Back to results
US 12,010,006 B2Granted
Packet capture using VXLAN encapsulation
AssigneeMicrosoft Technology Licensing, LLC
InventorsDarshil Jashvant Khetani, Salem Amin Al-Damluji
Life of this patent
Estimating the term…
Abstract
Techniques are disclosed for capturing network traffic in a computing environment comprising a plurality of computing devices. A data capture definition defines a network element of interest and data traffic that is to be captured for the network element. The network element to selectively identifies the data packets to be captured. The identified packets are encapsulated within a VXLAN session and sent to a storage service.
Claims20
A method for capturing network traffic in a virtualized computing environment comprising a plurality of network elements that are configured to send or receive network traffic in the virtualized computing environment, the method comprising:
- in response to receiving, by a packet capture service executing in the virtualized computing environment, data identifying a network element of the virtualized computing environment and data traffic to be captured, configuring the network element to identify which data packets are to be captured and a storage service for storing the data packets to be captured, wherein the storage service is an endpoint of the virtualized computing environment and configured to store the data packets to be captured, and wherein the data traffic to be captured comprises data packets received by the network element or data packets sent from the network element and wherein the data packets received by the network element or data packets sent from the network element are associated with a communication session identifiable by the network element based on application-level processing;
- encapsulating, by the network element, data packets received at the network element or sent by the network element that are to be captured, the data packets encapsulated within a tunneling session to include session information for the tunneling session;
- and
- sending the encapsulated packets to the storage service, the storage service configured to de-encapsulate the encapsulated packets and store the de-encapsulated packets, wherein the de-encapsulated packets are stored so as to enable retrieval of the de-encapsulated packets based on the session information for the tunneling session.
1 more element
A method for capturing network traffic in a computing environment comprising a plurality of computing devices, the method comprising:
- sending, by a packet capture service to a computing device executing in the computing environment, a rule indicative of data traffic to be captured, the data traffic associated with the computing device, wherein the data traffic to be captured comprises data packets received by the computing device or data packets sent from the computing device and wherein the data packets received by the computing device or data packets sent from the computing device are associated with a communication session identifiable by the computing device based on application-level processing;
- sending, by the computing device to a storage service, a message indicating a tunneling session by which the data traffic that is to be captured will be transmitted to the storage service;
- encapsulating, by the computing device, data packets received at or sent by the computing device that are to be captured in accordance with the rule, the data packets encapsulated for the tunneling session and including session information for the tunneling session;
- sending, by the computing device, the encapsulated packets to the storage service;
- matching, by the storage service, the encapsulated packets to the tunneling session;
- and
- de-encapsulating, by the storage service, the encapsulated packets and storing the de-encapsulated packets using an identifier usable to selectively retrieve the stored de-encapsulated packets.
4 more elements
A system comprising:
- a processor;
- a storage system;
- and
- a memory storing computer-executable instructions thereupon which, when executed by the processor, cause the system to perform operations comprising:
- in response to receiving identification of a network element and data traffic that is to be captured for the network element, wherein the data traffic to be captured comprises data packets received by the network element or data packets sent from the network element and wherein the data packets received by the network element or data packets sent from the network element are associated with a communication session identifiable by the network element based on application-level processing;
- configuring the network element to identify which data packets are to be captured at the network element;
- encapsulate packets received at or sent by the network element that are to be captured, the packets encapsulated within a tunneling session including session information for the tunneling session;
- and
- send the encapsulated packets to the storage system;
- wherein the storage system is configured to:
- match the encapsulated packets to the tunneling session;
- de-encapsulate the encapsulated packets;
- and
- store the de-encapsulated packets using an identifier usable to selectively retrieve the stored de-encapsulated packets.
11 more elements
Dependencies are inferred from the claim text.