a copy of the packet to be sent to each of one or more of the plurality of I/O ports includes selecting one or more ports from the plurality of I/O ports, wherein the one or more selected ports are determined using an access control list.

6. The method of claim 1, wherein each of the plurality of I/O ports is configured to connect to a corresponding monitoring device.

7. The method of claim 1, wherein causing a copy of the packet to be sent to each of one or more of the plurality of I/O ports includes causing a copy of the packet to be sent to each of the plurality of I/O ports.

8. A non-transitory computer-readable medium storing a plurality of instructions executable by one or more processors of a network device, the network device including a virtual local area network (VLAN), the VLAN including a receiving port and a plurality of I/O ports, the receiving port and the plurality of I/O ports of the VLAN corresponding to ports of the network device, wherein Media Access Control (MAC) learning has been disabled for the receiving port;

and

wherein the plurality of instructions comprise;

instructions for causing at least one processor from the one or more processors to determine, based on contents of a packet received at the receiving port of the VLAN, that the packet is to be sent to one or more monitoring devices; and

upon receiving the packet at the receiving port of the VLAN;

instructions for causing at least one processor from the one or more processors to cause a copy of the packet to be sent to each of one or more of the plurality of I/O ports of the VLAN.

9. The non-transitory computer-readable medium of claim 8, wherein the packet is a duplicate packet received from an in-line tap.

10. The non-transitory computer-readable medium of claim 8, wherein the packet is received from a network traffic source.

11. The non-transitory computer-readable medium of claim 8, wherein the instructions for causing at least one processor from the one or more processors to cause a copy of the packet to be sent to each of one or more of the plurality of I/O ports includes instructions for causing at least one processor from the one or more processors to select one or more ports from the plurality of I/O ports, wherein the one or more selected ports are determined using an access control list.

12. The non-transitory computer-readable medium of claim 8, wherein each of the plurality of I/O ports is configured to connect to a monitoring device.

13. The non-transitory computer-readable medium of claim 8, wherein the instructions for causing at least one processor from the one or more processors to cause a copy of the packet to be sent to one or more of the plurality of I/O ports includes instructions for causing at least one processor from the one or more processors to send a copy to each of the plurality of I/O ports.

14. A network device, comprising:

a plurality of ports, comprising a first port configured as a receiving port for a VLAN configured for the network device, the plurality of ports further comprising a set of ports configured as I/O ports of the VLAN, wherein Media Access Control (MAC) learning has been disabled for the receiving port;

wherein the network device is configured to;

determine, based on contents of a packet received at the receiving port of the VLAN, that the packet is to be sent to one or more monitoring devices; and

upon receiving the packet at the receiving port of the VLAN, cause a copy of the packet to be sent to each of one or more of the I/O ports of the VLAN.

15. The network device of claim 14, wherein the packet is a duplicate packet received from an in-line tap.

16. The network device of claim 14, wherein the packet is received from a network traffic source.

17. The network device of claim 14, wherein the network device is configured to determine that the packet is to be sent to one or more monitoring devices by determining that information included in the packet matches a defined parameter.

18. The network device of claim 14, wherein the network device is further configured to cause a copy of the packet to be sent to each of one or more of the plurality of I/O ports includes selecting one or more ports from the plurality of I/O ports, wherein the one or more I/O ports are determined using an access control list.

19. The network device of claim 14, wherein each of the plurality of I/O ports is configured to connect to a corresponding monitoring device.

20. The network device of claim 14, wherein the network device is configured to cause a copy of the packet to be sent to each of the plurality of I/O ports.