Traffic mirroring in a hybrid network environment

Abstract

The present disclosure describes various methods, systems, and devices related to mirrored traffic forwarding in a hybrid network. An example method includes receiving a mirrored data packet from a source forwarder in a source network. A session of the mirrored data packet can be identified based on a header of the mirrored data packet. A destination forwarder in a destination network can be identified based on the session. The destination network can be different from the source network. The mirrored data packet can be forwarded to the destination forwarder.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This patent application claims priority to U.S. Patent Application No. 16 / 863,713 filed on April 30, 2020, which claims priority to U.S. Provisional Patent Application No. 62 / 959,751 filed on January 10, 2020, the contents of each of which are incorporated herein by reference in their entirety. Technical Field

[0003] The present disclosure generally relates to forwarding and / or analyzing mirrored data traffic in a hybrid network environment (eg, a hybrid cloud environment). Background Art

[0004] Businesses, hospitals, schools, and other organizations utilize a variety of computing resources to store and / or process data. Traditionally, organizations use computing resources in data centers that are physically located locally to the organization (i.e., "local data centers"). However, because the needs of an organization change over time, changing computing resources in a data center can be expensive or burdensome.

[0005] To alleviate these and other burdens, organizations can use a portion of the pooled computing resources provided by cloud computing providers. These computing resources can be allocated to organizations on demand. For example, an organization utilizes a portion of cloud computing resources in a data center managed by a cloud computing provider. These data centers can be interconnected in the cloud computing provider's proprietary communication network. Therefore, as the needs of an organization change over time, different amounts of cloud computing resources can be allocated to the organization as needed, without the need for the organization's local data center to host cloud computing resources.

[0006] Although cloud computing can provide many advantages to organizations, cloud computing environments can also present many unique challenges to organizations. Specifically, organizations can utilize computing resources managed by multiple cloud computing service providers in a hybrid network environment. However, these service providers may not be able to communicate with each other. For example, a local traffic mirroring service in one cloud provider network may not be able to forward mirrored traffic to another service in another cloud provider network. Therefore, it can be a challenge to coordinate cloud computing resources distributed in a hybrid network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The following detailed description is made with reference to the accompanying drawings. In the figures, the leftmost (one or more) digits of a reference number identify the figure in which the reference number first appears. The use of the same reference numerals in different figures indicates similar or identical items. The systems depicted in the drawings are not drawn to scale, and the components in the figures may be depicted as not drawn to scale with each other.

[0008] Figure 1 An example environment for transmitting mirrored data packets between different networks is illustrated.

[0009] Figure 2 An example environment for transmitting data packets in a mirrored traffic forwarding session is illustrated.

[0010] Figure 3 An example of encapsulating mirrored data packets is illustrated.

[0011] Figure 4 The diagram illustrates an interconnected hybrid network environment.

[0012] Figure 5 An example process for forwarding mirrored data traffic in a hybrid network environment is illustrated.

[0013] Figure 6 Illustrated is an example process for forwarding mirrored data traffic outside a network.

[0014] Figure 7 An example computer architecture is shown for a computer capable of executing a number of program components for implementing the functionality described herein. DETAILED DESCRIPTION

[0015] Overview

[0016] The present disclosure describes various techniques for forwarding mirrored traffic in a hybrid network environment. An example method includes: receiving a mirrored data packet from a source forwarder in a source network; identifying a session of the mirrored data packet based on a header of the mirrored data packet; identifying a destination forwarder in a destination network based on the session, the destination network being different from the source network; and forwarding the mirrored data packet to the destination forwarder. In some examples, the source forwarder includes a first virtual machine (VM), a first container, or a first program hosted in a resource of the source network, and the destination forwarder includes a second VM, a second container, or a second program hosted in a resource of the destination network. In various embodiments, the mirrored data packet includes an encapsulated remote switched port analyzer (ERSPAN) data packet encapsulated in a generic routing encapsulation (GRE), and the header includes an ERSPAN header of the mirrored data packet. In some instances, the mirrored data packet includes a copy of an original data packet sent or received by at least one node in the source network, the original data packet conforming to one or more traffic mirroring rules. In some cases, the destination forwarder forwards the mirrored data packet to a traffic analyzer service in the destination network. According to some embodiments, identifying the session includes extracting a session identifier (ID) from a header of the mirrored data packet. In various examples, the source network includes a first cloud-based network and the destination network includes a second cloud-based network.

[0017] An example system includes: at least one processor; and a memory storing instructions that, when executed by the at least one processor, cause the system to perform operations. In various instances, the operations include: receiving a mirrored data packet from a source forwarder in a cloud-based source network; identifying a session of the mirrored data packet based on a header of the mirrored data packet; identifying a destination forwarder in a cloud-based destination network based on an entry corresponding to the session in a data repository, the cloud-based destination network being different from the cloud-based source network; and forwarding the mirrored data packet to the destination forwarder.

[0018] According to various embodiments, an example system includes a forwarder in a first cloud-based network and a controller connected to the first cloud-based network. The forwarder includes: at least one first processor; and a first memory, the first memory storing a first instruction, the first instruction when executed by the at least one first processor causes the forwarder to perform a first operation. The first operation includes: receiving a mirrored data packet from a source in the first cloud-based network; converting the mirrored data packet from a first format to a second format; encapsulating the mirrored data packet; and sending the mirrored data packet to the controller. In multiple examples, the controller includes: at least one second processor; and a second memory, the second memory storing a table and second instructions, the second instructions when executed by the at least one second processor cause the controller to perform a second operation. The second operation includes: receiving a mirrored data packet from a source forwarder; identifying a session of the mirrored data packet based on a header of the mirrored data packet; identifying a destination forwarder in a second cloud-based network based on an entry in the table corresponding to the session, the second cloud-based network being different from the first cloud-based network; and forwarding the mirrored data packet to the destination forwarder.

[0019] Example Embodiments

[0020] Various embodiments of the present disclosure relate to forwarding mirrored data traffic between multiple networks in a hybrid network environment. In various examples, a controller may be connected to multiple networks, and the controller may not be able to forward mirrored traffic between designated forwarders in each network in the hybrid network environment.

[0021] Various embodiments described herein provide specific improvements to the field of computer networks. For example, various embodiments can be used to enable data traffic in one network to be analyzed and / or load balanced in the other network even when the network and the other network are managed by different vendors and / or may use incompatible communication protocols. Thus, various embodiments described herein can improve the interoperability of different networks (e.g., different cloud networks managed by different cloud providers) in a hybrid network environment.

[0022] Various implementations of the present disclosure will be described in detail with reference to the accompanying drawings, wherein like reference numerals represent like parts and components throughout all of the accompanying drawings. In addition, any samples recorded in this specification are not intended to be limiting, but only record a portion of many possible implementations.

[0023] Figure 1 An example environment 100 for transmitting mirrored data packets between different networks is illustrated. As shown, environment 100 includes a source network 102. Source network 102 can be a cloud-based network. As used herein, the terms "cloud-based network", "cloud network", "service provider network" and their equivalents can refer to a collection of networked computing resources that can be dynamically supplied and allocated to users, clients or other devices based on requirements or needs. As used herein, computing resources can include memory resources, processing resources, applications, services, or virtual machines (VMs), etc. In a cloud-based network, resources can be distributed on one or more physical devices (e.g., servers), which can be located in different towers, buildings, data centers, or geographic regions, etc.

[0024] The source network 102 may include various nodes. As used herein, the terms "node", "network node" and their equivalents may refer to any entity in a network that is capable of sending data packets to at least one other node and / or receiving data packets from at least one other node. A node may be a device, a software instance, or a VM, etc. In some examples, a node may be a client, a server, or a combination thereof. The various nodes within a cloud-based network may be interconnected via a secure communication network over which data traffic may be exchanged. For example, the source network 102 may include a secure communication network over which data traffic may be exchanged between the various nodes in the source network 102.

[0025] In various embodiments, source 104 may be a node in source network 102. In various embodiments, source 104 may include a software instance and / or VM hosted by a computing resource in source network 102. Source 104 may include one or more interfaces (e.g., (one or more) virtual interfaces) through which source 104 receives and / or sends data traffic 106. Data traffic 106 may include a plurality of data packets being transmitted between source 104 and one or more other nodes (e.g., other nodes in source network 102). As used herein, the terms "packet", "data packet" and their equivalents may refer to a unit of data transmitted between two nodes. In various examples, a packet may have: a header, which may include control data; and a payload, which may include additional data carried in the packet. The header may include, for example, the following information: an identifier of the source of the packet, an identifier of the destination of the packet, an indication of the type of user data in the payload, etc. In some cases, a data packet may be defined by, for example, a specific network protocol: Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or other network protocols.

[0026] Source 104 may be associated with at least one user and / or at least one account. The account may enable a user to remotely (e.g., from a computing device 108 external to source network 102) control and / or manage the operation of source 104. For example, source network 102 may provide an application programming interface (API) through which (one or more) users may control and / or manage the operation of source 104. In some cases, (one or more) users may desire to monitor, analyze, or otherwise inspect data traffic 106. For example, (one or more) users may generate a VM within source network 102 that intercepts, copies, and / or forwards data traffic 106 to computing device 108 or some other entity. However, directly intercepting data traffic 106 may introduce unacceptable delays in the communication and / or operation of source 104.

[0027] In various embodiments, the data traffic 106 may be mirrored for further inspection. As used herein, the term "traffic mirroring" may refer to a process by which one or more data packets sent and / or received by a first node are copied and sent to a second node (e.g., for further processing). In some cases, a subset of the data traffic 106 may be mirrored according to a filter that specifies one or more traffic mirroring rules. Any data packets in the data traffic 106 that comply with one or more traffic mirroring rules may be mirrored, and any data packets in the data traffic 106 that do not comply with one or more traffic mirroring rules may not be mirrored. One or more traffic mirroring rules may specify, for example, at least one of the following: whether a data packet is associated with a specific interface (e.g., a port or a network interface, etc.), whether a data packet is associated with a specific virtual local area network (VLAN), whether a data packet is associated with a specific subnet, and the like. For example, the term "port mirroring" may refer to a process by which a data packet sent and / or received by a port is copied and sent to another port (e.g., in a different node). As used herein, the term "port" and its equivalents may refer to a component of a node that is configured to connect the rest of the node to an interface (e.g., a network interface controller (NIC)). A node may have a fixed set of ports that may be selectively connected to a specific interface. Each port of a node may have a unique identifier that may be represented by a port number. As used herein, the term "entrance port," "ingress port," and its equivalents may refer to a port through which a packet enters a node. As used herein, the term "egress port," "exit port," and their equivalents may refer to a port through which a packet leaves a node.

[0028] In various examples, a user may initiate mirroring of data traffic 106 by causing computing device 108 to send a request for traffic mirroring to source 104. The request may include one or more data packets transmitted through source network 102. In some cases, the request may specify at least one condition under which a type of data traffic 106 is to be mirrored. Thus, in some examples, only a portion of data traffic 106 may be mirrored. Source 104 may generate mirrored traffic 110 based on data traffic 106. Mirrored traffic 110 may include one or more data packets copied from data packets in data traffic 106.

[0029] According to various embodiments, the user(s) associated with the source 104 may seek to analyze the mirrored traffic 110 in the destination 112 (included in the destination network 114). The destination network 114 may be different from the source network 102. For example, the destination network 114 may be a cloud-based network external to the source network 102. In some cases, the destination network 114 may be a first region in the cloud-based network, and the source network 102 may be a second region in the cloud-based network, where the first region is different from the second region.

[0030] Destination 112 may be a node in destination network 114. In some cases, destination network 114 is also a cloud-based network, and destination 112 may be hosted by computing resources in destination network 114. In some cases, destination 112 may be a traffic analyzer. Destination 112 may be used by the user(s) to analyze mirrored traffic 110 for any of a variety of reasons. For example, destination 112 may be a local traffic analyzer associated with destination network 114, and the user(s) may want to test the efficacy of destination 112 as a traffic analyzer. For example, the traffic analyzer may perform application-specific processing on mirrored traffic 110 (e.g., applying one or more security policies, or analyzing content (e.g., video processing), etc.). In some cases, source network 102 may have an associated traffic analyzer, but it may not be as good as the traffic analyzer included in destination 112. In some cases, the traffic analyzer included in destination 112 may be hosted in destination network 114, rather than source network 102, to save resources of source network 102. In some cases, destination 112 may be a load balancer. For example, destination 112 may be configured to forward data traffic to one or more additional nodes in destination network 114 according to a particular load balancing protocol.

[0031] However, in various embodiments, source 104 may not be able to directly forward mirrored data traffic 110 to destination 112. Source 104 may not be able to directly exchange data packets with nodes in destination network 114, and / or destination 112 may not be able to directly exchange data packets with nodes in source network 102. For example, service providers of source network 102 and / or destination network 114 may restrict and / or prevent cross-region traffic mirroring. For example, IP addresses of nodes in source network 102 may be abstracted from communications associated with source network 102. In some cases, source network 102 and destination network 114 may each use different proprietary communication protocols, such that data packets transmitted by nodes in source network 102 cannot be understood by nodes in destination network 114, and vice versa.

[0032] The controller 116 may be connected to the source network 102 and the destination network 114 and may enable communication between the energy network 102 and the destination network 114. In various embodiments, the controller 116 may be configured to control and / or manage a network infrastructure that includes at least one node in the source network 102 and at least one node in the destination network 114. For example, the controller 116 may be a service defined network (SDN) controller. In some cases, the controller 116 may be embodied in a physical device (e.g., a server) located in the same place as the computing device 108 (e.g., in a local data center). In some embodiments, the controller 116 may be embodied in a resource of the source network 102 or a resource of the destination network 114. In various cases, the controller 116 may be connected to the computing device 108. The computing device 108 may send a forwarding request 118 to the controller 116. The forwarding request 118 may include a request to mirror the data traffic 106 and / or a request to forward the mirrored traffic 110 to the destination 112. In various embodiments, the forwarding request 118 may be (or include) a session configuration that identifies a forwarding session between the requested source 104 and the destination 112. The forwarding request 118 may include at least one data packet. In response to receiving the forwarding request 118, the controller 116 may instruct the source 104 to forward the mirrored traffic 110 to the source forwarder 120 in the source network 102. As used herein, the term "forwarder" and its equivalents may refer to a network node (e.g., at least one of a process, a container, a VM, a virtual private cloud (VPC), a virtual private network (VPN), etc.) in a network that is configured to forward data traffic between another node in the network (e.g., a source node or a destination node) and an entity (e.g., a controller) outside the network. The controller 116 may be connected to the source forwarder 120 in the source network 102. For example, the controller 116 may be connected to the source forwarder 120 via a VPN. In various embodiments, the source forwarder 120 is a node in the source network 102.

[0033] In various embodiments, in response to receiving the forwarding request 118, the controller 116 may identify that the destination 112 (which may be specified in the forwarding request 118) is located in a different network than the source 104. That is, the controller 116 may identify that the destination 112 is in the destination network 114 and the source 104 is in the source network 102. In response to identifying that the source 104 and the destination 112 are in different networks, the controller 116 may generate an entry in the session data store 124 that corresponds to the session requested by the forwarding request 118 and includes the transmission of the mirrored traffic 110 from the source 104 to the destination 112. As used herein, the terms "session", "flow", "data flow", "traffic flow", "packet flow" and their equivalents may refer to a plurality of packets sent from a source to a destination. In some examples, a session may include multiple packets that share at least one of the following: the same ingress interface (e.g., SNMP ifIndex), source (e.g., from the same IP address), destination (e.g., directed to the same IP address), protocol (e.g., IP protocol), source port (e.g., for UDP or TCP), destination port (e.g., for UDP, TCP, or ICMP), or service type (e.g., IP type of service (ToS)). A session that includes mirrored traffic 110 forwarded from source 104 to destination 112 may be referred to as a "mirrored traffic forwarding session." In particular embodiments, the entry may include an identifier of the mirrored traffic forwarding session, which may be referred to as a "session identifier" or "session ID." In some cases, the entry may include at least one of the following: an identifier of source 104 (e.g., IP address), an identifier (e.g., IP address of destination 112), an identifier of source forwarder 120 (e.g., IP address), an identifier of destination forwarder 126 (e.g., IP address), or quality of service (QoS) of the mirrored traffic forwarding session. For example, the QoS of the mirrored traffic forwarding session may be a low priority QoS. In some cases, the entry may be stored in a hash table in the session data store 124. In various implementations where multiple entries are stored in the session data store 124, the entries may be indexed according to the session identifier.

[0034] In various embodiments, the controller 116 may send an indication of the mirrored traffic forwarding session to the source forwarder 120, such as at least a portion of the data in an entry of the session data repository 124. For example, the controller 116 may send a session identifier and / or a send indication to the source forwarder 120 indicating that data packets in the mirrored traffic forwarding session should be sent by the source forwarder 120 to the controller 116. The source forwarder 120 may store the indication of the mirrored traffic forwarding session in a data repository (e.g., in a routing table). In addition, the controller 116 may send an indication of the mirrored traffic forwarding session to the destination forwarder 126 (e.g., at least a portion of the data in an entry of the session data repository 124). For example, the controller 116 may send a session identifier and / or a send indication to the destination forwarder 126 indicating that data packets in the mirrored traffic forwarding session should be sent by the destination forwarder to the destination 112. The destination forwarder may store the indication of the mirrored traffic forwarding session in a data repository (e.g., in a routing table).

[0035] According to various embodiments, source 104 may forward mirrored traffic 110 to source forwarder 120. For example, source forwarder 120 may be defined as a destination for mirrored traffic 110 in a local traffic mirroring service associated with source network 102. Upon receiving mirrored traffic 110, source forwarder 120 may identify a session identifier using an indication stored at source forwarder 120 (e.g., in a routing table). Thus, source forwarder 120 may determine to forward mirrored traffic 110 to controller 116. In various embodiments, source forwarder 120 may encapsulate mirrored traffic 110 to generate encapsulated traffic 122. For example, source forwarder 120 may encapsulate at least one data packet in mirrored traffic 110 according to a generic routing encapsulation (GRE) protocol.

[0036] In various embodiments, the source forwarder 120 may convert at least one data packet in the mirrored traffic 110 into a standardized format before encapsulation. In some cases, the mirrored traffic 110 may be in accordance with a network protocol (e.g., a proprietary communication protocol) associated with the source network 102. According to various embodiments, the source forwarder 120 may use a library such as Libpcap, Libnet, or IPtables to convert the mirrored traffic 110 into a standardized format. For example, the source forwarder 120 may use Libpcap to capture, filter, and manipulate raw mirrored data packets within the mirrored traffic. For example, the source forwarder 120 may use Libnet to perform packet construction and injection. In some cases, the source forwarder 120 may use IPtables to inspect and change packets. Libpcap, Libnet, and IPtables are example utilities that the source forwarder 120 may use, and in various embodiments of the present disclosure, the source forwarder 120 may use other utilities and / or techniques to convert the mirrored traffic 110. In some cases, the standardized format includes an encapsulated remote switched port analyzer (ERSPAN) format. In some cases, the source forwarder 120 may add a session identifier to the ERSPAN header of the encapsulated traffic 122.

[0037] The ERSPAN packet format is associated with a specific header format that includes various elements. For example, the ERSPAN header may include an Ethernet frame with one or more type-length-value (TLV) variables to convey information about the forwarding session, such as at least one of the following: the type of data packet (e.g., request or reply); system timestamp; frame sequence number; source ERSPAN session information (e.g., session number, description, and configuration); source device information (e.g., device name, device location, and operating system version); source and destination device addresses (e.g., IP addresses); platform-specific TLVs; cryptographic checksum TLVs (e.g., cryptographically based secure hash algorithm (SHA)-1 or SHA-256 checksums), etc. In various examples, the session number specified in the ERSPAN header may be used as a session identifier. In addition, the span session between the source 104 and the destination 112 (or between the source forwarder 120 and the destination forwarder 126) may be further defined based on one or more TLV variables in the ERSPAN header.

[0038] Source forwarder 120 may send encapsulated traffic 122 out of source network 102 and to controller 116. In various embodiments, controller 116 may identify that encapsulated traffic 122 should be forwarded to destination network 114 and / or destination 112. For example, controller 116 may extract a session identifier from encapsulated traffic 122 and use the session identifier to identify an entry corresponding to a mirrored traffic forwarding session in session data store 124. For example, controller 116 may identify the session identifier in encapsulated traffic 122 based on the entry, identify an entry in the session data store corresponding to the session identifier, and may identify that encapsulated traffic 122 should be forwarded to destination forwarder 126 in destination network 114. For example, controller 116 may identify that encapsulated traffic 122 is to be sent to destination 112 and may forward encapsulated traffic 122 to destination 112. Accordingly, controller 116 may send encapsulated traffic 122 to destination forwarder 126.

[0039] In various embodiments, the destination forwarder 126 may be a node in the destination network 114. After receiving the encapsulated traffic 122 from the controller 116, the destination forwarder 126 may identify that the encapsulated traffic 122 is part of a mirrored traffic forwarding session that should be forwarded to the destination 112. For example, the destination forwarder 126 may identify a session identifier in the encapsulated traffic 122 and may use the session identifier to identify an entry in a routing table corresponding to the mirrored traffic forwarding session, wherein the entry may identify that data packets in the session should be forwarded to the destination 112. Accordingly, the destination forwarder 126 may forward the mirrored traffic 110 to the destination 112 based on the encapsulated traffic 122. For example, the destination forwarder 126 may decapsulate the encapsulated traffic 122 and / or convert the mirrored traffic 110 into a communication format associated with the destination 112 and / or the destination network 114. For example, the destination forwarder 126 may use at least one of Libpcap, Libnet, or IPtables to convert the encapsulated traffic 122 into the mirrored traffic 110, wherein the mirrored traffic 110 may have a format acceptable to the destination 112. Thus, the destination 112 may be configured to process the mirrored traffic 110 even if the mirrored traffic 110 generated by the source 104 is originally in a format that is unacceptable to the destination 112 .

[0040] After receiving mirrored traffic 110, destination 112 can perform various operations based on mirrored traffic 110. For example, destination 112 can analyze mirrored traffic 110 and / or generate one or more analysis reports that can be sent to and / or displayed on computing device 108. In some examples, destination 112 can include a load balancer that can forward mirrored traffic 110 to one or more other nodes in destination network 114.

[0041] In various embodiments, the mirrored traffic 110 can be forwarded along a path through different networks (source network 102 and destination network 114), regardless of whether these different networks use different network protocols within their respective communication networks. As used herein, the terms "path", "network path" and their equivalents can refer to a specific sequence of nodes and / or interfaces that a packet can pass through. A path can be defined between two nodes. In some cases, the path for a packet to be transmitted from a first node to a second node can be defined based on an identifier of a first node, an identifier of a second node, and any sequence of intermediate nodes and / or interfaces through which the packet travels from the first node to the second node. The mirrored traffic 110 can be forwarded between the source network 102 and the destination network 114 by a controller 116.

[0042] Now refer to Figure 1 An illustrative example is described with reference to example environment 100 of . In this example, an organization may be hosting a video game service using various resources in source network 102 and destination network 114. However, the organization may suspect that latency associated with the video game service is becoming a problem. For example, the organization may have received complaints from users indicating that the users noticed a delay between when the user instructed a video game character to move in the video game service and when the video game character moved in a display of a device associated with the user. Therefore, the organization may seek to determine whether the abnormal traffic at the video game service is due to abnormal data traffic at the video game service. The organization may be associated with a dedicated analyzer service that is capable of analyzing data traffic. However, the analyzer service may be located in a different network than the video game service. Reference Figure 1 , the video game service may be the source 104 and the analyzer service may be the destination 112 .

[0043] To enable the analyzer service to analyze data traffic at the video game service, an individual in the organization may instruct the controller 116 to establish a traffic mirroring session from the source 104 to the destination 112. For example, the individual may use the computing device 108 to send a forwarding request 118 to the controller 116, which in turn may establish an entry corresponding to the traffic mirroring session in the session data repository 124. The controller 116 may also instruct the source forwarder 120 and the destination forwarder 126 to send packets in the session from the source 104 to the destination 112. The controller 116 may also instruct the video game service at the source 104 to generate the mirrored traffic 110. The mirrored traffic 110 may include a copy of one or more data packets sent and / or received by the video game service.

[0044] According to various embodiments described herein, mirrored traffic 110 including mirrored data packets from a video game service may be sent to an analyzer service at a destination 112. Upon receiving the mirrored traffic 110, the analyzer engine may analyze the mirrored traffic 110. For example, the analyzer engine may identify that the source 104 is receiving an abnormal amount of data traffic from a suspicious IP address. The analyzer engine may indicate the suspicious IP address to the organization (e.g., in a report displayed at the computing device 108). As a result, an individual in the organization (e.g., an administrator) may update a firewall policy for the source 104 that blocks traffic from the suspicious IP address. These and other advantages may be achieved even when the source 104 and the destination 112 are located in different networks associated with different communication protocols.

[0045] Figure 2 An example environment 200 for transmitting data packets in a mirrored traffic forwarding session is illustrated. The environment 200 includes the above reference Figure 1 Mirrored traffic 110, controller 116, source forwarder 120, encapsulated traffic 122, session data repository 124, and destination forwarder 126 are depicted.

[0046] As shown, mirrored traffic 110 is received by source forwarder 120. Source forwarder 120 can identify that mirrored traffic 110 is part of a particular mirrored traffic forwarding session. For example, source forwarder 120 can reference routing table 202 that includes session identifier 204 of the mirrored traffic forwarding session. In some cases, routing table 202 further identifies that mirrored traffic 110 should be forwarded to controller 116. For example, routing table 202 can include controller identifier 206, which can identify controller 116. In some cases, controller identifier 206 includes an IP address of controller 116.

[0047] The source forwarder 120 can convert the mirrored traffic 110 from a first format (e.g., a first communication protocol) into a standardized format and encapsulate it. In various embodiments, the source forwarder 120 can encapsulate the mirrored traffic 110 to generate encapsulated traffic 122. According to various examples, the source forwarder 120 can generate the encapsulated traffic 122 to include the session identifier 204. The source forwarder 120 can send the encapsulated traffic 122 to the node specified by the controller identifier 206 (i.e., the controller 116).

[0048] In various cases, the controller 116 may be responsible for managing multiple mirrored traffic forwarding sessions, which may be specified in respective entries of the session data repository 124. Each entry may specify a session identifier for the session, a destination for the session, and / or a quality of service (QoS) for the session. Figure 2 As shown, the session data repository 124 may include n entries corresponding to n mirrored traffic forwarding sessions. The n entries include session identifiers 1 to n, destination addresses 1 to n, and a QoS indication as "low priority." Due to the QoS associated with different mirrored traffic forwarding sessions, the controller 116 may reduce the priority of data packets in the mirrored traffic forwarding session to a lower level than other types of data packets (e.g., other types of control and / or data plane data packets) transmitted through the controller 116.

[0049] Upon receiving the encapsulated traffic 122, the controller 116 may use the session identifier 204 in the encapsulated traffic 122 to identify an entry in the session data store 124 that corresponds to the encapsulated traffic 122. The controller 116 may therefore use the entry to identify the destination of the encapsulated traffic 122. In some cases, the entry may specify an address (e.g., an IP address) of the final destination of the data packets in the session (e.g., the destination 112) and / or an address (e.g., an IP address) of the destination forwarder 126. Thus, the controller 116 may identify the destination forwarder 126 based on the session data store 124.

[0050] Although not shown, the controller 116 can use the session data repository 124 to identify the destination forwarder 126 among a plurality of destination forwarders (associated with one or more other networks). For example, the session ID 204 in the encapsulated traffic 122 can be "ID 1", and the address of the destination forwarder 126 can be "Address 1" (as indicated in the session data repository 124). However, the session ID associated with a different mirrored traffic forwarding session can be "ID 2" and can include a different destination forwarder associated with "Address 2" (not shown). Accordingly, even though the controller 116 may be connected to other destination forwarders, the controller can refrain from forwarding the encapsulated traffic 122 to any destination forwarder other than the destination forwarder 126 (which is associated with the particular mirrored traffic forwarding session that includes the encapsulated traffic 122).

[0051] The controller 116 can send the encapsulated traffic 122 to the destination forwarder 126. The destination forwarder 126 can identify the mirrored traffic forwarding session based on the session identifier 204 in the encapsulated traffic 122. In various embodiments, the destination forwarder 126 can store the session identifier 204 with a destination identifier 210, which can identify the destination of the data packets in the mirrored traffic forwarding session (e.g., the destination 112). The destination forwarder 126 can decapsulate the encapsulated traffic 122 to recover the mirrored traffic 110. In some embodiments, the destination forwarder 126 can convert the mirrored traffic 110 from a standardized format to a second format suitable for the destination and / or destination network. Therefore, the destination forwarder 126 can send the mirrored traffic 110 to the destination in a format suitable for the destination.

[0052] Figure 3 An example of encapsulating mirrored data packets is shown. In various embodiments, the encapsulated packets may be included in the encapsulated traffic (e.g., Figure 1 and Figure 2 As shown, encapsulated data packet 300 may include ERSPAN packet 302. ERSPAN packet 302 may include session identifier 204. In various embodiments, ERSPAN packet 302 may include data from one or more mirrored data packets. Encapsulated data packet 300 may also include GRE encapsulation 304 surrounding ERSPAN packet 302. Thus, encapsulated data packet 300 may be a GRE encapsulation that may be transmitted by a forwarder (e.g., as described above with reference to FIG. 2 ). Figure 1 and Figure 2 The source forwarder 120 and / or the destination forwarder 126 described above) and the controller (e.g., Figure 1 and Figure 2A standardized format for analysis by the controller 116 described herein.

[0053] Figure 4 The diagram shows an interconnected hybrid network environment 400. As shown in the figure, the environment 400 includes the above reference Figure 1 and Figure 2 Controller 116 described. Controller 116 can be connected to multiple networks, including a first network 402-1, a second network 402-2, a third network 402-3, and a fourth network 402-4. Each of networks 402-1 to 402-4 can be a cloud-based network or a different region within a cloud-based network. A region can be defined as one or more data centers arranged in different geographic regions, which different geographic regions include multiple availability zones. For example, each of networks 402-1 to 402-4 may include a different internal communication network that is securely isolated from other networks in networks 402-1 to 402-4. In some cases, one of networks 402-1 to 402-4 may be a source network (e.g., referenced above). Figure 1 102 described above), and / or another network among networks 402-1 to 402-4 may be a destination network (e.g., Figure 1 Destination network 114 described).

[0054] In various embodiments, the controller 116 may be configured to control and / or manage a network infrastructure including nodes in the networks 402-1 to 402-4. The controller 116 may be securely connected to the networks 402-1 to 402-4. For example, communications between the controller 116 and any one of the networks 402-1 to 402-4 may be sent through a corresponding VPN. Thus, even though the controller 116 may be outside of some or all of the networks 402-1 to 402-4, the networks 402-1 to 402-4 may remain protected from malicious data traffic.

[0055] Networks 402-1 to 402-4 may include corresponding terminal nodes 404-1 to 404-4. Terminal nodes 404-1 to 404-4 may include sources and / or terminals of various mirrored traffic forwarding sessions. For example, one of terminal nodes 404-1 to 404-4 may be the above referenced Figure 1 The source 104 described above, and another of the terminal nodes 404-1 to 404-4 may be the above reference Figure 1 Describing destination 112. In various cases, terminal nodes 404-1 through 404-4 may generate mirrored data traffic and / or receive mirrored data traffic from other terminal nodes 404-1 through 404-4 (eg, terminal nodes in other networks).

[0056] The networks 402-1 to 402-4 may additionally include respective forwarders 406-1 to 406-4. The forwarders 406-1 to 406-4 may be configured to relay mirrored data traffic between the networks 402-1 to 402-4 and the controller 116. For example, one of the forwarders 406-1 to 406-4 may be the one described above with reference to Figure 1 and Figure 2 Another of the forwarders 406-1 to 406-4 may be the source forwarder 120 described above. Figure 1 and Figure 2 In various embodiments, any one of the forwarders 406-1 through 406-4 may be configured to receive the mirrored data traffic, convert the mirrored data traffic to a standardized format, encapsulate the mirrored data traffic, and forward the mirrored data traffic to the controller 116. In some embodiments, any one of the forwarders 406-1 through 406-4 may be configured to receive the mirrored data traffic, convert the mirrored data traffic to a format appropriate for its corresponding network 402-1 through 402-4, decapsulate the mirrored data traffic, and forward the mirrored data traffic to a corresponding one of the terminal nodes 404-1 through 404-4.

[0057] In various embodiments described herein, the controller 116 and / or forwarders 406-1 to 406-4 may enable mirrored data traffic to be forwarded to various networks 402-1 to 402-4 in the hybrid network environment 400. For example, the controller 116 may establish a session identifier associated with a mirrored traffic forwarding session between a first terminal node 404-1 in the first network 402-1 and a second terminal node 404-2 in the second network 402-2. The controller 116 may store the session identifier in a session data repository (e.g., as described above with reference to FIG. 1 ) along with an indication of the mirrored data traffic. Figure 1 and Figure 2In an entry of a session data repository 124 described in the embodiment of the present invention, the controller 116 may indicate that the data packets in the session are to be forwarded from the first forwarder 406-1 to the second forwarder 406-2. In addition, the controller 116 may instruct the first forwarder 406-1 to forward the data packets in the session from the first terminal node 404-1 to the controller 116, and / or may instruct the second forwarder 406-2 to forward the data packets in the session from the controller 116 to the second terminal node 404-2. The first forwarder 406-1 may forward the data packets in the session to the controller 116 with the specified session identifier. Accordingly, the controller 116 may identify that the packet is in the session from the first terminal node 404-1 to the second terminal node 404-2 based on the session identifier in the data packet. The controller 116 may therefore forward the data packet to the second forwarder 406-2 instead of forwarding it to other forwarders (e.g., the third forwarder 406-3 or the fourth forwarder 406-4) in the environment 400.

[0058] In some cases, the controller 116 can accommodate multiple mirrored traffic forwarding sessions in the environment 400, which can be between any pair of terminals in the terminals 404-1 to 404-4. Each of the multiple sessions can be associated with a separate session identifier, which can be tracked in the data repository of the controller 116. Accordingly, the controller 116 can use the separate session identifiers to appropriately forward data packets in the multiple sessions. In addition, the forwarders 406-1 to 406-4 can use the separate session identifiers to appropriately forward data packets in the multiple sessions.

[0059] Figure 5 An example process 500 for forwarding mirrored data traffic in a hybrid network environment is illustrated. In various embodiments, the process 500 may be performed by a controller (e.g., as described above with reference to Figure 1 and Figure 2 116) entity described herein.

[0060] At 502, an entity may receive a mirrored data packet from a source forwarder in a source network. In various embodiments, the mirrored data packet may be copied from a data packet sent or received by a source node within the source network. The data packet may be sent or received by at least one interface connected to a source node within the source network. In some cases, the source node may generate the mirrored data packet according to a local data traffic mirroring protocol associated with the source network. The source node may forward the mirrored data packet to the source forwarder according to the data traffic mirroring protocol. In some cases, the source node and / or the source forwarder may include at least one virtual machine (VM) that occupies at least one computing resource of the source network. The source network may be, for example, a cloud-based network.

[0061] In various cases, the source forwarder may modify the mirrored data packet before forwarding the mirrored data packet to the entity. For example, the source forwarder may convert the mirrored data packet from a first format (e.g., a format proprietary to the source network) to a second format. In some cases, the source forwarder may encapsulate the mirrored data packet according to an encapsulation protocol. According to some examples, the source forwarder may convert the mirrored data packet to an encapsulated remote switched port analyzer (ERSPAN) data packet encapsulated in a generic routing encapsulation (GRE).

[0062] At 504, the entity may identify a session of the mirrored data packet. In various examples, the session may be a mirrored data traffic forwarding session. According to some examples, the entity may identify the session by extracting a session identifier from the mirrored data packet. In various cases, the session identifier may be within an ERSPAN header of the mirrored data packet.

[0063] At 506, the entity may identify a destination forwarder in a destination network for the mirrored data packet. In various cases, the entity may access a data repository that stores entries associated with various mirrored traffic forwarding sessions managed by the entity. The entries may be indexed by a session identifier. Accordingly, the entity may use the session identifier of the mirrored data packet to extract an entry associated with the mirrored data packet. The entry may also indicate a destination forwarder. For example, the entry may indicate an address (e.g., an IP address) of the destination forwarder.

[0064] At 508, the entity may forward the mirrored data packet to a destination forwarder. The destination forwarder may be part of a destination network. In some cases, the destination forwarder may decapsulate the mirrored data packet. According to some examples, the destination forwarder may convert the mirrored data packet from a second format to a third format (e.g., a format that is proprietary to the destination network). The destination forwarder may forward the mirrored data packet to a destination node within the destination network. In some cases, the destination node may be a traffic analyzer configured to analyze the mirrored data packet using one or more rules. In some cases, the destination node may be a load balancer configured to forward the mirrored data packet to another node within the destination network according to a load balancing protocol. In some cases, the destination node and / or the destination forwarder may include at least one VM that occupies at least one computing resource of the destination network. The destination network may be, for example, a cloud-based network.

[0065] In various examples, the source network may be different from the destination network. For example, the source network may be a first region in a cloud-based network, and the destination network may be a second region in the cloud-based network. In some cases, the source network may be a first cloud-based network, and the destination network may be a second cloud-based network. Accordingly, process 500 may enable traffic mirroring in a hybrid network environment.

[0066] Figure 6 An example process 600 for forwarding mirrored data traffic outside a network is illustrated. In various embodiments, the process 600 may be performed by a forwarder (e.g., as described above with reference to Figure 1 The source forwarder 120 described above and / or referenced Figure 4 An entity of any of the described forwarders 406-1 to 406-4) is executed.

[0067] At 602, an entity may receive a mirrored data packet from a source node in a cloud-based network. In various embodiments, the entity and the source node may be nodes within the network. In some cases, the mirrored data packet may be a first format that is proprietary to the network. In various embodiments, the mirrored data packet may be copied from a data packet sent or received by a source node. Data packets may be sent or received by at least one interface connected to a source node. In some cases, a source node may generate a mirrored data packet based on a local data traffic mirroring protocol associated with the network. The source node may forward the mirrored data packet to a source forwarder based on a data traffic mirroring protocol. In some cases, the source node and / or the source forwarder may include at least one virtual machine (VM) that occupies at least one computing resource of the network. For example, the network may be a cloud-based network.

[0068] According to various embodiments, the mirrored data packet may include a cloud-native mirrored packet header. The entity performing process 600 may identify that the mirrored data packet is to be forwarded to the controller by identifying (e.g., discerning) a packet header of the mirrored data packet. In some cases, the controller may indicate to the entity about a forwarding session associated with the mirrored data packet before process 600 begins. For example, the controller may send an instruction to the entity to perform mirroring, the instruction indicating a packet header of the mirrored data packet. Accordingly, when the entity receives the mirrored data packet, the entity may identify the forwarding session of which the mirrored data packet is to be a part, and may determine to forward the mirrored data packet outside the cloud-based network of the source node. In some cases, the entity may handle (e.g., receive and / or forward) traffic from multiple mirrored sessions associated with a cloud-based network.

[0069] At 604, the entity may encapsulate the mirrored data packet. In some cases, the entity may convert the mirrored data packet from a first format to a second format. For example, the entity may convert the mirrored data packet to an encapsulated remote switched port analyzer (ERSPAN) data packet encapsulated in a generic routing encapsulation (GRE).

[0070] In some cases, the entity may also identify a specific mirrored traffic forwarding session that includes the mirrored data packet. In some cases, the entity may add a session identifier associated with the specific session to the mirrored data packet. For example, the session identifier may be added to an ERSPAN header of the mirrored data packet.

[0071] At 606, the entity may forward the mirrored data packet to a controller outside the network. In various examples, the controller may be a service defined network (SDN) controller connected to multiple networks in a hybrid network environment. The controller may forward the mirrored data packet to another network for further processing.

[0072] Figure 7 An example computer architecture of a server computer 700 capable of executing program components for implementing the functionality described above is shown. Figure 7 The computer architecture shown shows a traditional server computer, workstation, desktop computer, laptop computer, tablet computer, network device, e-reader, smart phone or other computing device, and can be used to execute any software components presented herein.In some examples, server computer 700 can correspond to a network node described herein.

[0073] The computer 700 includes a baseboard 702 or "motherboard," which is a printed circuit board to which multiple components or devices may be connected via a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units ("CPUs") 704 operate in conjunction with a chipset 706. The CPU 704 may be a standard programmable processor that performs the arithmetic and logic operations necessary for the operation of the computer 700.

[0074] The CPU 704 performs operations by operating switching elements to switch from one discrete physical state to the next, and the switching elements distinguish and change these states. Switching elements generally include electronic circuits that maintain one of two binary states, such as flip-flops, and electronic circuits that provide output states based on logical combinations of the states of one or more other switching elements, such as logic gates. These basic switching elements can be combined to create more complex logic circuits, including registers, adder-subtractors, arithmetic logic units, floating point units, etc.

[0075] Chipset 706 provides an interface between CPU 704 and the remaining components and devices on substrate 702. Chipset 706 may provide an interface to RAM 709, which is used as main memory in computer 700. Chipset 706 may further provide an interface to a computer-readable storage medium, such as read-only memory ("ROM") 710 or non-volatile RAM ("NVRAM"), for storing basic programs that help start computer 700 and transfer information between various components and devices. ROM 710 or NVRAM may also store other software components necessary to operate computer 700 according to the configuration described herein.

[0076] The computer 700 can operate in a network environment using logical connections to remote computing devices and computer systems through a network (e.g., network 708). Chipset 706 may include functionality for providing network connectivity through a network interface controller (NIC) 712 (e.g., a Gigabit Ethernet adapter). NIC 712 is capable of connecting the computer 700 to other computing devices through network 708 (or 128). It should be understood that multiple NICs 712 may exist in the computer 700 to connect the computer to other types of networks and remote computer systems. In some cases, NIC 712 may include at least one inlet port and / or at least one outlet port.

[0077] The computer 700 can be connected to a storage device 718 that provides non-volatile storage for the computer. The storage device 718 can store an operating system 720, programs 722, and data, which have been described in more detail herein. The storage device 718 can be connected to the computer 700 via a storage controller 714 connected to the chipset 706. The storage device 718 can be composed of one or more physical storage units. The storage controller 714 can interface with the physical storage unit via a serial attached SCSI ("SAS") interface, a serial advanced technology connection ("SATA") interface, a fiber channel ("FC") interface, or other types of interfaces for physically connecting and transmitting data between the computer and the physical storage unit.

[0078] The computer 700 can store data on the storage device 718 by converting the physical state of the physical storage unit to reflect the information being stored. In different embodiments of the present specification, the specific conversion of the physical state can depend on various factors. Examples of such factors can include, but are not limited to, the technology used to implement the physical storage unit, whether the storage device 718 is characterized as primary or secondary storage, etc.

[0079] For example, the computer 700 can store information to the storage device 718 by issuing instructions through the storage controller 714 to change the magnetic properties of a specific location in a disk drive unit, the reflective or refractive properties of a specific location in an optical storage unit, or the electrical properties of a specific capacitor, transistor or other discrete component in a solid-state storage unit. Other transformations of the physical medium are possible without departing from the scope and spirit of the present description, and the foregoing examples are provided only for the convenience of the present description. The computer 700 can further read information from the storage device 718 by detecting the physical state or properties of one or more specific locations in the physical storage unit.

[0080] In addition to the mass storage device 718 described above, the computer 700 may access other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. It will be appreciated by those skilled in the art that a computer-readable storage medium is any available medium that provides non-transitory storage of data and can be accessed by the computer 700. In some examples, operations performed by a network node (e.g., network node 404), a source (e.g., 202), a destination (e.g., 207), a collector (e.g., 308), or a central administrator (e.g., 312) may be supported by one or more devices similar to the computer 700. In other words, some or all of the operations performed by a network node, a collector, and / or a central administrator may be performed by one or more computer devices 700 operating in a cloud-based arrangement.

[0081] By way of example and not limitation, computer-readable storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media include, but are not limited to, RAM, ROM, erasable programmable ROM ("EPROM"), electrically erasable programmable ROM ("EEPROM"), flash memory or other solid-state storage technology, compact disk ROM ("CD-ROM"), digital versatile disk ("DVD"), high-definition DVD ("HD-DVD"), BLU-RAY or other optical storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information in a non-temporary manner.

[0082] As briefly described above, the storage device 718 may store an operating system 720 for controlling the operation of the computer 700. According to one embodiment, the operating system comprises a LINUX operating system. According to another embodiment, the operating system comprises Microsoft Corporation of Redmond, Washington. SERVER operating system. According to further embodiments, the operating system may include a UNIX operating system or one of its variants. It should be understood that other operating systems may also be used. Storage device 718 may store other systems or applications and data used by computer 700.

[0083] In one embodiment, the storage device 718 or other computer-readable storage medium is encoded with computer-executable instructions that, when loaded into the computer 700, convert the computer from a general-purpose computing system to a special-purpose computer capable of implementing the embodiments described herein. As described above, these computer-executable instructions convert the computer 700 by specifying how the CPU 704 transitions between states. According to one embodiment, the computer 700 can access a computer-readable storage medium storing computer-executable instructions that, when executed by the computer 700, perform the above-described Figure 1-6 The computer 700 may also include a computer-readable storage medium having stored thereon instructions for performing any other computer-implemented operations described herein.

[0084] like Figure 7 As shown, the storage device 718 stores the program 722, as well as the controller 116, the session data repository 124, and / or the forwarder 724 (e.g., as described above with reference to Figure 4 In some implementations, at least one of the controller 116 , the session data repository 124 , or the forwarder 724 may be omitted from the storage device 718 .

[0085] The computer 700 may also include one or more input / output controllers 716 for receiving and processing input from a plurality of input devices, such as a keyboard, a mouse, a touch pad, a touch screen, an electronic stylus, or other types of input devices. Similarly, the input / output controller 716 may provide output to a display, such as a computer monitor, a flat panel display, a digital projector, a printer, or other types of output devices. It should be understood that the computer 700 may not include Figure 7 All components shown in Figure 7 other components explicitly shown in the Figure 7 Completely different architecture as shown.

[0086] In some cases, one or more components may be referred to herein as being "configured to," "configurable to," "operable / operable to," "suitable to / suitable for," "capable of," "conformable / conformable to," etc. Those skilled in the art will recognize that such terms (e.g., "configured to") may generally encompass active state components and / or inactive state components and / or standby state components unless the context requires otherwise.

[0087] As used herein, the term "based on" may be used synonymously with "based at least in part on" and "based at least in part on." As used herein, the terms "including" and "comprising" and their equivalents may be used interchangeably. An apparatus, system, or method "comprising A, B, and C" includes A, B, and C, but may also include other components (e.g., D). That is, the apparatus, system, or method is not limited to components A, B, and C.

[0088] Although the present invention is described with respect to specific embodiments, it should be understood that the scope of the present invention is not limited to these specific embodiments. Since other modifications and changes to suit specific operating requirements and environments will be apparent to those skilled in the art, the present invention is not considered to be limited to the examples selected for disclosure purposes, and all changes and modifications that do not constitute a departure from the true spirit and scope of the present invention are covered.

[0089] Although the present application describes embodiments with specific structural features and / or methodological acts, it should be understood that the claims are not necessarily limited to the specific features or acts described. Rather, the specific features and acts are merely illustrative embodiments falling within the scope of the claims of the present application.

Claims

1. A method for traffic mirroring in a hybrid network environment, comprising: receiving, by the controller, a mirrored data packet from a source forwarder in a source network; The controller identifies a session of the mirrored data packet based on a header of the mirrored data packet; identifying, by the controller, a destination forwarder in a destination network based on an entry corresponding to the session in a session data repository at the controller, the destination network being different from the source network, the destination network using a different communication protocol than the source network, the session data repository including a plurality of entries corresponding to a plurality of mirrored traffic forwarding sessions, wherein each entry stores a session identifier and a destination for a corresponding session; as well as The mirrored data packet is forwarded to the destination forwarder.

2. The method according to claim 1, wherein: The source forwarder includes a first virtual machine (VM), a first container, or a first program hosted in a resource of the source network, and The destination forwarder includes a second VM, a second container, or a second program hosted in a resource of the destination network.

3. The method according to claim 1 or 2, wherein: The mirrored data packets include Encapsulated Remote Switched Port Analyzer (ERSPAN) data packets encapsulated in Generic Routing Encapsulation (GRE), and The header includes an ERSPAN header of the mirrored data packet.

4. The method according to claim 1 or 2, wherein: The mirrored data packet includes a copy of an original data packet sent or received by at least one node in the source network, the original data packet conforming to one or more traffic mirroring rules.

5. The method according to claim 1 or 2, wherein: The destination forwarder forwards the mirrored data packets to a traffic analyzer service in the destination network.

6. The method according to claim 1 or 2, wherein: Identifying the session includes extracting a session identifier (ID) from a header of the mirrored data packet.

7. The method according to claim 1 or 2, wherein: The source network includes a first cloud-based network and the destination network includes a second cloud-based network.

8. A system for traffic mirroring in a hybrid network environment, comprising: at least one processor; as well as A memory storing instructions that, when executed by the at least one processor, cause the system to perform operations including: receiving a mirrored data packet from a source forwarder in a cloud-based source network; Identifying a session of the mirrored data packet based on a header of the mirrored data packet; identifying a destination forwarder in a cloud-based destination network based on an entry corresponding to the session in a session data repository at the system, the cloud-based destination network being different from the cloud-based source network, the cloud-based destination network using a different communication protocol than the cloud-based source network, the session data repository comprising a plurality of entries corresponding to a plurality of mirrored traffic forwarding sessions, wherein each entry stores a session identifier and a destination for a corresponding session; as well as The mirrored data packet is forwarded to the destination forwarder.

9. The system according to claim 8, wherein: The source forwarder includes a first virtual machine (VM) hosted in a resource of the cloud-based source network, and Wherein the destination forwarder comprises a second VM hosted in a resource of the cloud-based destination network.

10. The system according to claim 8 or 9, wherein: The mirrored data packets include Encapsulated Remote Switched Port Analyzer (ERSPAN) data packets encapsulated in Generic Routing Encapsulation (GRE), and The header includes an ERSPAN header of the mirrored data packet.

11. The system according to claim 8 or 9, wherein: The mirrored data packet includes a copy of an original data packet that is sent or received through at least one interface in the cloud-based source network.

12. The system according to claim 8 or 9, wherein: The destination forwarder forwards the mirrored data packets to a traffic analyzer service in the cloud-based destination network.

13. The system according to claim 8 or 9, wherein: Identifying the session includes extracting a session identifier (ID) from a header of the mirrored data packet.

14. The system according to claim 8 or 9, wherein: The system is included in the cloud-based source network or the cloud-based destination network.

15. The system according to claim 8 or 9, wherein: The system is included in a data center, wherein the data center is located external to the cloud-based source network and the cloud-based destination network.

16. A system for traffic mirroring in a hybrid network environment, comprising: A forwarder, in a first cloud-based network, the forwarder comprising: at least one first processor; and A first memory stores a first instruction, which, when executed by the at least one first processor, causes the forwarder to perform a first operation including: receiving a mirrored data packet from a source in the first cloud-based network; converting the mirrored data packets from a first format to a second format; Encapsulating the mirrored data group; and sending the mirrored data packets to a controller; and A controller connected to the first cloud-based network, the controller comprising: at least one second processor; and A second memory stores a table and a second instruction, wherein the second instruction, when executed by the at least one second processor, causes the controller to perform a second operation including: receiving the mirrored data packet from the forwarder; Identifying a session of the mirrored data packet based on a header of the mirrored data packet; identifying a destination forwarder in a second cloud-based network different from the first cloud-based network based on an entry corresponding to the session in a session data repository at the controller, the second cloud-based network being different from the first cloud-based network, the second cloud-based network using a different communication protocol than the first cloud-based network, the session data repository comprising a plurality of entries corresponding to a plurality of mirrored traffic forwarding sessions, wherein each entry stores a session identifier and a destination for the corresponding session; and The mirrored data packet is forwarded to the destination forwarder.

17. The system of claim 16, further comprising: The destination forwarder comprises: at least one third processor; and a third memory storing third instructions, wherein when the third instructions are executed by the at least one third processor, the destination forwarder performs a third operation including: receiving the mirrored data packet from the controller; Decapsulating the mirrored data group; converting the mirrored data packets from the second format to a third format; and The mirrored data packets are sent to a destination in the second cloud-based network.

18. The system of claim 17, wherein: The first operation also includes inserting a session identifier into a header of the mirrored data packet, wherein identifying the session of the mirrored data packet comprises identifying a session identifier in the header, and The third operation further includes identifying the destination based on a session identifier in the header.

19. A system according to any one of claims 16 to 18, wherein: The controller is included in the first cloud-based network or the second cloud-based network.

20. The system according to any one of claims 16 to 18, wherein: The second format comprises an Encapsulated Remote Switched Port Analyzer (ERSPAN) format, and The encapsulating the mirrored data packet includes encapsulating the mirrored data packet in a general routing encapsulation, and the header of the mirrored data packet includes an ERSPAN header of the mirrored data packet.

Images