De-duplicating of packets in flows at layer 3

A network device for monitoring flows of packets over a network, comprising:

• a transceiver device for monitoring communication over the network;
• a memory device for storing at least instructions;
• and
• a processor device that is operative to execute instructions that enable actions, including:
• passively receiving packets communicated over at least one network;
• determining Open Systems Interconnection (OSI) model layer 2 and layer 3 (layer 2-3) information included in each header of each received packet;
• normalizing layer 2-3 information in each header of each received packet;
• if at least a value based on normalized layer 2-3 information for a header of a packet is determined to be equivalent to another value based on normalized layer 2-3 information for another header of another subsequently received packet, determining the other subsequently received packet as duplicative of the packet;
• and
• monitoring at least one flow of received packets, wherein the at least one monitored flow's packets are identified as non-duplicative, and wherein each packet that is determined as duplicative is subsequently processed separate from monitoring the at least one flow of received packets.

A system for monitoring flows of packets over a network, comprising:

• a first network device that includes:
• a transceiver device for monitoring communication over the network;
• a memory device for storing at least instructions;
• and
• a processor device that is operative to execute instructions that enable actions, comprising communicating at least one flow of packets with at least a second network device;
• and
• a third network device that includes:
• a transceiver device for monitoring communication between the first network device and the second network device;
• a memory device for storing at least instructions;
• and
• a processor device that is operative to execute instructions that enable actions, comprising:
• passively receiving packets communicated over at least one network;
• determining Open Systems Interconnection (OSI) model layer 2 and layer 3 (layer 2-3) information included in each header of each received packet;
• normalizing layer 2-3 information in each header of each received packet;
• if at least a value based on normalized layer 2-3 information for a header of a packet is determined to be equivalent to another value based on normalized layer 2-3 information for another header of another subsequently received packet, determining the other subsequently received packet as duplicative of the packet;
• and
• monitoring at least one flow of received packets, wherein the at least one monitored flow's packets are identified as non-duplicative, and wherein each packet that is determined as duplicative is subsequently processed separate from monitoring the at least one flow of received packets.

A processor readable non-transitive storage media that includes instructions for monitoring flows of packets over a network, wherein a network device that executes at least a portion of the instructions enables actions, comprising:

• passively receiving packets communicated over at least one network;
• determining Open Systems Interconnection (OSI) model layer 2 and layer 3 (layer 2-3) information included in each header of each received packet;
• normalizing layer 2-3 information in each header of each received packet;
• if at least a value based on normalized layer 2-3 information for a header of a packet is determined to be equivalent to another value based on normalized layer 3 information for another header of another subsequently received packet, determining the other subsequently received packet as duplicative of the packet;
• and
• monitoring at least one flow of received packets, wherein the at least one monitored flow's packets are identified as non-duplicative, and wherein each packet that is determined as duplicative is subsequently processed separate from monitoring the at least one flow of received packets.