Elastic modification of application instances in a network visibility infrastructure

A computer-implemented method comprising:

• receiving virtualized traffic indicative of data packets handled by a virtual machine;
• determining that the virtualized traffic exceeds a capacity limitation of a first instance of an application,
• wherein the first instance of the application is executed in a first node of a visibility fabric;
• creating, in real time responsive to a result of said determining, a second instance of the application on a second node in the visibility fabric;
• separating the virtualized traffic into a first group of data packets and a second group of data packets by
• generating a hash value for each data packet included in the virtualized traffic, to produce a plurality of hash values,
• accessing a data structure that maps the plurality of hash values amongs a plurality of instances of the application,
• wherein each hash value is mapped to a separate instance of the application, and
• wherein each instance of the application executes in a different node of the visibility fabric,
• determining that each data packet in the first group of data packets corresponds to an entry in the data structure that specifies the first instance of the application, and
• determining that each data packet in the second group of data packets corresponds to an entry in the data structure that specifies the second instance of the application;
• forwarding the first group of data packets to the first instance of the application for processing;
• and
• forwarding the second group of data packets to the second instance of the application for processing.

A computer-implemented method comprising:

• receiving virtualized traffic indicative of data packets handled by a virtual machine;
• determining that the virtualized traffic exceeds a capacity limitation of a first instance of an application,
• wherein the first instance of the application is executed in a first node of a visibility fabric;
• creating, in real time responsive to a result of said determining, a second instance of the application on a second node in the visibility fabric;
• separating the virtualized traffic into a first group of data packets and a second group of data packets;
• forwarding the first group of data packets to the first instance of the application for processing;
• forwarding the second group of data packets to the second instance of the application for processing;
• forming a filtered stream of data packets by combining at least a portion of the first group of data packets with at least a portion of the second group of data packets,
• wherein the at least a portion of the first group of data packets are those data packets that were not filtered by the first instance of the application, and
• wherein the at least a portion of the second group of data packets are those data packets that were not filtered by the second instance of the application;
• and
• forwarding the filtered stream of data packets to an egress port for transmission downstream toward a destination.

A computer-implemented method comprising:

• acquiring, by a network appliance, virtualized traffic indicative of data packets output by a plurality of virtual machines hosted on a multi-tenant cloud computing platform;
• comparing, by the network appliance repeatedly, an amount of the virtualized traffic acquired during a time period to available processing capacity of a number of existing instances of the application configured to process the virtual traffic;
• and
• modifying, by the network appliance in real time, the number of existing instances of the application, based on a result of said comparing.

A network appliance comprising:

• an ingress port through which to receive virtualized traffic output by a plurality of virtual machines hosted on a multi-tenant cloud computing platform;
• an egress port through which to route data packets away from the network appliance;
• and
• a processor configured to:
• monitor a volume of virtualized traffic received at the ingress port over a predetermined interval of time,
• determine that the volume exceeds processing capacity of a first instance of an application,
• cause a second instance of the application to be created, and
• distribute the virtualized traffic amongst the first and second instances of the application.