# US 2021/0243091 A1 · Methods, systems, and computer readable media for processing network flow metadata at a network packet broker > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243091 A1 - Document ID: US20210243091A1 - Status: Published application - Kind: A1 - Application number: 16/781,542 - Filed: 2020-02-04 - Published: 2021-08-05 - Earliest claimed: 2020-02-04 - Assignees: Keysight Technologies, Inc. - Applicants: Keysight Technologies, Inc. - Inventors: Kristopher Len Raney; Jonathan Glenn Stroud; Matthew R. Bergeron; Peter J. Marsico - Web page: https://patentgrep.com/patent/US20210243091A1 ## CPC - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 43/026: using flow identification - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/0811: by checking connectivity - H04L 43/0888: Throughput - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2483: involving identification of individual flows - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for network flow metadata processing at a network packet broker includes, receiving, as input at the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow. The method further includes accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata. The method further includes processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule. The method further includes forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool. ## Claims ### Claim 1 A method for network flow metadata processing at a network packet broker, the method comprising: receiving, as input at a network port of the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata; processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule; and forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein receiving the network flow metadata includes receiving at least two copies of the same network flow metadata record, identifying a network flow metadata processing rule includes identifying a network flow metadata deduplication processing rule to apply to the at least two copies of the same network flow metadata record, processing the network flow metadata includes performing deduplication processing of the at least two copies of the same network flow metadata record, and forwarding the egress network flow metadata includes forwarding a single copy of the same network flow metadata processing record to a single tool port. ### Claim 2 (canceled) ### Claim 3 A method for network flow metadata processing at a network packet broker, the method comprising: receiving, as input at a network port of the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata; processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule; and forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein receiving the network flow metadata includes receiving a single network flow metadata record, identifying a network flow metadata processing rule includes identifying a network flow metadata replication rule to apply to the single network flow metadata record, processing the network flow metadata record includes replicating the single network flow metadata record, and forwarding the egress network flow metadata includes forwarding at least two copies of the single network flow metadata record to at least two different network tools. ### Claim 4 A method for network flow metadata processing at a network packet broker, the method comprising: receiving, as input at a network port of the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata; processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule; and forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein receiving the network flow metadata includes receiving an encrypted network flow metadata record, identifying the network flow metadata processing rule includes identifying a network flow metadata decryption, processing, and re-encryption rule to apply to the network flow metadata, processing the network flow metadata includes decrypting the network flow metadata record a decryption key obtained via a secure backchannel interface to produce a decrypted network metadata record, performing at least one operation on the decrypted network flow metadata record, re-encrypting the decrypted network flow metadata record to produce a re-encrypted network flow metadata record, and forwarding the egress network flow metadata includes forwarding the re-encrypted network metadata flow record to the network tool. ### Claim 5 (depends on 4) The method of claim 4 wherein performing at least one operation on the decrypted network flow metadata record includes performing at least one of: network flow metadata deduplication, replication, aggregation, and format translation processing on the decrypted network flow metadata record. ### Claim 6 A method for network flow metadata processing at a network packet broker, the method comprising: receiving, as input at a network port of the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata; processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule; and forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, receiving packet copies and network flow log data, wherein identifying a network flow metadata processing rule includes identifying a network flow metadata aggregation rule to apply to the network flow metadata, the packet copies, and the network flow log data, wherein processing the network flow metadata includes aggregating the network flow metadata with at least one of the packet copies and the network flow log data to create an aggregated network flow metadata record, and wherein forwarding the egress network flow metadata includes forwarding the aggregated network flow metadata record to the network tool. ### Claim 7 (depends on 1) The method of claim 1 wherein receiving the network flow metadata includes receiving a network flow metadata record formatted according to a first network flow metadata format, identifying the network flow metadata processing rule includes identifying a network flow metadata format translation rule to apply to the network flow metadata record, processing the network flow metadata includes translating a format of the network flow metadata from the first network flow metadata format to a second network flow metadata format different from the first network flow metadata format to produce a translated network flow metadata record, and forwarding the egress network flow metadata includes forwarding the translated network flow metadata record to the network tool. ### Claim 8 (depends on 7) The method of claim 7 wherein the first network flow metadata format comprises a first network flow metadata record format and the second network flow metadata format includes a second network flow metadata record format different from the first network flow metadata record format and wherein translating the format of the network flow metadata includes translating the format of the network flow metadata from the first network flow metadata record format to the second network flow metadata record format. ### Claim 9 (canceled) ### Claim 10 (canceled) ### Claim 11 A system for network flow metadata processing, the system comprising: a network packet broker including a network port, at least one processor and a memory, the network port for receiving network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; a network flow metadata processing rules database stored in the memory and containing rules for processing network flow metadata; and a network flow metadata processing engine implemented by the at least one processor for accessing the network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata, for processing the network flow metadata using the network flow metadata processing rule, and for forwarding, based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein the network flow metadata processing engine is configured to receive at least two copies of the same network flow metadata record, identify a network flow metadata deduplication processing rule to apply to the at least two copies of the same network flow metadata record, perform deduplication processing of the at least two copies of the same network flow metadata record, and forward a single copy of the same network flow metadata processing record to a single tool port. ### Claim 12 (canceled) ### Claim 13 A system for network flow metadata processing, the system comprising: a network packet broker including a network port, at least one processor and a memory, the network port for receiving network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; a network flow metadata processing rules database stored in the memory and containing rules for processing network flow metadata; and a network flow metadata processing engine implemented by the at least one processor for accessing the network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata, for processing the network flow metadata using the network flow metadata processing rule, and for forwarding, based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein the network flow metadata processing engine is configured to receive a single network flow metadata record, identify a network flow metadata replication rule to apply to the single network flow metadata record, replicate the single network flow metadata record, and forward at least two copies of the single network flow metadata record to at least two different network tools. ### Claim 14 A system for network flow metadata processing, the system comprising: a network packet broker including a network port, at least one processor and a memory, the network port for receiving network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; a network flow metadata processing rules database stored in the memory and containing rules for processing network flow metadata; and a network flow metadata processing engine implemented by the at least one processor for accessing the network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata, for processing the network flow metadata using the network flow metadata processing rule, and for forwarding, based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein the network flow metadata processing engine is configured to receive an encrypted network flow metadata record, identify a network flow metadata decryption, processing, and re-encryption rule to apply to the network flow metadata, decrypt the network flow metadata record a decryption key obtained via a secure backchannel interface to produce a decrypted network metadata record, perform at least one operation on the decrypted network flow metadata record, re-encrypt the decrypted network flow metadata record to produce a re-encrypted network flow metadata record, and forward the re-encrypted network metadata flow record to the network tool. ### Claim 15 (depends on 14) The system of claim 14 wherein the network flow metadata processing engine is configured to perform at least one of: network flow metadata deduplication, replication, aggregation, enrichment, and format translation processing on the decrypted network flow metadata record. ### Claim 16 A system for network flow metadata processing, the system comprising: a network packet broker including a network port, at least one processor and a memory, the network port for receiving network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; a network flow metadata processing rules database stored in the memory and containing rules for processing network flow metadata; and a network flow metadata processing engine implemented by the at least one processor for accessing the network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata, for processing the network flow metadata using the network flow metadata processing rule, and for forwarding, based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein the network flow metadata processing engine is configured to receive packet copies and network flow log data, identify a network flow metadata aggregation rule to apply to the network flow metadata, the packet copies, and the network flow log data, aggregate the network flow metadata with at least one of the packet copies and the network flow log data to create an aggregated network flow metadata record, and forward the aggregated network flow metadata record to the network tool. ### Claim 17 (depends on 11) The system of claim 11 wherein the network flow metadata processing engine is configured to receive a network flow metadata record formatted according to a first network flow metadata format, identify a network flow metadata format translation rule to apply to the network flow metadata record, translate a format of the network flow metadata from the first network flow metadata format to a second network flow metadata format different from the first network flow metadata format to produce a translated network flow metadata record, and forward the translated network flow metadata record to the network tool. ### Claim 18 (depends on 17) The system of claim 17 wherein the first network flow metadata format comprises a first network flow metadata record format and the second network flow metadata format includes a second network flow metadata record format wherein the network flow metadata processing engine is configured to translate the network flow metadata from the first network flow metadata record format to the second network flow metadata record format. ### Claim 19 (canceled) ### Claim 20 A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising: receiving, as input at a network port of a network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow, wherein receiving the network flow metadata from a network device includes receiving network flow metadata records from a network tap or a tap or span port on a router or switch; accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata; processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule; and forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool, wherein forwarding the network flow metadata to a network tool includes forwarding the network flow metadata to a network flow metadata collector, wherein receiving the network flow metadata includes receiving at least two copies of the same network flow metadata record, identifying a network flow metadata processing rule includes identifying a network flow metadata deduplication processing rule to apply to the at least two copies of the same network flow metadata record, processing the network flow metadata includes performing deduplication processing of the at least two copies of the same network flow metadata record, and forwarding the egress network flow metadata includes forwarding a single copy of the same network flow metadata processing record to a single tool port.