Adaptive and Flexible Packet Sampling
AssigneeGigamon Inc.
InventorsMaziar Mirzazad Barijough, Santosh Reddy Mamidi
Life of this patent
Estimating the term…
Abstract
The disclosed techniques include at least one method. The method includes receiving, by a network device, incoming packets communicated over a computer network, and detecting flows to which the incoming packets belong. Each incoming packet belongs to a flow of the flows. The method further includes sampling each incoming packet that satisfies a flow condition having a flow interval of packets for the flow of the incoming packet, and sampling each incoming packet that satisfies a global condition having a global interval of packets irrespective of the flow of the incoming packet. The method further includes storing any sampled packets or information indicative of any sampled packets.
Claims27
A method comprising:
- receiving, by a network device, a plurality of incoming packets communicated over a computer network;
- detecting a flow, of a plurality of flows, to which each packet of the plurality of incoming packets belongs, each incoming packet of the plurality of incoming packets belonging to a flow of the plurality of flows;
- sampling each incoming packet that satisfies a flow condition having a flow interval of packets for the flow of the incoming packet;
- sampling each incoming packet that satisfies a global condition having a global interval of packets irrespective of the flow of the incoming packet;
- and
- storing any sampled packets or information indicative of any sampled packets.
A method comprising:
- receiving, by a network device, a plurality of incoming packets of a plurality of flows over a computer network;
- setting an output rate of sampled packets for the network device;
- for each incoming packet of the plurality of incoming packets:
- detecting a flow to which each incoming packet belongs, the flow associated with a flow interval of packets having a number of packets corresponding to a sum of a number of all distinct flows of the plurality of flows in a global interval of packets divided by the output rate, and the global interval of packets has a number of packets that corresponds to an inverse of the output rate;
- sampling each incoming packet for a flow when there is no other packet in the flow interval of the incoming packet that has been sampled;
- sampling each incoming packet for a flow when there is no other packet in the global interval that has been sampled;
- outputting any sampled packet to another network device;
- and
- dropping any incoming packet that has not been sampled.
A network device comprising:
- an ingress port configured to receive a plurality of packets of a plurality of flows from a plurality of sources over at least one network;
- an egress port configured to output each sampled packet of the plurality of packets to another network device in accordance with an output rate;
- a sampler configured to:
- sample each packet that satisfies a flow condition having a flow interval of packets of a flow to which the packet belongs, the number of packets in the flow interval corresponding to a sum of a number of all distinct flows of the plurality of flows in a global interval of packets divided by the output rate;
- and
- sample each packet that satisfies a global condition having the global interval of packets corresponding to an inverse of the output rate.
Dependencies are inferred from the claim text.