# US 12,010,006 B2 · Packet capture using VXLAN encapsulation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,006 B2 - Document ID: US12010006B2 - Status: Granted - Kind: B2 - Application number: 18/181,481 - Filed: 2023-03-09 - Published: 2023-12-14 - Granted: 2024-06-11 - Earliest claimed: 2022-02-24 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Darshil Jashvant Khetani; Salem Amin Al-Damluji - Web page: https://patentgrep.com/patent/US12010006B2 ## CPC - H04L 43/0811: by checking connectivity - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 43/028: by filtering - H04L 43/062: related to network traffic - H04L 43/12: Network monitoring probes - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques are disclosed for capturing network traffic in a computing environment comprising a plurality of computing devices. A data capture definition defines a network element of interest and data traffic that is to be captured for the network element. The network element to selectively identifies the data packets to be captured. The identified packets are encapsulated within a VXLAN session and sent to a storage service. ## Claims ### Claim 1 A method for capturing network traffic in a virtualized computing environment comprising a plurality of network elements that are configured to send or receive network traffic in the virtualized computing environment, the method comprising: in response to receiving, by a packet capture service executing in the virtualized computing environment, data identifying a network element of the virtualized computing environment and data traffic to be captured, configuring the network element to identify which data packets are to be captured and a storage service for storing the data packets to be captured, wherein the storage service is an endpoint of the virtualized computing environment and configured to store the data packets to be captured, and wherein the data traffic to be captured comprises data packets received by the network element or data packets sent from the network element and wherein the data packets received by the network element or data packets sent from the network element are associated with a communication session identifiable by the network element based on application-level processing; encapsulating, by the network element, data packets received at the network element or sent by the network element that are to be captured, the data packets encapsulated within a tunneling session to include session information for the tunneling session; and sending the encapsulated packets to the storage service, the storage service configured to de-encapsulate the encapsulated packets and store the de-encapsulated packets, wherein the de-encapsulated packets are stored so as to enable retrieval of the de-encapsulated packets based on the session information for the tunneling session. ### Claim 2 (depends on 1) The method of claim 1, wherein the data packets to be captured are identified based on one or more of source IP address, SIP call-ID, or destination username. ### Claim 3 (depends on 1) The method of claim 1, wherein the session information includes a session ID. ### Claim 4 (depends on 1) The method of claim 1, wherein the session information comprises a source port. ### Claim 5 (depends on 1) The method of claim 1, further comprising sending, by the network element to the storage service, metadata for the tunneling session to be transmitted to the storage service. ### Claim 6 (depends on 5) The method of claim 5, wherein the metadata comprises SIP call-ID or source/destination users. ### Claim 7 (depends on 1) The method of claim 1, further comprising sending, by the network element to the storage service, a stop message when the tunneling session is to be terminated. ### Claim 8 (depends on 1) The method of claim 1, further comprising matching, at the storage service, the encapsulated packets to the tunneling session based on information provided to the storage service in a start message. ### Claim 9 A method for capturing network traffic in a computing environment comprising a plurality of computing devices, the method comprising: sending, by a packet capture service to a computing device executing in the computing environment, a rule indicative of data traffic to be captured, the data traffic associated with the computing device, wherein the data traffic to be captured comprises data packets received by the computing device or data packets sent from the computing device and wherein the data packets received by the computing device or data packets sent from the computing device are associated with a communication session identifiable by the computing device based on application-level processing; sending, by the computing device to a storage service, a message indicating a tunneling session by which the data traffic that is to be captured will be transmitted to the storage service; encapsulating, by the computing device, data packets received at or sent by the computing device that are to be captured in accordance with the rule, the data packets encapsulated for the tunneling session and including session information for the tunneling session; sending, by the computing device, the encapsulated packets to the storage service; matching, by the storage service, the encapsulated packets to the tunneling session; and de-encapsulating, by the storage service, the encapsulated packets and storing the de-encapsulated packets using an identifier usable to selectively retrieve the stored de-encapsulated packets. ### Claim 10 (depends on 9) The method of claim 9, wherein the message indicating the tunneling session comprises a source port. ### Claim 11 (depends on 9) The method of claim 9, wherein the data traffic that is to be captured is identified by one or more of a source IP address, SIP call-ID, or destination username. ### Claim 12 (depends on 9) The method of claim 9, wherein the computing device is a first computing device, further comprising capturing packets received at or sent by a second computing device on a same logical session. ### Claim 13 (depends on 12) The method of claim 12, further comprising linking capture streams for the first computing device and the second computing device. ### Claim 14 (depends on 13) The method of claim 13, further comprising sending, to the storage service, updates to the tunneling session when changes are made to the packets that are to be captured. ### Claim 15 (depends on 9) The method of claim 9, further comprising sending a stop message to the storage service when packet capture is to be terminated. ### Claim 16 A system comprising: a processor; a storage system; and a memory storing computer-executable instructions thereupon which, when executed by the processor, cause the system to perform operations comprising: in response to receiving identification of a network element and data traffic that is to be captured for the network element, wherein the data traffic to be captured comprises data packets received by the network element or data packets sent from the network element and wherein the data packets received by the network element or data packets sent from the network element are associated with a communication session identifiable by the network element based on application-level processing; configuring the network element to identify which data packets are to be captured at the network element; encapsulate packets received at or sent by the network element that are to be captured, the packets encapsulated within a tunneling session including session information for the tunneling session; and send the encapsulated packets to the storage system; wherein the storage system is configured to: match the encapsulated packets to the tunneling session; de-encapsulate the encapsulated packets; and store the de-encapsulated packets using an identifier usable to selectively retrieve the stored de-encapsulated packets. ### Claim 17 (depends on 16) The system of claim 16, wherein the data packets to be captured at the network element are identified based on one or more of source IP address, SIP call-ID, or destination username. ### Claim 18 (depends on 16) The system of claim 16, the memory storing computer-executable instructions thereupon which, when executed by the processor, cause the system to perform operations comprising: receiving, from the network element, tunneling information for a session to be received by the storage system; wherein the tunneling information comprises a tunneling ID or source port. ### Claim 19 (depends on 16) The system of claim 16, the memory storing computer-executable instructions thereupon which, when executed by the processor, cause the system to perform operations comprising: receiving, from the network element, metadata for a session to be transmitted to the storage system; wherein the metadata comprises SIP call-ID or source/destination users. ### Claim 20 (depends on 19) The system of claim 19, wherein the storage system is configured to match the encapsulated packets to the tunneling session based on the information provided to the storage system in a start message.