Policy-based sampling of network flows at a network visibility node
AssigneeGigamon Inc.
InventorSrinivasa MOMMILETI
Life of this patent
Estimating the term…
Abstract
Methods and systems are disclosed for analyzing control signaling messages over a network to inform policy-based sampling of network flows using a network visibility node communicatively coupled to the network. In an illustrative embodiment, session dialog information is extracted from control signaling messages exchanged between subscriber devices initiating a communications session and tracked. A network flow associated with the communications session is selected for sampling at the network visibility node based on the tracked session dialog information. Packets associated with the network flow are then forwarded by the network visibility node to an external tool for processing.
Claims30
A method comprising:
- receiving a plurality of packets at a network visibility node communicatively coupled to a network, the plurality of packets including control packets and data packets, the control packets including control signaling messages;
- processing, by the network visibility node, the control packets to determine, based on the control signaling messages, a parameter of a network flow associated with the plurality of packets;
- and
- forwarding, by the network visibility node, the plurality of packets to an egress port of the network visibility node when the determined parameter of the network flow satisfies a sampling criterion, the egress port communicatively coupled to an external tool that is not an intended destination of the packets associated with the network flow.
An apparatus comprising:
- a plurality of network ports through which to communicate on a network;
- a plurality of tool ports through which to communicate with external tools;
- and
- a processing unit communicatively coupled to the plurality of network ports and the plurality of tool ports, the processing unit configured to:
- receive a plurality of packets via one or more of the plurality of network ports, the plurality of packets including control packets and data packets, the control packets including control signaling messages between subscriber devices communicating over the network;
- process the control packets to determine, based on the control signaling messages, a parameter of a network flow associated with the plurality of packets;
- and
- forward the plurality of packets to one or more of the plurality of tool ports when the determined parameter of the network flow satisfies a sampling criterion, the one or more tool ports communicatively coupled to external tools that are not an intended destination of the plurality of packets.
An apparatus comprising:
- a network port through which to communicate on a network;
- a tool port through which to communicate with an external tool;
- and
- a processing unit communicatively coupled to the network port and the tool port, the processing unit configured to:
- track session dialog information included in an exchange of control signaling messages between subscriber devices over the network;
- select a network flow associated with the exchange of control signaling messages for sampling based on the tracked session dialog information;
- receive a packet via the network port;
- determine whether the packet is associated with the network flow selected for sampling;
- and
- forward the packet to the tool port if the packet is associated with the network flow, wherein the external tool is not an intended destination of the packet.
Dependencies are inferred from the claim text.