Traffic capture mechanisms for industrial network security
AssigneeCisco Technology, Inc.
InventorsLin Zhang, Alex Wang, Srinivas Tenneti, Heather Riley Hilldale, Erika Franco Acevedo
Life of this patent
Estimating the term…
Abstract
According to various embodiments, a networking device in a network receives traffic from the network. The networking device duplicates the traffic into a duplicate traffic copy. The networking device encapsulates the duplicate traffic copy into a multicast frame. The networking device sends, via a multicast address, the multicast frame to a network sensor in the network for analysis, wherein the multicast address is reserved in the network for traffic analysis.
Claims16
A method comprising:
- receiving, at a networking device in a network, traffic from the network;
- duplicating, by the networking device, the traffic into a duplicate traffic copy;
- encapsulating, by the networking device, the duplicate traffic copy into a multicast frame, wherein the multicast frame is assigned a different Quality of Service (QoS) policy as that of the traffic;
- and
- sending, by the networking device and via a multicast address, the multicast frame to a network sensor in the network via one or more intermediate devices between the networking device and the network sensor for analysis, wherein the multicast address is reserved in the network for traffic analysis, such that the one or more intermediate devices forward the multicast frame to the network sensor using their uplink port only.
An apparatus, comprising:
- one or more interfaces to communicate with a ring of networking devices of a network;
- a processor coupled to the one or more interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process that is executable by the processor, the process when executed configured to:
- receive traffic from the network;
- duplicate the traffic into a duplicate traffic copy;
- encapsulate the duplicate traffic copy into a multicast frame, wherein the multicast frame is assigned a different Quality of Service (QoS) policy as that of the traffic;
- and
- send, via a multicast address, the multicast frame to a network sensor in the network via one or more intermediate devices between the networking device and the network sensor for analysis, wherein the multicast address is reserved in the network for traffic analysis, such that the one or more intermediate devices forward the multicast frame to the network sensor using their uplink port only.
A tangible, non-transitory, computer-readable medium storing program instructions that cause a networking device in a network to execute a process comprising:
- receiving, at the networking device in the network, traffic from the network;
- duplicating, by the networking device, the traffic into a duplicate traffic copy;
- encapsulating, by the networking device, the duplicate traffic copy into a multicast frame wherein the multicast frame is assigned a different Quality of Service (QoS) policy as that of the traffic;
- and
- sending, by the networking device and via a multicast address, the multicast frame to a network sensor in the network via one or more intermediate devices between the networking device and the network sensor for analysis, wherein the multicast address is reserved in the network for traffic analysis, such that the one or more intermediate devices forward the multicast frame to the network sensor using their uplink port only.
Dependencies are inferred from the claim text.