US 8,427,966 B2 · Programmable passive probe

Abstract

A configurable probe takes advantage of inter-dependent probe control elements that pass data control signals from one controelement to the other for controlling data extraction. The control elements operate in parallel on one word at a time, based upon a state established by one of the control elements. The data to be considered is established by timing offsets dependant upon packet header lengths, and a function to be performed on the data is controlled by individual control units based upon template information individual to each control element. The probe is agnostic about protocols. It operates on stream of packet words and executes its functions according to defined templates. It is the host that controls the probe and determines what protocol header to parse and how. The controlling host instructs the probe via defined templates that act as state machine definitions what to do and when.

Claims22

Dependent claims

A method of monitoring a communication network, the method comprising:

sending instructional templates via the network to a probe inserted at a data access point in said network, said templates for storage at said probe for a period of time, each said template stored at said probe in association with a particular one of various probe control elements of said probe, said control elements comprising a packet header parser, a packet filter and a packet data extractor;
each said template defining when to execute a function and defining a location of data in a data stream for said control elements to execute said function on, said control elements acting in parallel with each other and in dependent fashion upon each other;
wherein said templates comprise at least a packet header parser template, a packet filter template and a packet data extractor template;
and
receiving information from said probe, said received information resulting from a function executed on particular data by said probe, said data passing by said data access point, said data function and a location of said data being in accordance with said information contained in said templates.

2 more elements

A method of monitoring a communication network, the method comprising:

causing a probe inserted at a data access point in said network to process data passing said data access point, said processing comprising:
determining, by a packet header parser, what a next packet header will be, when the current packet header will end, and a next state of said packet data parser at a beginning of a next packet header, said state being dependent upon said determined next packet header, said determining based upon data contained in a first template temporarily stored at the probe and associated with said packet header parser;
passing said determined next packet header's starting point as an offset, and said next state of said packet data parser, to at least one data control element;
determining, by the packet header parser, a match to retrieve one or more packet filter values, and in response to said match, filtering selected data, said selected data being selected based upon a template data contained in a second template temporarily stored at the probe and associated with a packet filter control element;
and
extracting selected data from said data access point in real time by at least one data extraction element under control of said at least one data control element, said selected data being selected based upon template data contained in a third template temporarily stored at the probe and associated with each said data extraction element in combination with said passed determined next packet header, said header's starting point as an offset, and said next state of said packet data parser.

3 more elements

A hardware probe, comprising:

a packet header parser configured to employ a temporary packet header parser template received by the probe from a device external to the probe, and further configured to determine whether there is a match between at least one characteristic pertaining to data passing an access point to which the probe is attached in a network and information included in the temporary packet header parser template, and when the match is determined, to produce a packet header parser output signal indicating the match;
and
at least one packet filter, each packet filter being configured to employ a temporary packet filter template associated with the packet filter and received by the probe from the device external to the probe, and further being configured, in response to the packet header parser output signal indicating the match to retrieve one or more packet filter values from the associated temporary packet filter template and to use the retrieved one or more packet filter values to process data passing the data access point for which the packet data parser determined the match, and further configured in response to said processing to generate a commit signal indicating whether at least a portion of the data passing the data access point for which the packet data parser determined the match should be saved;
and
at last one packet data extractor, each packet data extractor being configured to employ a temporary packet data extractor template associated with the packet data extractor and received by the probe from the device external to the probe, and further configured, in response to the packet header parser output signal indicating the match and further in response to the commit signal, to extract and save at least the portion of the data passing the data access point for which the packet data parser determined the match and for which the at least one packet filter generated the commit signal.

2 more elements

Dependencies are inferred from the claim text.

Programmable passive probe

Life of this patent

Programmable passive probe

Life of this patent

Abstract

Claims22