Packet metadata capture in a software-defined network

An apparatus, comprising:

• one or more network interfaces to communicate with a software-defined network (SDN);
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• receive, as a switch in the SDN, a packet sent by an endpoint device via the SDN, wherein the switch maintains one or more flow tables with entries indicative of one or more Transport Layer Security (TLS) header fields and that indicate whether and for how long a Transport Layer Security (TLS) packet is to be copied, wherein an entry in the entries comprises a particular ciphersuite, user agent, or TLS extension;
• make a determination that one or more header fields of the packet match the particular ciphersuite, user agent, or TLS extension included in the one or more TLS header fields;
• make a copy of the packet based on the determination;
• form telemetry data for reporting to a traffic analysis service by applying a metadata filter that applies a protocol-specific filtering policy that identifies TLS handshake messages and selectively extracts metadata from those packets, and that truncates the copy of the packet, by the switch and without decrypting a payload, by preventing the payload of the copy from inclusion in the telemetry data and causing only one or more header fields of the copy to be included in the telemetry data;
• applying, by the switch, header compression to the telemetry data before sending the telemetry data to the traffic analysis service;
• and
• send the telemetry data to the traffic analysis service, wherein the traffic analysis service comprises a classifier configured to use the telemetry data to classify the endpoint device for security analysis, including determining whether the endpoint device is infected with malware, to cause one or more mitigation actions to be performed by the traffic analysis service on the endpoint device when infected with malware.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a switch in a software-defined network (SDN) to execute a process comprising:

• receiving, at a switch of a software-defined network (SDN), a packet sent by an endpoint device via the SDN, wherein the switch maintains one or more flow tables with entries indicative of one or more Transport Layer Security (TLS) header fields and that indicate whether and for how long a Transport Layer Security (TLS) packet is to be copied, wherein an entry in the entries comprises a particular ciphersuite, user agent, or TLS extension;
• making, by the switch, a determination that one or more header fields of the packet match the particular ciphersuite, user agent, or TLS extension included in the one or more TLS header fields;
• making, by the switch, a copy of the packet based on the determination;
• forming, by the switch, telemetry data for reporting to a traffic analysis service by applying a metadata filter that applies a protocol-specific filtering policy that identifies TLS handshake messages and selectively extracts metadata from those packets, and that truncates the copy of the packet, by the switch and without decrypting a payload, by preventing the payload of the copy from inclusion in the telemetry data and causing only one or more header fields of the copy to be included in the telemetry data;
• applying, by the switch, header compression to the telemetry data before sending the telemetry data to the traffic analysis service;
• and
• sending, by the switch, the telemetry data to the traffic analysis service, wherein the traffic analysis service comprises a classifier configured to use the telemetry data to classify the endpoint device for security analysis, including determining whether the endpoint device is infected with malware, to cause one or more mitigation actions to be performed by the traffic analysis service on the endpoint device when infected with malware.