Techniques for exchanging control and configuration information in a network visibility system

A non-transitory computer readable storage medium having stored thereon program code executable by a network visibility system comprising a data plane component and a control plane component, the program code causing the network visibility system to:

• receive, by the control plane component, one or more first messages from the data plane component of the network visibility system, the one or more first messages comprising information identifying one or more service instances of the data plane component and information identifying one or more egress ports available on the data plane component, wherein the data plane component of the network visibility system is configured to intercept traffic on one or more networks to be monitored and to forward the intercepted traffic to one or more analytic servers;
• retrieve, by the control plane component, configuration information stored on the control plane component, the configuration information comprising one or more network prefixes of one or more networks to be monitored by the network visibility system;
• determine, by the control plane component, one or more mappings that map the one or more network prefixes to the one or more egress ports and the one or more service instances, wherein determining the one or more mappings comprises using a round-robin matching of the one or more network prefixes to the one or more egress ports and the one or more service instances, each mapping in the one or more mappings identifying a network prefix, a service instance of the data plane component, and an egress port of the data plane component;
• generate, by the control plane component, one or more packet forwarding rules to be programmed on the data plane component based on the one or more mappings, wherein the one or more packet forwarding rules comprise, for at least one mapping of the one or more mappings, at least one packet forwarding rule for forwarding ingress packets destined for an IP address covered by the network prefix in the at least one mapping to the egress port identified in the at least one mapping;
• transmit, by the control plane component to the data plane component, one or more second messages including the one or more packet forwarding rules, to program the data plane component;
• generate, at the data plane component and using a whitelist access control list, a whitelist table to filter out part of the intercepted traffic such that the filtered out part of the intercepted traffic is dropped and is not forwarded to the one or more analytic servers;
• determine, by the data plane component and using the whitelist table, a list of one or more packets to be dropped and not to be forwarded to the one or more analytic servers;
• and
• forward, by the data plane component, ingress packets, which are not in the list of one or more packets and are destined for an address covered by the one or more network prefixes in the one or more mappings, to the one or more egress ports identified in the one or more mappings.

A computer system comprising:

• one or more processors;
• and
• a non-transitory computer readable medium having stored thereon program code that, when executed by the one or more processor, causes the processor to:
• receive one or more first messages from a data plane component of a network visibility system, the one or more first messages comprising information identifying one or more service instances of the data plane component and information identifying one or more egress ports available on the data plane component, wherein the data plane component of the network visibility system is configured to intercept traffic on one or more networks to be monitored and to forward the intercepted traffic to one or more analytic servers;
• retrieve configuration information stored on the computer system, the configuration information comprising one or more network prefixes of one or more networks to be monitored by the network visibility system;
• determine one or more mappings that map the one or more network prefixes to the one or more egress ports and the one or more service instances, wherein to determine the one or more mappings the program code, when executed by the processor, causes the processor to use a round-robin matching of the one or more network prefixes to the one or more egress ports and the one or more service instances, each mapping in the one or more mappings identifying a network prefix, a service instance of the data plane component, and an egress port of the data plane component;
• generate one or more packet forwarding rules to be programmed on the data plane component based on the one or more mappings, wherein the one or more packet forwarding rules include, for at least one mapping of the one or more mappings, at least one packet forwarding rule for forwarding ingress packets destined for an IP address covered by the network prefix in the at least one mapping to the egress port identified in the at least one mapping;
• transmit, to the data plane component, one or more second messages including the one or more packet forwarding rules, to program the data plane component;
• generate, using a whitelist access control list, a whitelist table to filter out part of the intercepted traffic such that the filtered out part of the intercepted traffic is dropped and is not forwarded to the one or more analytic servers;
• determine, using the whitelist table, a list of one or more packets to be dropped and not to be forwarded to the one or more analytic servers;
• and
• forward ingress packets, which are not in the list of one or more packets and are destined for an address covered by the one or more network prefixes in the one or more mappings, to the one or more egress ports identified in the one or more mappings.