# US 11,909,606 B2 · Systems and methods for determining flow and path analytics of an application of a network using sampled packet inspection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,606 B2 - Document ID: US11909606B2 - Status: Granted - Kind: B2 - Application number: 17/537,160 - Filed: 2021-11-29 - Published: 2022-03-17 - Granted: 2024-02-20 - Earliest claimed: 2017-11-29 - Assignees: Extreme Networks, Inc. - Applicants: Extreme Networks, Inc. - Inventors: Donald B. Grosser; Chun Zhang; Patrick A. Bosa; Markus Nispel - Web page: https://patentgrep.com/patent/US11909606B2 ## CPC - H04L 43/028: by filtering - H04L 41/0894: Policy-based network configuration management - H04L 41/12: Discovery or management of network topologies - H04L 41/142: using statistical or mathematical methods - H04L 43/12: Network monitoring probes - H04L 43/18: Protocol analysers - H04L 43/022: by sampling - H04L 43/0852: Delays - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are disclosed herein for monitoring health of each switch of a plurality of switches on a network by selectively mirroring packets transmitted by each switch of the plurality of switches. In some embodiments, control circuitry generates a plurality of mirroring parameters, each mirroring parameter comprising an instruction to mirror a respective type of packet. The control circuitry transmits the plurality of mirroring parameters to each switch of the plurality of switches on the network, and receives, from a switch, a packet that was mirrored by the switch according to a mirroring parameter of the plurality of mirroring parameters. The control circuitry determines the respective type of the packet, executes an analysis of contents of the packet based on the respective type of the packet, and determines a health of the switch based on results of the analysis. ## Claims ### Claim 1 A method, comprising: generating a mirroring parameter that comprises an instruction to mirror a type of packet; transmitting the mirroring parameter to each switch of a plurality of switches in a network; receiving one or more packets, each mirrored by a respective one of the plurality of switches based on the mirroring parameter, wherein the one or more packets correspond to a web-based flow between a client and a service; and determining an identity of a switch of the plurality of switches that dropped an acknowledgement packet corresponding to a packet of the one or more packets, wherein the switch is located along the web-based flow between the client and the service. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving, from a second switch of the plurality of switches, another acknowledgement packet corresponding to another packet of the one or more packets; analyzing contents of the other packet and the other acknowledgement packet; determining a time difference between when the other packet was received and when the other acknowledgment packet was received; and determining a status of an application corresponding to the web-based flow by comparing the time difference to a threshold. ### Claim 3 (depends on 1) The method of claim 1, further comprising: transmitting an access control list (ACL) to the switch. ### Claim 4 (depends on 1) The method of claim 1, wherein receiving the one or more packets further comprises: receiving the one or more packets using a sampled flow (SFlow) protocol. ### Claim 5 (depends on 1) The method of claim 1, wherein receiving the one or more packets further comprises: mirroring the packet of the one or more packets based at least in part on whether the packet comprises data matching a predetermined pattern of the mirroring parameter at a predetermined location. ### Claim 6 (depends on 1) The method of claim 1, wherein the packet is a synchronization (SYN) packet. ### Claim 7 (depends on 1) The method of claim 1, wherein the application is a transmission control protocol (TCP) application. ### Claim 8 A system, comprising: communications circuitry; and control circuitry configured to: generate a mirroring parameter that comprises an instruction to mirror a type of packet; transmit the mirroring parameter to each switch of a plurality of switches in a network; receive one or more packets, each mirrored by a respective one of the plurality of switches based on the mirroring parameter, wherein the one or more packets correspond to a web-based flow between a client and a service; determine an identity of a switch of the plurality of switches that dropped an acknowledgement packet corresponding to a packet of the one or more packets, wherein the switch is located along the web-based flow between the client and the service. ### Claim 9 (depends on 8) The system of claim 8, wherein the control circuitry is further configured to: receive, from a second switch of the plurality of switches, an other acknowledgement packet corresponding to an other packet of the one or more packets; analyze contents of the other packet and the other acknowledgement packet determine a time difference between when the other packet was received and when the other acknowledgment packet was received; and determine a status of an application corresponding to the web-flow by comparing the time difference to a threshold. ### Claim 10 (depends on 8) The system of claim 8, wherein to receive the one or more packets, the control circuitry is further configured to: receive the one or more packets using a sampled flow (SFlow) protocol. ### Claim 11 (depends on 8) The system of claim 8, wherein to receive the one or more packets, the control circuitry is further configured to mirror the packet of the one or more packets based at least in part on whether the packet comprises data matching a predetermined pattern of the mirroring parameter at a predetermined location. ### Claim 12 (depends on 8) The system of claim 8, wherein the packet is a synchronization (SYN) packet. ### Claim 13 (depends on 8) The system of claim 8, wherein the control circuitry is further configured to: transmit an access control list (ACL) to the switch. ### Claim 14 A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising: generating a mirroring parameter that comprises an instruction to mirror a type of packet, wherein the type of packet is a synchronization (SYN) packet; transmitting the mirroring parameter to each switch of a plurality of switches in a network; receiving one or more SYN packets each mirrored by a respective one of the plurality of switches based on the mirroring parameter, wherein the one or more SYN packets correspond to a web-based flow between a client and a service; and determining an identity of a switch of the plurality of switches that dropped an acknowledgement packet corresponding to the SYN packet of the one or more SYN packets, wherein the switch is located along the web-based flow between the client and the service. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, the operations further comprising: receiving, from a second switch of the plurality of switches, an other acknowledgement packet corresponding to an other SYN packet of the one or more SYN packets; analyzing contents of the other SYN packet and the other acknowledgement packet; and determining a time difference between when the other SYN packet was received and when the other acknowledgment packet was received; and determining a status of an application corresponding to the web-based flow by comparing the time difference to a threshold. ### Claim 16 (depends on 14) The non-transitory computer-readable medium of claim 14, the operations further comprising: transmitting an access control list (ACL) to the switch. ### Claim 17 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the receiving the one or more SYN packets further comprises: receiving the one or more SYN packets using a sampled flow (SFlow) protocol. ### Claim 18 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein receiving the one or more SYN packets further comprises: mirroring the SYN packet of the one or more SYN packets based at least in part on whether the SYN packet comprises data matching a predetermined pattern of the mirroring parameter at a predetermined location. ### Claim 19 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the SYN packet is mirrored based on a match between the mirroring parameter of the ACL and a parameter of the SYN packet. ### Claim 20 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the application is a transmission control protocol (TCP) application.