Network packet de-duplication
AssigneeExtraHop Networks, Inc.
InventorsEric Joseph Hammerle, Jesse Abraham Rothstein, Michael Kerber Krause Montague
Life of this patent
Estimating the term…
Abstract
Embodiments are directed to monitoring network traffic over a network. A monitoring engine may monitor flows of network packets in the network. The monitoring engine may determine an observation port that provided the network packets. The monitoring engine may determine primary network packets provided by an authoritative observation port based on which observation port provided the network packets and provide them to an analysis engine. The monitoring engine may discard a remainder of the network packets that may be associated with non-authoritative observation ports. The analysis engine may analyze the one or more primary network packets.
Claims30
A method for monitoring network traffic over a network, wherein one or more processors in one or more network monitoring computers (NMCs) execute instructions to perform actions, comprising:
- employ a monitoring engine to perform further actions, including:
- monitoring one or more flows of network packets based on one or more network packets;
- determining an observation port that is providing the network packets based on one or more characteristics of the network packets and one or more characteristics of the observation port;
- determining one or more primary network packets that are provided by an authoritative observation port based on the observation port that provided the network packets, wherein the one or more primary network packets are provided to an analysis engine;
- discarding a remainder of the network packets that are associated with non-authoritative observation ports;
- and
- employing the analysis engine to analyze the one or more primary network packets.
A system for monitoring network traffic over a network between one or more computers comprising:
- one or more network monitoring computers (NMCs), comprising:
- a transceiver that communicates over the network;
- a memory that stores at least instructions;
- and
- one or more processors that execute instructions that perform actions, including:
- employ a monitoring engine to perform further actions, including:
- monitoring one or more flows of network packets based on one or more network packets;
- determining an observation port that is providing the network packets based on one or more characteristics of the network packets and one or more characteristics of the observation port;
- determining one or more primary network packets that are provided by an authoritative observation port based on the observation port that provided the network packets, wherein the one or more primary network packets are provided to an analysis engine;
- discarding a remainder of the network packets that are associated with non-authoritative observation ports;
- and
- employing the analysis engine to analyze the one or more primary network packets;
- the one or more computers, comprising:
- a transceiver that communicates over the network;
- a memory that stores at least instructions;
- and
- one or more processors that execute instructions that perform actions, including:
- providing the one or more flows of network packets.
A processor readable non-transitory storage media that includes instructions for monitoring network traffic over a network between one or more computers, wherein execution of the instructions by one or more processors on one or more network monitoring computers (NMCs) performs actions, comprising:
- employ a monitoring engine to perform further actions, including:
- monitoring one or more flows of network packets based on one or more network packets;
- determining an observation port that is providing the network packets based on one or more characteristics of the network packets and one or more characteristics of the observation port;
- determining one or more primary network packets that are provided by an authoritative observation port based on the observation port that provided the network packets, wherein the one or more primary network packets are provided to an analysis engine;
- discarding a remainder of the network packets that are associated with non-authoritative observation ports;
- and
- employing the analysis engine to analyze the one or more primary network packets.
A network monitoring computer (NMC) for monitoring network traffic over a network, comprising:
- a transceiver that communicates over the network;
- a memory that stores at least instructions;
- and
- one or more processors that execute instructions that perform actions, including:
- employ a monitoring engine to perform further actions, including:
- monitoring one or more flows of network packets based on one or more network packets;
- determining an observation port that is providing the network packets based on one or more characteristics of the network packets and one or more characteristics of the observation port;
- determining one or more primary network packets that are provided by an authoritative observation port based on the observation port that provided the network packets, wherein the one or more primary network packets are provided to an analysis engine;
- discarding a remainder of the network packets that are associated with non-authoritative observation ports;
- and
- employing the analysis engine to analyze the one or more primary network packets.
Dependencies are inferred from the claim text.