Network traffic monitoring
AssigneeHewlett-Packard Development Company, L.P.
InventorShaun C. Wackerly
Life of this patent
Estimating the term…
Abstract
Systems, methods, and devices are described that monitor network traffic. One method includes monitoring a number of packets received by a network device based on a number of criteria to determine a flow of the packets. For each monitored packet for a particular source IP address/destination IP address pair, the method includes hashing a destination TCP/UDP port number into a range [0 . . . N]. The method further includes setting a bit in a bit field that has a width of N+1 bits based on the hashing.
Claims20
A method of monitoring network traffic, comprising:
- monitoring a number of packets received by a network device based on a number of criteria to determine a flow of the packets;
- for each monitored packet, for a particular flow, hashing a destination TCP/UDP port number into a range [0 . . . N] based on the particular flow, wherein N is a number of ports being monitored;
- setting a bit in a bit field that has a width of N+1, wherein a location of the bit set in the bit field is based upon the hashed destination TCP/UDP port number;
- and
- rate limiting network traffic associated with the particular source IP address and the particular destination IP address pair, once all the bits in the bit field have been set.
A network device, comprising:
- a processor;
- a memory in communication with the processor;
- a network chip having a number of network ports for the device, the network chip including logic to execute instructions and having access to the processor and memory;
- and
- wherein the instructions are executed to:
- selectively monitor network traffic in-line with a network path;
- for selectively monitored network traffic, for a particular source IP address and a particular destination IP address pair, hash the destination TCP/UDP port number into a range [0 . . . N], wherein N is a number of ports being monitored;
- set a bit in a bit field that has a width of N+1, wherein a location of the bit set in the bit field is based upon the hashed destination TCP/UDP port number;
- and
- rate limit network traffic associated with the particular source IP address and the particular destination IP address pair, once all the bits in the bit field have been set.
A network monitoring system, comprising:
- a network device including a processor coupled to a memory and a network chip having a number of network ports for the device, the network chip including logic to execute instructions and having access to the processor and memory, and wherein the instructions are executed to:
- monitor a number of packets received by a network device based on a number of criteria to determine an IP flow of the packets;
- for each monitored packet, for a particular source IP address and a particular destination IP address pair, hash a destination TCP/UDP port number (DP) into a range [0 . . . N], wherein N is a number of ports being monitored;
- and
- set a bit in a bit field that has a width of N+1, wherein a location of the bit set in the bit field is based upon the hashed destination TCP/UDP port number;
- and
- a network management station (NMS) networked with the network device, the NMS including a memory coupled to a processor, and computer executable instructions stored in memory and executable by the processor to execute a remedial action once all of the bits in the bit field have been set.
Dependencies are inferred from the claim text.