US 10,652,112 B2Granted

Network traffic pre-classification within VM platforms in virtual processing environments

AssigneeKeysight Technologies Singapore (Sales) Pte. Ltd.

InventorKristopher Raney

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods and systems are disclosed that pre-classify network traffic monitored within virtual machine (VM) platforms. Client packet monitor applications operate within client VM platforms to monitor network packets, generate monitored packets representing traffic of interest, determine packet classifications for the monitored packets based upon packet contents, identify tags associated with the packet classifications, encapsulate monitored packets with encapsulation headers including the tags to form encapsulated packets, and forward the encapsulated packets to tool VM platforms. Tool packet monitor applications operate within the tool VM platforms to receive the encapsulated packets, identify packet classifications associated with the tags, remove the encapsulation headers from the encapsulated packets, and forward de-encapsulated packets to network destinations based upon the packet classifications. The tool packet monitor applications can also aggregate de-encapsulated packets having the same packet classification prior to forwarding the aggregated packets to one or more network destinations.

Claims26

Dependent claims

A method to monitor packet traffic, comprising:

communicating network packets using one or more client applications operating within a client virtual machine (VM) platform operating within a first VM host server;
operating a client packet monitor application within the client VM platform;
operating a tool packet monitor application within a tool VM platform operating within a second VM host server;
at the client packet monitor application:
receiving mapping data from a traffic configuration platform;
storing the mapping data as classification-to-tag mapping data;
monitoring the network packets to generate monitored packets representing traffic of interest;
determining packet classifications for the monitored packets based upon contents of the monitored packets;
identifying tags associated with the packet classifications by searching the classification-to-tag mapping data to identify the tags associated with the packet classifications;
encapsulating the monitored packets with encapsulation headers to form encapsulated packets, the encapsulation headers including the tags and delivery headers separate from the tags, and the delivery headers including a destination address for the tool packet monitor application;
and
forwarding the encapsulated packets to the tool VM platform based upon the delivery headers and not based upon the tags associated with the packet classifications;
and
at the tool packet monitor application:
receiving mapping data from the traffic configuration platform;
storing the mapping data as tag-to-classification mapping data;
receiving the encapsulated packets;
identifying packet classifications associated with the tags included within the encapsulated packets by searching the tag-to-classification mapping data to identify the tags associated with the packet classifications;
removing the encapsulation headers from the encapsulated packets to generate de-encapsulated packets;
and
forwarding the de-encapsulated packets to one or more network destinations based upon the packet classifications.

18 more elements

A system to monitor packet traffic, comprising:

a first virtual machine (VM) host server configured to host one or more client applications operating within a client virtual machine (VM) platform, the one or more client applications being configured to generate network packets;
and
a second VM host server configured to host a tool VM platform;
wherein the first VM host server is further configured to host a client packet monitor application, the client packet monitor application being configured to:
receive mapping data from a traffic configuration platform;
store the mapping data as classification-to-tag mapping data
monitor the network packets to generate monitored packets representing traffic of interest;
determine packet classifications for the monitored packets based upon contents of the monitored packets;
identify tags associated with the packet classifications by searching the classification-to-tag mapping data to identify the tags associated with the packet classifications;
encapsulate the monitored packets with encapsulation headers including the tags to form encapsulated packets, the encapsulation headers also including delivery headers separate from the tags, and the delivery headers including a destination address for the tool packet monitor application;
and
forward the encapsulated packets to the tool VM platform based upon the delivery headers and not based upon the tags associated with the packet classifications;
and
wherein the second VM host server is further configured to host a tool packet monitor application configured to:
receive mapping data from the traffic configuration platform;
store the mapping data as the tag-to-classification mapping data;
receive the encapsulated packets;
identify packet classifications associated with the tags included within the encapsulated packets by searching the tag-to-classification mapping data to identify the tags associated with the packet classifications;
remove the encapsulation headers from the encapsulated packets to generate de-encapsulated packets;
and
forward the de-encapsulated packets to one or more network destinations based upon the packet classifications.

18 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/342,170Filed 3 Nov 2016 · continuation in part
Priority: 2 Oct 2015
Published: US 2017/0099195 A16 Apr 2017
Granted: 12 May 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 43/028
Capturing of monitoring data: by filtering
H04L 12/4633
Interconnection of networks: interconnection of networks using encapsulation techniques, e.g. tunneling
H04L 69/22
Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass:…
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL

Family

Application14/873,896Parent of this continuation-in-part · filed 2 Oct 2015
US 2017/0099197 A1Pre-grant publication · published 6 Apr 2017
US 10,116,528 B2Parent of this continuation-in-part
US 2017/0099195 A1Published application
US 10,652,112 B2This patent

From the US filing history. Foreign family members aren’t listed.