# US 8,542,681 B2 · Method and system for simplified network wide traffic and/or flow monitoring in a data network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,542,681 B2
- Document ID: US8542681B2
- Status: Granted
- Kind: B2
- Application number: 12/883,531
- Filed: 2010-09-16
- Published: 2011-01-13
- Granted: 2013-09-24
- Earliest claimed: 2006-02-13
- Assignees: Cisco Technology, Inc.
- Applicants: Robert Andrews; Navindra Yadav; Shree Murthy; Gnanaprakasam Pandian
- Inventors: Robert Andrews; Navindra Yadav; Shree Murthy; Gnanaprakasam Pandian
- Web page: https://patentgrep.com/patent/US8542681B2

## CPC

- H04L 12/4675: {Dynamic sharing of VLAN information amongst network nodes (configuration of the network or of network elements H04L41/08)}
- H04L 12/4695: {VTP [VLAN trunking protocol]}
- H04L 41/0816: the condition being an adaptation, e.g. in response to network events
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Method and system for providing dynamic network data traffic monitoring including monitoring a data network, detecting a change in the data network, initiating a span session based on the detected change in the data network, and dynamically modifying network configuration based on the detected change in the data network is disclosed.

## Claims

### Claim 1

A method of providing dynamic network data traffic monitoring, comprising:
transmitting a request to access a data network for a source to be monitored, the request to access the data network indicating that the source has migrated in the data network to become coupled to a network device;
receiving, responsive to the request to access the data network, information associated with a Virtual Local Area Network (VLAN) that has been automatically allocated for a Switched Port Analyzer (SPAN) session corresponding to the request to access the data network, the VLAN allocated for the SPAN session coupling the source and a destination that performs monitoring; and
sending, by a network device, a copy of traffic to and from the source to the destination in the SPAN session, wherein the allocated VLAN carries the copy of the traffic sent to the destination in the SPAN session.

### Claim 2 (depends on 1)

The method of claim 1 wherein the step of receiving information associated with the VLAN includes the step of receiving a SPAN source information and a SPAN destination information.

### Claim 3 (depends on 2)

The method of claim 2 further including the step of storing the SPAN source information and the SPAN destination information.

### Claim 4 (depends on 1)

The method of claim 1 further comprising:
receiving information associated with a VLAN trunking protocol (VTP) configuration for the SPAN session.

### Claim 5 (depends on 4)

The method of claim 4 further comprising:
configuring the VLAN to support a remote SPAN (RSPAN) session.

### Claim 6 (depends on 1)

The method of claim 1 further comprising:
enabling a SPAN tunneling in the data network for the SPAN source and destination.

### Claim 7 (depends on 6)

The method of claim 6 wherein the enabling the SPAN tunneling includes:
informing a tunnel source end-point and a tunnel destination end-point of the VLAN.

### Claim 8

A system comprising:
a network device coupled to a data network; and
a controller unit coupled to the data network, the controller unit configured to:
detect a migration of a client terminal in the data network to become coupled to the network device;
in response to the detection of the migration of the client terminal, automatically initiate a Switched Port Analyzer (SPAN) session for monitoring the client terminal, the SPAN session coupling the network device to a destination that performs monitoring;
automatically allocate a Virtual Local Area Network (VLAN) for the SPAN session;
enable the network device to send a copy of traffic to and from the client terminal to the allocated VLAN; and
configure the data network to deliver the copy of traffic on the allocated VLAN to the destination that performs monitoring.

### Claim 9 (depends on 8)

The system of claim 8 wherein the controller unit includes a memory, and the controller unit is further configured to store SPAN source and SPAN destination information in the memory.

### Claim 10 (depends on 9)

The system of claim 9 wherein the controller unit is further configured to utilize a VLAN trunking protocol (VTP) to configure the data network to deliver the copy of traffic to the destination that performs monitoring.

### Claim 11 (depends on 10)

The system of claim 10 wherein the controller unit is further configured to utilize the allocated VLAN to support a remote SPAN (RSPAN) session.

### Claim 12 (depends on 8)

The system of claim 8 wherein the controller unit is further configured to enable a SPAN tunneling in the data network for the network device and the destination that performs monitoring.

### Claim 13 (depends on 12)

The system of claim 12 wherein the controller unit is further configured to inform a tunnel source end-point and a tunnel destination end-point of the VLAN.

### Claim 14 (depends on 13)

The system of claim 13 wherein the tunnel source end-point is the network device.

### Claim 15

A method comprising:
detecting a migration of a source to be monitored in a data network such that the source becomes coupled to a network device;
in response to detecting the migration of the source, automatically initiating a Switched Port Analyzer (SPAN) session for monitoring the source, the SPAN session coupling the network device to a destination that performs monitoring;
automatically allocating a Virtual Local Area Network (VLAN) for the SPAN session, the VLAN to carry a copy of traffic to and from the source that is provided to the destination that performs monitoring; and
configuring the data network to deliver the copy of traffic on the allocated VLAN to the destination that performs monitoring.

### Claim 16 (depends on 15)

The method of claim 15 wherein the step of automatically initiating further comprises providing a SPAN source and SPAN destination to the network device.

### Claim 17 (depends on 15)

The method of claim 15 further comprising:
utilizing a VLAN trunking protocol (VTP) to configure the data network to deliver the copy of traffic to the destination that performs monitoring.

### Claim 18 (depends on 15)

The method of claim 15 wherein the SPAN session is a remote SPAN (RSPAN) session.

### Claim 19 (depends on 15)

The method of claim 15, further comprising:
identifying the source to be monitored by a source handle and the destination that performs monitoring by a destination handle, wherein the source handle and the destination handle each indicate at least a port, a Media Access Control (MAC) address or a user name.