# US 11,451,473 B2 · Egress mirroring packets to CPU using recirculation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,473 B2
- Document ID: US11451473B2
- Status: Granted
- Kind: B2
- Application number: 16/883,097
- Filed: 2020-05-26
- Published: 2021-12-02
- Granted: 2022-09-20
- Earliest claimed: 2020-05-26
- Assignees: Arista Networks, Inc.
- Applicants: Arista Networks, Inc.
- Inventors: Robert Esposito; William Darby
- Web page: https://patentgrep.com/patent/US11451473B2

## CPC

- H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling}
- H04L 12/413: with random access, e.g. carrier-sense multiple-access with collision detection [CSMA-CD]
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 43/026: using flow identification
- H04L 69/22: Parsing or analysis of headers
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Egress mirroring packets to a CPU includes processing ingress packets in a forwarding pipeline; egressing one or more packets from the forwarding pipeline to a first physical port of the switch; mirroring the one or more packets on the first physical port to a second physical port of the switch; recirculating the one or more packets on the second physical port to the forwarding pipeline, wherein the one or more packets on the second physical port become ingress packets on the second physical port and processing the recirculated one or more packets in the forwarding pipeline includes identifying packets that ingress on the second physical port; and sending the identified packets to a central processing unit (CPU) in the switch.

## Claims

### Claim 1

A method in a switch comprising:
processing ingress packets in a forwarding pipeline;
egressing one or more packets from the forwarding pipeline to a first physical port of the switch;
mirroring the one or more packets on the first physical port to a second physical port of the switch;
recirculating the one or more packets on the second physical port to the forwarding pipeline, wherein the one or more packets on the second physical port become ingress packets on the second physical port and processing the recirculated one or more packets in the forwarding pipeline includes identifying packets that ingress on the second physical port; and
sending the identified packets to a central processing unit (CPU) in the switch.

### Claim 2 (depends on 1)

The method of claim 1 further comprising using a ternary content-addressable memory (TCAM) rule to identify packets that ingress on the second physical port.

### Claim 3 (depends on 1)

The method of claim 1 further comprising adding information to the one or more mirrored packets to distinguish different kinds of packets, wherein the CPU processes the packets according to the added information.

### Claim 4 (depends on 3)

The method of claim 3 further comprising:
egressing a different one or more packets from the forwarding pipeline to a third physical port of the switch; and
mirroring the one or more packets on the third physical port to the second physical port of the switch.

### Claim 5 (depends on 4)

The method of claim 4 wherein:
the mirroring adds information to the mirrored packets from the third physical port and the first physical port,
the information distinguishes the mirrored packets from the third physical port from the mirrored packets from the first physical port, and
the CPU processes the identified packets according to the added information.

### Claim 6 (depends on 1)

The method of claim 1 wherein the CPU analyzes the identified packets, including decoding raw data of the identified packets.

### Claim 7

A switch comprising:
a processor; and
a memory communicatively coupled to the processor, the memory storing instructions executable by the processor to configure a data plane circuit to perform a method, the method comprising:
mirroring one or more packets on a first physical port to a second physical port of the switch;
recirculating the one or more packets on the second physical port to a forwarding pipeline, wherein the one or more packets on the second physical port become ingress packets on the second physical port;
identifying, in the forwarding pipeline, packets that ingress on the second physical port; and
sending the identified packets to a central processing unit (CPU) in the switch.

### Claim 8 (depends on 7)

The switch of claim 7 wherein the method further comprises using a ternary content-addressable memory (TCAM) rule to identify packets that ingress on the second physical port.

### Claim 9 (depends on 7)

The switch of claim 7 wherein the method further comprises adding information to the one or more mirrored packets to distinguish different kinds of packets, and the CPU processes the packets according to the added information.

### Claim 10 (depends on 9)

The switch of claim 9 wherein the method further comprises:
egressing a different one or more packets from the forwarding pipeline to a third physical port of the switch; and
mirroring the one or more packets on the third physical port to the second physical port of the switch.

### Claim 11 (depends on 10)

The switch of claim 10 wherein the mirroring adds information to the mirrored packets from the third physical port and the mirrored packets from the first physical port, the information distinguishing the mirrored packets from the third physical port from the mirrored packets from the first physical port, the CPU processing the identified packets according to the added information.

### Claim 12 (depends on 10)

The switch of claim 10 wherein the mirroring adds information to the mirrored packets from the third physical port and the mirrored packets from the first physical port, the information grouping the mirrored packets from the third physical port together and the mirrored packets from the first physical port together, the CPU processing the identified packets according to the added information.

### Claim 13 (depends on 7)

The switch of claim 7 wherein the CPU analyzes the identified packets, including decoding raw data of the identified packets.

### Claim 14

A switch comprising:
a mirroring circuit, the mirroring circuit copying one or more packets on a first physical port to a second physical port of the switch;
a recirculation circuit, the recirculation circuit providing the one or more packets on the second physical port to a forwarding pipeline, wherein the one or more packets on the second physical port become ingress packets on the second physical port; and
the forwarding pipeline, the forwarding pipeline identifying packets that ingress on the second physical port and sending the identified packets to a central processing unit (CPU) in the switch.

### Claim 15 (depends on 14)

The switch of claim 14 further comprising a ternary content-addressable memory (TCAM), the TCAM storing a rule used by the forwarding pipeline to identify packets that ingress on the second physical port.

### Claim 16 (depends on 14)

The switch of claim 14 wherein the mirroring circuit further adds added information to the one or more mirrored packets to distinguish different kinds of packets and the CPU processes the packets according to the added information.

### Claim 17 (depends on 16)

The switch of claim 16 wherein the mirroring circuit copies a different one or more packets on a third physical port to the second physical port of the switch.

### Claim 18 (depends on 17)

The switch of claim 17 wherein the mirroring adds information to the mirrored packets from the third physical port and the mirrored packets from the first physical port, the information is used by the CPU to distinguish the mirrored packets from the third physical port from the mirrored packets from the first physical port, the CPU processing the identified packets according to the added information.

### Claim 19 (depends on 17)

The switch of claim 17 wherein the mirroring adds information to the mirrored packets from the third physical port and the mirrored packets from the first physical port, the information is used by the CPU to group the mirrored packets from the third physical port together and the mirrored packets from the first physical port together, the CPU processing the identified packets according to the added information.

### Claim 20 (depends on 14)

The switch of claim 14 wherein the CPU analyzes the identified packets, including decoding raw data of the identified packets.