Methods, systems, and computer readable media for processing network flow metadata at a network packet broker

A method for network flow metadata processing at a network packet broker, the method comprising:

• receiving, as input at a network port of the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch;
• accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata;
• processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule;
• and
• forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein receiving the network flow metadata includes receiving a single network flow metadata record, identifying a network flow metadata processing rule includes identifying a network flow metadata replication rule to apply to the single network flow metadata record, processing the network flow metadata record includes replicating the single network flow metadata record, and forwarding the egress network flow metadata includes forwarding at least two copies of the single network flow metadata record to at least two different network tools.

A method for network flow metadata processing at a network packet broker, the method comprising:

• receiving, as input at a network port of the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch;
• accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata;
• processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule;
• and
• forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein receiving the network flow metadata includes receiving an encrypted network flow metadata record, identifying the network flow metadata processing rule includes identifying a network flow metadata decryption, processing, and re-encryption rule to apply to the network flow metadata, processing the network flow metadata includes decrypting the network flow metadata record a decryption key obtained via a secure backchannel interface to produce a decrypted network metadata record, performing at least one operation on the decrypted network flow metadata record, re-encrypting the decrypted network flow metadata record to produce a re-encrypted network flow metadata record, and forwarding the egress network flow metadata includes forwarding the re-encrypted network metadata flow record to the network tool.

A method for network flow metadata processing at a network packet broker, the method comprising:

• receiving, as input at a network port of the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch;
• accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata;
• processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule;
• and
• forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, receiving packet copies and network flow log data, wherein identifying a network flow metadata processing rule includes identifying a network flow metadata aggregation rule to apply to the network flow metadata, the packet copies, and the network flow log data, wherein processing the network flow metadata includes aggregating the network flow metadata with at least one of the packet copies and the network flow log data to create an aggregated network flow metadata record, and wherein forwarding the egress network flow metadata includes forwarding the aggregated network flow metadata record to the network tool.

A system for network flow metadata processing, the system comprising:

• a network packet broker including a network port, at least one processor and a memory, the network port for receiving network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch;
• a network flow metadata processing rules database stored in the memory and containing rules for processing network flow metadata;
• and
• a network flow metadata processing engine implemented by the at least one processor for accessing the network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata, for processing the network flow metadata using the network flow metadata processing rule, and for forwarding, based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein the network flow metadata processing engine is configured to receive at least two copies of the same network flow metadata record, identify a network flow metadata deduplication processing rule to apply to the at least two copies of the same network flow metadata record, perform deduplication processing of the at least two copies of the same network flow metadata record, and forward a single copy of the same network flow metadata processing record to a single tool port.

A system for network flow metadata processing, the system comprising:

• a network packet broker including a network port, at least one processor and a memory, the network port for receiving network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch;
• a network flow metadata processing rules database stored in the memory and containing rules for processing network flow metadata;
• and
• a network flow metadata processing engine implemented by the at least one processor for accessing the network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata, for processing the network flow metadata using the network flow metadata processing rule, and for forwarding, based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein the network flow metadata processing engine is configured to receive a single network flow metadata record, identify a network flow metadata replication rule to apply to the single network flow metadata record, replicate the single network flow metadata record, and forward at least two copies of the single network flow metadata record to at least two different network tools.

A system for network flow metadata processing, the system comprising:

• a network packet broker including a network port, at least one processor and a memory, the network port for receiving network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch;
• a network flow metadata processing rules database stored in the memory and containing rules for processing network flow metadata;
• and
• a network flow metadata processing engine implemented by the at least one processor for accessing the network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata, for processing the network flow metadata using the network flow metadata processing rule, and for forwarding, based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein the network flow metadata processing engine is configured to receive an encrypted network flow metadata record, identify a network flow metadata decryption, processing, and re-encryption rule to apply to the network flow metadata, decrypt the network flow metadata record a decryption key obtained via a secure backchannel interface to produce a decrypted network metadata record, perform at least one operation on the decrypted network flow metadata record, re-encrypt the decrypted network flow metadata record to produce a re-encrypted network flow metadata record, and forward the re-encrypted network metadata flow record to the network tool.

A system for network flow metadata processing, the system comprising:

• a network packet broker including a network port, at least one processor and a memory, the network port for receiving network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch;
• a network flow metadata processing rules database stored in the memory and containing rules for processing network flow metadata;
• and
• a network flow metadata processing engine implemented by the at least one processor for accessing the network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata, for processing the network flow metadata using the network flow metadata processing rule, and for forwarding, based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein the network flow metadata processing engine is configured to receive packet copies and network flow log data, identify a network flow metadata aggregation rule to apply to the network flow metadata, the packet copies, and the network flow log data, aggregate the network flow metadata with at least one of the packet copies and the network flow log data to create an aggregated network flow metadata record, and forward the aggregated network flow metadata record to the network tool.

A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:

• receiving, as input at a network port of a network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch;
• accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata;
• processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule;
• and
• forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein receiving the network flow metadata includes receiving at least two copies of the same network flow metadata record, identifying a network flow metadata processing rule includes identifying a network flow metadata deduplication processing rule to apply to the at least two copies of the same network flow metadata record, processing the network flow metadata includes performing deduplication processing of the at least two copies of the same network flow metadata record, and forwarding the egress network flow metadata includes forwarding a single copy of the same network flow metadata processing record to a single tool port.