# US 12,603,895 B2 · Packet metadata capture in a software-defined network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,895 B2 - Document ID: US12603895B2 - Status: Granted - Kind: B2 - Application number: 16/724,746 - Filed: 2019-12-23 - Published: 2021-06-24 - Granted: 2026-04-14 - Earliest claimed: 2019-12-23 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Blake Harrell Anderson; David McGrew - Web page: https://patentgrep.com/patent/US12603895B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/166: {at the transport layer} - H04L 63/0421: {Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a switch in a software-defined network receives a packet sent by an endpoint device via the SDN. The switch makes a copy of the packet based on one or more header fields of the packet matching one or more flow table entries of the switch. The switch forms telemetry data for reporting to a traffic analysis service by applying a metadata filter to the copy of the packet. The metadata filter prevents at least a portion of the copy of the packet from inclusion in the telemetry data. The switch sends the formed telemetry data to the traffic analysis service. ## Claims ### Claim 1 A method comprising: receiving, at a switch of a software-defined network (SDN), a packet sent by an endpoint device via the SDN, wherein the switch maintains one or more flow tables with entries indicative of one or more Transport Layer Security (TLS) header fields and that indicate whether and for how long a Transport Layer Security (TLS) packet is to be copied, wherein an entry in the entries comprises a particular ciphersuite, user agent, or TLS extension; making, by the switch, a determination that one or more header fields of the packet match the particular ciphersuite, user agent, or TLS extension included in the one or more TLS header fields; making, by the switch, a copy of the packet based on the determination; forming, by the switch, telemetry data for reporting to a traffic analysis service by applying a metadata filter that applies a protocol-specific filtering policy that identifies TLS handshake messages and selectively extracts metadata from those packets, and that truncates the copy of the packet, by the switch and without decrypting a payload, by preventing the payload of the copy from inclusion in the telemetry data and causing only one or more header fields of the copy to be included in the telemetry data; applying, by the switch, header compression to the telemetry data before sending the telemetry data to the traffic analysis service; and sending, by the switch, the telemetry data to the traffic analysis service, wherein the traffic analysis service comprises a classifier configured to use the telemetry data to classify the endpoint device for security analysis, including determining whether the endpoint device is infected with malware, to cause one or more mitigation actions to be performed by the traffic analysis service on the endpoint device when infected with malware. ### Claim 2 (depends on 1) The method as in claim 1, wherein the traffic analysis service uses the telemetry data to determine whether the endpoint device is infected with malware. ### Claim 3 (depends on 1) The method as in claim 1, wherein forming the telemetry data further comprises: applying header compression to the copy of the packet. ### Claim 4 (depends on 1) The method as in claim 1, further comprising: receiving, at the switch, an update to the one or more flow tables and to the metadata filter from an SDN controller. ### Claim 5 (depends on 1) The method as in claim 1, wherein the metadata filter determines whether the packet is one of a set of initial packets for a Transmission Control Protocol (TCP) session. ### Claim 6 (depends on 1) The method as in claim 1, wherein the telemetry data comprises header information from the copy of the packet and one or more other packets sent by the endpoint device. ### Claim 7 (depends on 1) The method as in claim 1, wherein the traffic analysis service comprises a classifier that takes the telemetry data as input to determine whether a flow associated with the packet sent by the endpoint device is malware-related, an attempt to exfiltrate traffic, or follows authorized security parameters. ### Claim 8 (depends on 1) The method as in claim 1, wherein the packet sent by the endpoint device is from a TLS handshake. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a software-defined network (SDN); a processor coupled to the one or more network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: receive, as a switch in the SDN, a packet sent by an endpoint device via the SDN, wherein the switch maintains one or more flow tables with entries indicative of one or more Transport Layer Security (TLS) header fields and that indicate whether and for how long a Transport Layer Security (TLS) packet is to be copied, wherein an entry in the entries comprises a particular ciphersuite, user agent, or TLS extension; make a determination that one or more header fields of the packet match the particular ciphersuite, user agent, or TLS extension included in the one or more TLS header fields; make a copy of the packet based on the determination; form telemetry data for reporting to a traffic analysis service by applying a metadata filter that applies a protocol-specific filtering policy that identifies TLS handshake messages and selectively extracts metadata from those packets, and that truncates the copy of the packet, by the switch and without decrypting a payload, by preventing the payload of the copy from inclusion in the telemetry data and causing only one or more header fields of the copy to be included in the telemetry data; applying, by the switch, header compression to the telemetry data before sending the telemetry data to the traffic analysis service; and send the telemetry data to the traffic analysis service, wherein the traffic analysis service comprises a classifier configured to use the telemetry data to classify the endpoint device for security analysis, including determining whether the endpoint device is infected with malware, to cause one or more mitigation actions to be performed by the traffic analysis service on the endpoint device when infected with malware. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the traffic analysis service uses the telemetry data to determine whether the endpoint device is infected with malware. ### Claim 11 (depends on 9) The apparatus as in claim 9, wherein the apparatus forms the telemetry data further by: applying header compression to the copy of the packet. ### Claim 12 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: receive an update to the one or more flow tables and to the metadata filter from an SDN controller. ### Claim 13 (depends on 9) The apparatus as in claim 9, wherein the metadata filter determines whether the packet is one of a set of initial packets for a Transmission Control Protocol (TCP) session. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein the telemetry data comprises header information from the copy of the packet and one or more other packets sent by the endpoint device. ### Claim 15 (depends on 9) The apparatus as in claim 9, wherein the apparatus comprises a network switch. ### Claim 16 (depends on 9) The apparatus as in claim 9, wherein the traffic analysis service comprises a classifier that takes the telemetry data as input to determine whether a flow associated with the packet sent by the endpoint device is malware-related, an attempt to exfiltrate traffic, or follows authorized security parameters. ### Claim 17 (depends on 9) The apparatus as in claim 9, wherein the packet sent by the endpoint device is from a TLS handshake. ### Claim 18 A tangible, non-transitory, computer-readable medium storing program instructions that cause a switch in a software-defined network (SDN) to execute a process comprising: receiving, at a switch of a software-defined network (SDN), a packet sent by an endpoint device via the SDN, wherein the switch maintains one or more flow tables with entries indicative of one or more Transport Layer Security (TLS) header fields and that indicate whether and for how long a Transport Layer Security (TLS) packet is to be copied, wherein an entry in the entries comprises a particular ciphersuite, user agent, or TLS extension; making, by the switch, a determination that one or more header fields of the packet match the particular ciphersuite, user agent, or TLS extension included in the one or more TLS header fields; making, by the switch, a copy of the packet based on the determination; forming, by the switch, telemetry data for reporting to a traffic analysis service by applying a metadata filter that applies a protocol-specific filtering policy that identifies TLS handshake messages and selectively extracts metadata from those packets, and that truncates the copy of the packet, by the switch and without decrypting a payload, by preventing the payload of the copy from inclusion in the telemetry data and causing only one or more header fields of the copy to be included in the telemetry data; applying, by the switch, header compression to the telemetry data before sending the telemetry data to the traffic analysis service; and sending, by the switch, the telemetry data to the traffic analysis service, wherein the traffic analysis service comprises a classifier configured to use the telemetry data to classify the endpoint device for security analysis, including determining whether the endpoint device is infected with malware, to cause one or more mitigation actions to be performed by the traffic analysis service on the endpoint device when infected with malware. ### Claim 19 (depends on 18) The tangible, non-transitory, computer-readable medium as in claim 18, wherein the traffic analysis service comprises a classifier that takes the telemetry data as input to determine whether a flow associated with the packet sent by the endpoint device is malware-related, an attempt to exfiltrate traffic, or follows authorized security parameters. ### Claim 20 (depends on 18) The tangible, non-transitory, computer-readable medium as in claim 18, wherein the packet sent by the endpoint device is from a TLS handshake.