Autonomous distributed forwarding plane traceability based anomaly detection in application traffic for hyper-scale SD-WAN

A method for detecting and remediating anomalies in a software-defined wide area network (SD-WAN) comprising a controller, at least one enterprise datacenter, and a plurality of branch sites, wherein each branch site comprises at least one forwarding node, each forwarding node comprising a set of packet processing stages that process packet flows that are forwarded through the SD-WAN, the method comprising:

• at a trace monitor agent of a particular forwarding node that comprises a plurality of packet processing stages:
• receiving, from the controller of the SD-WAN, a set of one or more trace monitoring rules specified for a particular packet flow;
• determining that packets of a particular packet flow received at the particular forwarding node match at least one trace monitoring rule in the set of trace monitoring rules;
• based on the determination, directing each packet processing stage in the plurality of packet processing stages of the particular forwarding node to perform trace monitoring for the packets of the particular packet flow, wherein each packet processing stage in the plurality of packet processing stages generates trace monitoring results for the particular packet flow and provides the generated trace monitoring results to the trace monitor agent of the particular forwarding node;
• and
• forwarding a plurality of trace monitoring results for the particular flow to the controller for analysis,
• wherein the plurality of packet processing stages comprise one or more of:
• ingress, firewall, routing, quality of service (QoS), network address translation (NAT), and egress.

A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for detecting and remediating anomalies in a software-defined wide area network (SD-WAN) comprising a controller, at least one enterprise datacenter, and a plurality of branch sites, wherein each branch site comprises at least one forwarding node, each forwarding node comprising a set of packet processing stages that process packet flows that are forwarded through the SD-WAN, the program comprising sets of instructions for:

• at a particular forwarding node that comprises a plurality of packet processing stages:
• receiving, from the controller of the SD-WAN, a set of one or more trace monitoring rules specified for a particular packet flow;
• determining that packets of the particular packet flow received at the particular forwarding node match at least one trace monitoring rule in the set of trace monitoring rules;
• based on the determination, directing each packet processing stage in the plurality of packet processing stages of the particular forwarding node to perform trace monitoring for the packets of the particular packet flow;
• and
• forwarding a plurality of trace monitoring results for the particular packet flow to the controller for analysis,
• wherein the plurality of packet processing stages comprise one or more of:
• ingress, firewall, routing, quality of service (QoS), network address translation (NAT), and egress.