Back to results
US 11,082,312 B2Granted
Service chaining segmentation analytics
AssigneeCisco Technology, Inc.
InventorSamar Sharma
Life of this patent
Estimating the term…
Abstract
Presented herein are service chaining techniques for selective traffic redirection based on Access Control List (ACL) configurations on switches. Network traffic forwarded along one or more service chains may be monitored on the basis of individual segments of the service chains. In one example, the network traffic forwarded along individual segments may be counted on a per-segment basis.
Claims20
A method comprising:
- storing, in at least one hardware module of a network device having a plurality of ports, attributes for at least one access control list and associated actions that cause network packets received at one of the plurality of ports that match the attributes for the at least one access control list, to be directed into one or more service chains, each service chain defining a path that network traffic follows through the network device and one or more applications, each service chain being segmented into a plurality of segments wherein each segment represents a portion of the path of a service chain between an ingress port of the network device to a first application of a service chain, between successively applied applications of a chain, or between a last application of a service chain and an egress port of the network device;
- directing received network packets that match the attributes for the at least one access control list into the one or more service chains;
- monitoring network traffic on each of the one or more service chains by counting, on a per-segment basis, network packets through each individual segment of each of the one or more service chains such that each segment of each of the one or more service chains has a corresponding packet count;
- and
- based on the counting, generating analytics of network traffic for each segment of each of the one or more service chains, wherein generating analytics includes summing packet counts of a plurality of segments.
2 more elements
An apparatus comprising:
- at least one hardware module of a network device having a plurality of ports, the at least one hardware module configured to store attributes for at least one access control list and associated actions that cause network packets received at one of the plurality of ports that match the attributes for the at least one access control list, to be directed into one or more service chains, each service chain defining a path that network traffic follows through the network device and one or more applications, each service chain being segmented into a plurality of segments wherein each segment represents a portion of the path of a service chain between an ingress port of the network device to a first application of a service chain, between successively applied applications of a chain, or between a last application of a service chain and an egress port of the network device;
- and
- a processor configured to communicate with the at least one hardware module and to:
- direct received network packets that match the attributes for the at least one access control list into the one or more service chains;
- monitor network traffic on each of the one or more service chains by counting, on a per-segment basis, network packets through each individual segment of each of the one or more service chains such that each segment of each of the one or more service chains has a corresponding packet count;
- and
- based on counted network packets, generate analytics of network traffic for each segment of each of the one or more service chains, wherein analytics of the network traffic include analytics generated by summing packet counts of a plurality of segments.
4 more elements
One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to perform operations comprising:
- storing, in at least one hardware module of a network device having a plurality of ports, attributes for at least one access control list and associated actions that cause network packets received at one of the plurality of ports that match the attributes for the at least one access control list, to be directed into one or more service chains, each service chain defining a path that network traffic follows through the network device and one or more applications, each service chain being segmented into a plurality of segments wherein each segment represents a portion of the path of a service chain between an ingress port of the network device to a first application of a service chain, between successively applied applications of a chain, or between a last application of a service chain and an egress port of the network device;
- directing received network packets that match the attributes for the at least one access control list into the one or more service chains;
- monitoring network traffic on each of the one or more service chains by counting, on a per-segment basis, network packets through each individual segment of each of the one or more service chains such that each segment of each of the one or more service chains has a corresponding packet count;
- and
- based on the counting, generating analytics of network traffic for each segment of each of the one or more service chains, wherein analytics of the network traffic include analytics generated by summing packet counts of a plurality of segments.
2 more elements
Dependencies are inferred from the claim text.