# US 8,751,450 B1 · Method and system for securely capturing workloads at a live network for replaying at a test network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,751,450 B1
- Document ID: US8751450B1
- Status: Granted
- Kind: B1
- Application number: 13/095,740
- Filed: 2011-04-27
- Granted: 2014-06-10
- Earliest claimed: 2011-04-27
- Assignees: NetApp, Inc.
- Applicants: Shravan Gaonkar; Shankar Pasupathy; Kiran Srinivasan; Prashanth Radhakrishnan; Garth Goodson; Scott Dawkins
- Inventors: Shravan Gaonkar; Shankar Pasupathy; Kiran Srinivasan; Prashanth Radhakrishnan; Garth Goodson; Scott Dawkins
- Web page: https://patentgrep.com/patent/US8751450B1

## CPC

- H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- G06F 11/30: Monitoring
- G06F 11/3414: {Workload generation, e.g. scripts, playback}
- G06F 11/3495: {for systems}
- G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L 43/50: Testing arrangements
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods and system for securely capturing workloads at a live network for replaying at a test network. The disclosed system captures file system states and workloads of a live server at the live network. In one embodiment the captured data is anonymized to protect confidentiality of the data. A file system of a test server at the test network is mirrored from a captured state of the live server. An anonymized version of the captured workloads is replayed as a request to the test server. A lost or incomplete command is recreated from the states of the live server. An order of the commands during replay can be based on an order in the captured workload, or based on a causal relationship. Performance characteristics of the live network are determined based on the response to the replayed command.

## Claims

### Claim 1

A computer-readable memory storing instructions computer-executable instructions, comprising:
instructions for capturing real-time data of a first processing system on a first network, wherein the real-time data includes a command having a payload, and wherein the capturing is performed independently of a storage protocol used to send the command via the first network;
instructions for modifying the payload such that an original content of the payload cannot be identified from the modified payload;
instructions for generating replay traffic based on a live network traffic of the first network, wherein a portion of the replay traffic includes the command and the modified payload; and
instructions for sending the replay traffic including the command and the modified payload to a second network so that the second network can replay the command and the modified payload, wherein a second processing system of the second network has a file system configured based on an initial state of a first processing system of the first network;
instructions for evaluating a performance characteristic of the first processing system of the first network based on a response of the second network to the replay traffic.

### Claim 2 (depends on 1)

The computer-readable memory of claim 1, wherein to perform the capturing of the real-time data independently of the storage protocol is to capture the real-time data irrespective of a type of storage protocol used to send the command via the first network, and wherein a type of storage protocol is selected from a group of storage protocols consisting of Fiber Channel, CIFS and iSCSI.

### Claim 3 (depends on 1)

The computer-readable memory of claim 1, wherein the first network is a live network, the second network is a test network, and the capturing is performed in such a manner that the first processing system has no knowledge of the capturing of the real-time data.

### Claim 4 (depends on 3)

The computer-readable memory of claim 3, wherein the capturing is performed by using port mirroring.

### Claim 5 (depends on 1)

The computer-readable memory of claim 1, further comprising:
instructions for determining an initial state of the first processing system, wherein the initial state includes a copy of an original dataset of the first processing system at a time before the capturing of the real-time data; and
instructions for determining a final state of the first processing system, wherein the final state includes a copy of a final dataset of the first processing system at a time after the capturing of the real-time data.

### Claim 6 (depends on 5)

The computer-readable storage of claim 5, wherein the instructions further comprise:
instructions for determining a missing or corrupted data in the final state by comparing the final dataset of the final state with the original dataset of the initial state; and
instructions for recreating the missing or corrupted data based on a portion of the original dataset of the initial state.

### Claim 7 (depends on 5)

The computer-readable memory of claim 5, further comprising instructions for modifying a portion of the copy of the original dataset.

### Claim 8 (depends on 7)

The computer-readable memory of claim 7, wherein the portion of the copy of the original dataset is modified by using a hashing algorithm.

### Claim 9 (depends on 7)

The computer-readable memory of claim 7, further comprising instructions for maintaining a mapping between data in the original dataset and the modified portion of the copy of the original dataset.

### Claim 10 (depends on 5)

The computer-readable memory of claim 5, wherein the initial dataset and the final dataset include meta data associated with a respective first and second datasets of the first processing system.

### Claim 11 (depends on 10)

The computer-readable memory of claim 10, wherein the meta data is selected from a group consisting of a create time, a size, and a last access time.

### Claim 12 (depends on 10)

The computer-readable memory of claim 10, wherein the meta data includes a data block layout used by the first processing system to store the datasets.

### Claim 13 (depends on 1)

The computer-readable memory of claim 1, wherein the second network has a processing system having a file system created based on the first processing system, and wherein the file system of the processing system at the second network utilizes a data block layout used by the first processing system.

### Claim 14 (depends on 13)

The computer-readable memory of claim 13, wherein the file system of the second processing system is created from a mirror image of a file system of the first processing system.

### Claim 15 (depends on 1)

The computer-readable memory of claim 1, further comprising instructions for verifying a response of a second processing system to a replayed command captured from the real-time data by comparing the response of the second processing system to a response determined from the captured real-time data of the first processing system.

### Claim 16

A method comprising:
determining an initial state and a final state of a first networked processing system on a live network, wherein the initial state includes a copy of an original dataset from the first processing system;
modifying a portion of data in the initial state such that an original content of the portion of data cannot be identified from the modified portion of data;
capturing live network traffic associated with the first networked processing system, wherein the live network traffic includes an original command, and the original command includes a payload having a copy of a portion of the data in the original dataset;
modifying the payload of the command of the live network traffic such that an original content of the payload cannot be identified from the modified payload;
generating replay traffic based on the live network traffic of the first networked system, wherein a portion of the replay traffic includes the original command including the modified payload;
sending the replay traffic to a second networked processing system at a test network to simulate the live network traffic of the first networked processing system, wherein the second networked processing system has a file system configured based on the initial state of the first networked processing system; and
determining a performance characteristic of the first networked processing system based on a response of the second networked processing system to the replay traffic.

### Claim 17 (depends on 16)

The method of claim 16, further comprising maintaining a mapping between data in the original dataset and the data in the initial state, and wherein sending the replay traffic further includes sending the original command after a response to a previously sent original command is received from the second networked processing system.

### Claim 18 (depends on 16)

The method of claim 16, wherein sending the replay traffic further includes sending the original command in identical order to an order that the original command was captured relative to another original command at the live network.

### Claim 19 (depends on 18)

The method of claim 18, wherein the original command of the replay traffic is sent at a time based on a time stamp associated with the capture of the original command at the live network.

### Claim 20 (depends on 16)

The method of claim 16, wherein generating replay traffic further includes determining an incomplete or missing original command from the captured live network traffic and creating a replacement for the incomplete or missing original command, based on the data in the initial state and the final state of the first networked processing system.

### Claim 21 (depends on 16)

The method of claim 16, further comprising verifying a degree of accuracy of the replay by comparing the final state of the first processing system to a final state of the second networked processing system.

### Claim 22 (depends on 16)

The method of claim 16, wherein data in the initial state includes meta data, and wherein the final state is determined after the capturing of the live network traffic.

### Claim 23 (depends on 17)

The method of claim 17, wherein the meta data includes a data block layout used by the first processing system to store the original dataset.

### Claim 24

A processing system configured to capture real-time data at a first network to use at a second network for determining a performance characteristic of the first network, the processing system comprising:
a processor;
a capture module configured to, when executed by the processor, collect the real-time data of a first processing system on the first network, wherein the real-time data includes a command having payload data, wherein the capture module determines an initial and final state of the first processing system, and wherein the capture module operates independently of a storage protocol used by the command;
a data security module configured to, when executed by the processor, generate hashed values of the payload data, the initial state and the final state, wherein an original content of the payload data cannot be identified from the hashed value of the payload data;
a replay module configured to simulate the real-time data of the first processing system by sending the command for delivery to a second processing system at the second network to cause the second network to simulate a live network traffic of the first network using the command, the command having a hashed value of the payload data; and
an analysis module configured to, when executed by the processor, determine a performance characteristic of the first processing system on the first network, based on a response of the second processing system of the second network to the command for delivery to the second processing system.

### Claim 25 (depends on 24)

The processing system of claim 24, further comprising determining the performance characteristic of the first network based on a response of the second processing system to the command.

### Claim 26 (depends on 24)

The system of claim 24, wherein the initial state includes a copy of a portion of the payload data and associated meta data stored by the first processing system at a time before the collection of the real-time data, and wherein the final state includes a copy of data and associated meta data stored by the first processing system at a time after the collection of the real-time data.

### Claim 27 (depends on 26)

The system of claim 26, wherein the second processing system has a file system created from the initial state of the first processing system.

### Claim 28 (depends on 24)

The system of claim 24, wherein a response of the second processing system to the command sent by the replay module is verified by comparing the response of the second processing system with a response determined from the collected real-time data of the first processing system.

### Claim 29 (depends on 24)

The system of claim 24, wherein the replay module verifies an accuracy of the simulated real-time data sent for delivery to the second processing system by comparing the final state of the first processing system to a final state of the second processing system.

### Claim 30 (depends on 29)

The system of claim 29, wherein verifying the accuracy of the simulated real-time data includes determining an incomplete or missing original command and creating a replacement command for the incomplete or missing original command, based on data of the initial state and the final state of the first networked processing system.

### Claim 31 (depends on 24)

The system of claim 24, wherein the performance characteristic of the first processing system on the first network indicates that a file being requested multiple times by a client of the first processing system causes a degradation of performance of the first processing system, and wherein the performance can be improved by a cache system within the first network having the file.