Capturing data packets for analysis using a virtual machine
AssigneeLenovo Enterprise Solutions (Singapore) Pte. Ltd.
InventorsGavril Ioan Florian, Andrei I. Bunghez, Bogdan-Alexandru Ratiu, Anda-Maria Nicolae
Life of this patent
Estimating the term…
Abstract
Capturing data packets for analysis using a virtual machine including receiving, at an analyzer virtual machine, an encapsulated packet for analysis, wherein the encapsulated packet comprises a monitoring metadata header and a data packet with a data packet header; stripping the monitoring metadata header from the encapsulated packet to obtain a de-encapsulated packet comprising the data packet with the data packet header; and directing, based on the data packet header, the de-encapsulated packet to a virtual network interface associated with a packet capture application within the analyzer virtual machine.
Claims20
A method comprising:
- by program instructions on a computing device,
- receiving, at an analyzer virtual machine, an encapsulated packet for analysis, wherein the encapsulated packet comprises a monitoring metadata header and a mirrored data packet with a data packet header, and wherein the analyzer virtual machine is one of a plurality of virtual machines hosted on the computing device;
- stripping, by the analyzer virtual machine, the monitoring metadata header from the encapsulated packet to obtain a de-encapsulated packet comprising the data packet with the data packet header;
- and
- directing, by the analyzer virtual machine and based on the data packet header, the de-encapsulated packet to a virtual network interface associated with a packet capture application within the analyzer virtual machine for analysis by the packet capture application.
An apparatus comprising a computing device, a computer processor, and a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:
- receiving, at an analyzer virtual machine, an encapsulated packet for analysis, wherein the encapsulated packet comprises a monitoring metadata header and a mirrored data packet with a data packet header, and wherein the analyzer virtual machine is one of a plurality of virtual machines hosted on the computing device;
- stripping, by the analyzer virtual machine, the monitoring metadata header from the encapsulated packet to obtain a de-encapsulated packet comprising the data packet with the data packet header;
- and
- directing, by the analyzer virtual machine and based on the data packet header, the de-encapsulated packet to a virtual network interface associated with a packet capture application within the analyzer virtual machine for analysis by the packet capture application.
A computer program product including a non-volatile computer readable storage medium and computer program instructions stored therein that, when executed, cause a computer to carry out the steps of:
- receiving, at an analyzer virtual machine, an encapsulated packet for analysis, wherein the encapsulated packet comprises a monitoring metadata header and a mirrored data packet with a data packet header, and wherein the analyzer virtual machine is one of a plurality of virtual machines hosted on a virtualization platform on a computing device;
- stripping, by the analyzer virtual machine, the monitoring metadata header from the encapsulated packet to obtain a de-encapsulated packet comprising the data packet with the data packet header;
- and
- directing, by the analyzer virtual machine and based on the data packet header, the de-encapsulated packet to a virtual network interface associated with a packet capture application within the analyzer virtual machine for analysis by the packet capture application.
Dependencies are inferred from the claim text.