Method and apparatus for mirroring traffic over a network

A source network device for transmitting a substantially identical copy of one or more qualified packets to a target network device, the source network device comprising:

• (a) a flow resolution logic for:
• (i) processing one or more packets from an ingress stream for switching, wherein one or more egress packets is formed;
• and
• (ii) selecting one or more qualified packets from the ingress stream;
• (b) a replicator for duplicating the one or more qualified packets, wherein one or more duplicate packets are formed;
• (c) an encapsulation module for appending a mirrored flow encapsulation header to each of the one or more duplicate packets, wherein one or more mirrored flow encapsulation packets are formed;
• and
• (d) one or more queue memory devices for buffering the:
• (i) one or more egress packets prior to transmission to one or more network nodes, and
• (ii) one or more mirrored flow encapsulation packets prior to transmission to the target network device.

A target network device for receiving one or more mirrored flow encapsulation packets from a source network device, each of the mirrored flow encapsulation packets comprising a mirrored flow encapsulation header and a qualified packet, the target network device comprising:

• (a) a flow resolution logic for:
• (i) processing one or more packets from an ingress stream for switching, wherein one or more egress packets are formed;
• and
• (ii) selecting one or more mirrored flow encapsulation packets from an ingress stream;
• (b) a de-encapsulation module for removing the mirrored flow encapsulation header from each of the one or more mirrored flow encapsulation packets;
• wherein one or more qualified packets substantially identical to that received at the source network device are regenerated.

A method for mirroring one or more qualified packets from a source network device to a target network device, the method comprising the steps of:

• (a) selecting one or more qualified packets from an ingress stream using mirror classification criteria;
• (b) duplicating the one or more qualified packets, wherein duplicate packets are formed;
• (c) appending a mirrored flow encapsulation header to the duplicate packets, the mirrored flow encapsulation header comprising destination addressing information for the target network device, wherein one or more mirrored flow encapsulation packets are formed;
• (d) transmitting the mirrored flow encapsulation packets from the source network device to the target network device;
• (e) removing the mirrored flow encapsulation header from the one or more mirrored flow encapsulation packets at the target network device, wherein the plurality of qualified packets are regenerated;
• and
• (f) forwarding the one or more qualified packets to an egress port independent of the destination address contained therein.

A traffic mirroring method, comprising the steps of:

• (a) receiving an ingress packet on a first network node;
• (b) duplicating the ingress packet, such that a duplicate packet is formed;
• (c) encapsulating the duplicate packet with a mirrored flow header;
• and
• (d) transmitting, using information in the mirrored flow header, the duplicate packet from the first network node to a second network node.

A traffic mirroring system for a communication network, comprising:

• (a) a first network node;
• and
• (b) a second network node interconnected to the first network node;
• wherein the first network node receives an ingress packet, duplicates the ingress packet such that a duplicate packet is formed, encapsulates the duplicate packet with a mirrored flow header and transmits, using information in the mirrored flow header, the duplicate packet from a first network node to the second network node.

A transmitting network node of a flow mirroring system for a communication network, comprising:

• (a) an ingress module for receiving an ingress packet on an input port;
• (b) a classification module for classifying the ingress packet as belonging to a mirrored flow;
• (c) a replication module for duplicating the ingress packet, such that a duplicate packet is formed;
• (d) an encapsulation module for appending a mirrored flow header to the duplicate packet;
• (e) a memory for temporarily storing the duplicate packet;
• and
• (f) an egress module for transmitting, using information in the mirrored flow header, the duplicate packet on an output port.

A receiving network node of a flow mirroring system for a communication network, comprising:

• (a) an ingress module for receiving a duplicate packet on an input port;
• (b) a classification module for classifying the duplicate packet as belonging to a mirrored flow;
• (c) a de-capsulation module for removing a mirrored flow header from the duplicate packet;
• (d) a memory for temporarily storing the duplicate packet;
• and
• (e) an egress module for transmitting the duplicate packet on an output port.