Method to capture packets from applications hosted on containers

Abstract

The present invention describes a method for capturing packets from one or more applications hosted on a container by a packet capture service, the container being connected to one or more network interfaces in a portion of an industrial network. The method includes receiving a capture request for capturing packets associated with a connection of a second container of the one or more containers, determining a network path associated with the connection of the second container; determining the existence of one or more network interfaces in one of a first capture session and a connection between a packet capture service and a packet capture client; and approving the capture request based on the packet capture service and the packet capture client to create a second capture session for capturing packets associated with the connection of the second container.

Description

Technical Field

[0001] The present invention relates to containers in industrial automation. More particularly, the present invention relates to packet capture and analysis of network traffic associated with containers. A packet capture tool (also known as a packet sniffer or packet analyzer) is a program or special hardware that is capable of intercepting and recording packets transmitted in a network. These packets are then used to analyze network behavior to improve network performance. Background Art

[0002] The present invention relates to packet capture and analysis in industrial networks. With the advent of container technology, containers have been deployed in a variety of scenarios, including industrial automation. In addition to numerous physical assets, there are also a large number of virtual assets in automation networks. Because they are container-based, relatively small and flexible, these virtual assets or industrial applications are deployed and executed in large numbers. These industrial applications can run on Industrial Edge in the factory or on industrial OT clusters, where they can still access the production network directly through the network. Therefore, considering the large number of assets (physical assets and virtual assets) in automation networks, it is necessary to perform network analysis to ensure optimal network utilization. In order to perform network analysis, data packets in the network are recorded for analysis. This is done with a packet capture tool. Using a packet capture tool, network traffic within and to and from an Industrial Edge device can be recorded from a remote computer (also called a capture client) and observed and evaluated in real time without delays during the recording process. The data packets are recorded in the industrial device, but are not stored there, but are immediately transmitted to the capture client via a so-called web socket connection for recording and evaluation.

[0003] However, for certain communication problems and paths, it is necessary to record the communication between the application on the industrial device and the automation equipment outside the industrial device, especially at the physical interface of the industrial device, in contrast to recording purely at the virtual network interface of the container associated with the application. The problem, however, is that feedback may occur when recording or transmitting the recorded packets: since the packets are recorded at a certain point in the industrial device network, these packets are then transmitted through this point as a recording stream, feedback occurs. As a result, the recording is severely bloated and not very reliable. Therefore, a capture service is needed that can automatically prevent self-recording. Summary of the invention

[0004] The present invention therefore describes a method according to claim 1 and a device according to claim 11 which solve the above-mentioned problems.

[0005] The present invention describes a method for capturing packets from one or more applications through a packet capture service, the one or more applications being hosted on one or more containers connected to one or more network interfaces in a portion of an industrial network. The packet capture service is connected to a packet capture client for transmitting captured packets to the packet capture client, and includes a first capture session for capturing packets associated with a first container. The method includes receiving a capture request for capturing packets associated with a connection to a second container from one or more containers, wherein the connection is located between the second container and a network destination for transmitting one or more packets; determining a network path associated with the connection to the second container, wherein the network path indicates one or more network interfaces used by packets of the connection from the second container to the network destination; determining the presence of one or more network interfaces in one of the first capture session and the connection between the packet capture service and the packet capture client; and approving the capture request based on the packet capture service and the packet capture client to create a second capture session for capturing packets associated with the connection to the second container.

[0006] Thus, the present invention describes a method for packet capture, wherein incoming capture requests are checked for potential overlaps with respect to network interfaces with existing capture sessions and connections between a packet capture service and a packet capture client. Thus, the method ensures that the risk of self-recording is eliminated.

[0007] In one example, when one or more network interfaces are not present in the first capture session and the connection between the packet capture service and the packet capture client, the capture request is approved. Thus, when there is a possibility of self-recording, the capture request is determined based on the network interface and is not further processed.

[0008] In one example, the method further includes generating a filter associated with a capture request for capturing packets associated with the connection to the second container when at least one of the one or more network interfaces is present in the first capture session and in the connection between the packet capture service and the packet capture client, and wherein the filter includes one or more filter expressions for filtering one or more of packets associated with the first capture session and packets originating from the packet capture service. Thus, despite the potential overlap in the network interfaces, the method avoids the possibility of self-logging by dynamically generating a filter to filter packets associated with the packet capture service from being logged by the packet capture service.

[0009] In one example, approving the capture request includes detecting the presence of a filter associated with one or more network interfaces, wherein the capture request is not approved when the filter is detected. Thus, the method allows for determining whether there is a filter already associated with the network interface, and in the event that such a filter already exists, the new filter may be incompatible.

[0010] In one example, the capture request is transmitted by a packet capture client, and the capture request includes network information associated with the packet capture client. Thus, based on the network information associated with the packet capture client, a determination of a network interface associated with a connection between the packet capture client and the packet capture service is determined. In one example, the capture request includes network information associated with the second container.

[0011] Thus, determining the network path includes determining one or more intermediate network interfaces based on network information associated with the second container and a network topology associated with the portion of the industrial network.

[0012] In one example, the method further determines a first set of network interfaces to be used in a connection between the packet capture service and the packet capture client based on network information of the packet capture client and a network topology associated with a portion of the industrial network. In one example, the one or more intermediate network interfaces belong to at least one reverse proxy device. In one example, the network topology includes IP / TCP address configuration and IP routing information for the one or more containers and the one or more network interfaces.

[0013] In another aspect, the present invention describes a packet capture device for capturing packets from one or more containers connected to one or more network interfaces in a portion of an industrial network. The packet capture device is connected to a packet capture client for transmitting captured packets to the packet capture client, and includes a first capture session for capturing packets associated with a first container. The packet capture device includes: one or more processors configured to receive a capture request for capturing packets associated with a connection to a second container from one or more containers, wherein the connection is located between the second container and a network destination for transmitting one or more packets; determining a network path associated with the connection to the second container, wherein the network path indicates one or more network interfaces used by packets of the connection from the second container to the network destination; determining the presence of one or more network interfaces in one of the first capture session and the connection between the packet capture service and the packet capture client; and approving the capture request based on the presence of one or more network interfaces in one of the first capture session and the connection between the packet capture service and the packet capture client to create a second capture session for capturing packets associated with the connection to the second container. The advantages of the method also apply to the device. In combination with Figures 1 to 3 Explain these aspects further. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A portion of an industrial facility is shown including a packet capture service for capturing packets between two or more applications;

[0015] Figure 2 A method of capturing data packets from one or more containers connected to one or more network interfaces in a portion of an industrial network is shown; and

[0016] Figure 3 A packet capture device for capturing packets from one or more containers connected to one or more network interfaces in a portion of an industrial network is shown. DETAILED DESCRIPTION

[0017] Figure 1A portion of an industrial facility 100 is shown, which includes multiple applications (120, 130 and 140). The industrial facility herein refers to any environment where one or more industrial processes (such as manufacturing, refining, smelting or instrument assembly, power generation, transmission or distribution, transportation) can be performed. This includes processing plants, refineries, automobile plants, power plants, smart grids, substations, warehouses, etc. Multiple industrial processes and operations can be performed in a production unit using a variety of devices (such as control devices, field devices, mobile devices, etc.) that appear with the corresponding production unit. Control devices include process controllers, programmable logic controllers, supervisory controllers, automatic guided vehicles, robots, operator devices, etc. One or more control devices are connected to multiple field devices (not shown in the figure), such as actuators and sensor devices for monitoring and controlling various industrial processes in the industrial facility. These field devices may include flow meters, value actuators, temperature sensors, pressure sensors, etc. In addition, the industrial facility includes multiple mobile devices (also called mobile network devices), including one or more robots for performing multiple operations such as welding, component assembly; one or more automated guided vehicles for transporting and handling materials; one or more assets with RFID tags on conveyors in the industrial facility, etc. In addition, the industrial facility may include an operator station for displaying the status of the industrial facility to the operator and allowing the operator to define KPIs for controlling industrial processes in the facility. All industrial devices can be interconnected through the factory network (implemented through wired and wireless technologies).

[0018] The communication in the above-mentioned factory network is carried out by wired and wireless means or technology. Therefore, industrial facilities use wireless communication networks to realize communication between various devices of industrial facilities. The wireless network is based on cellular technology and includes multiple gateway devices or network devices. The gateway device herein refers to one or more devices that can connect user devices to a wireless network. Examples of gateway devices include base stations, routers, switches, repeaters, access points, etc. Multiple gateway devices may include fixed gateway devices, which can be fixed to multiple locations in industrial facilities. Multiple industrial devices in the facility are connected to one or more gateway devices to connect to the wireless network and to communicate information with other devices and systems in the industrial facility. Industrial devices include industrial applications that can process data from other industrial devices. Applications (120, 130 and 140) are hosted on one or more containers (not shown in the figure) and can therefore be hosted in a container cluster. These applications can communicate with each other through one or more network / gateway devices present in a part 100. For example, application 120 is connected to application 130 via reverse proxy device 150. Similarly, application 130 is connected to application 140 via reverse proxy device 160.

[0019] In addition, a portion 100 includes a packet capture service 110 for capturing packets associated with the application (120, 130 and 140). In order to capture packets associated with the application, the packet capture service is configured to listen and capture packets at an external network interface associated with the reverse proxy device. As mentioned previously, this is done because certain communications between the application of the industrial device and the automation equipment outside the industrial device must be recorded, especially at the physical interface of the container associated with the application rather than the virtual network interface. In order to detect or eliminate interference in the responsible communication components in the industrial edge, it is always necessary to perform such recording at an external or physical interface. In addition, because non-IP-based automation protocols must be used when communicating with automation equipment, some applications must be directly connected to the factory network at the data link layer level and thus to the external interface.

[0020] In addition, the packet capture service 110 is connected to one or more packet capture clients (shown as packet capture client 180 in the figure). The packet capture service 110 is configured to receive a capture request from a packet capture client, process the capture request, initiate a capture session in response to the capture request, and transmit captured packets to the packet capture client. However, in order to ensure that the packet capture service 110 does not record packets transmitted to the packet capture client or packets that have already been captured through an existing capture session, the packet capture service 110 is configured to process the capture request. Based on the processing, the packet capture service 110 determines whether to create a capture session and whether filters are needed to filter out certain packets from being captured. This will be combined with Figure 2 Further explanation.

[0021] Figure 2 A method 200 is shown for capturing packets from one or more applications hosted on one or more containers connected to one or more network interfaces in a portion of an industrial network 100. The method 200 is implemented by a packet capture service 110. For purposes of explanation, the packet capture service 110 captures packets associated with communications between an application 130 and an application 140 at a first network interface of a reverse proxy device 160.

[0022] At step 210, the packet capture service receives a capture request for capturing packets associated with a connection of a second container of the one or more containers. The connection is between the second container and a network destination for transmitting one or more packets. In one example, the second container is associated with application 120, and the network destination is a container associated with application 130. The capture request is transmitted by packet capture client 180.

[0023] At step 220, the packet capture service determines a network path associated with the connection of the second container. The network path indicates one or more network interfaces used by the data packets of the connection from the second container to the network destination. The network path associated with the connection of the second container is determined based on the network information associated with the second container. In one example, the packet capture service 110 uses a network discovery and management service to determine the network information associated with the second container. In another example, the network information of the second container is included in the capture request from the packet capture client. Based on the network information, the packet capture service is configured to use a network topology associated with a portion of the industrial facility 100 to determine the network path. The network topology herein refers to the topology information of the network device, which indicates the corresponding connections between the network devices. The network topology represents the physical and virtual connections between the devices and the possible data flows between the devices. For example, for a linux device, this includes VETH network interface connection pair information. Therefore, the network topology includes routing information, TCP / IP address configuration, and link layer information associated with the devices in the network. Furthermore, the network topology also includes information about: network interfaces and their assignment to the (virtual) IP stack, assignment of network interfaces to containers and their services (especially proxy and capture services), direct data link layer connections between network interfaces (especially VETH and MACVLAN types), IP addresses assigned to network interfaces and routing information of the (virtual) IP stack.

[0024] The network path herein refers to various network interfaces and network devices that establish a connection between the second container and the network destination. The network interface includes both virtual interfaces and physical interfaces. For example, the network path between the second application associated with the application 120 and the network destination (i.e., the container associated with the application 130) includes the network interface (virtual and real) of the second container that transmits / receives the data packet associated with the application 120, the network interface of the reverse proxy device 150 (which acts as an intermediate network device between the second container and the network destination), and the network interface (virtual and real) of the network destination that transmits / receives the data packet associated with the application 120.

[0025] In order to calculate the network path, the packet capture service determines the starting point (212) of the path, namely: the (external) network interface, using the IP address of the packet capture client and the IP routing table to determine the incoming external network interface. The packet capture service then uses the routing table and the IP address of the reverse proxy device to determine the end point of the first path segment at the reverse proxy device RPR. In addition, using the reverse proxy device, the packet capture service iteratively performs the above steps to determine the network interface until the path terminates at the packet capture service. Therefore, the packet capture service determines the path segments based on the IP addresses recorded in the web socket / HTTP header mentioned in the capture request. In addition, the packet capture service also records the TCP ports used along the path when determining each segment. An example network path is as follows: Segment #1: from the external ETH "ens33" with IP port 1.2.3.4:443 to the ETH "eth0" of the RPR with 172.17.1.1:443, including layer 2 interfaces "ens33", "docker0", "veth1234", "eth0"; and Segment #2: from the RPR's "eth1" with 172.17.6.66:12345 to the CS's "eth0" with 172.17.6.99:5001, including layer 2 interfaces "eth1", "vethabcd", "br-6667", "vethxyzz", "eth0".

[0026] Then, in step 230, the packet capture service determines the presence of one or more network interfaces in one of the first capture session and the connection between the packet capture service and the packet capture client. Based on the network path associated with the second container, the packet capture service determines whether there is any overlap in the determined network path with the first capture session or the connection with the packet capture client. The packet capture service is configured to determine the network interfaces associated with the packet capture client and the packet capture service. Similar to the determination of the above network path, the packet capture service is configured to obtain network information associated with the packet capture client (from a network discovery service or from the packet capture client itself), and based on the network information and the network topology, the packet capture service determines the network interface used in the connection between the packet capture client and the packet capture service. Then, the packet capture service determines whether there are one or more network interfaces in the network path between the second container and the network destination and the connection between the packet capture client and the packet capture service. Similarly, the packet capture service includes a network path for the first capture session, which includes a network interface associated with the communication between the application 130 and the application 140, that is, the network interface of the container of the application 130 and 140, and the first network interface of the reverse proxy device 160. The packet capture service then determines whether one or more network interfaces exist in both a network path between the second container and the network destination and a network path of the first capture session.

[0027] Then, at step 240, the packet capture service approves the capture request based on the presence of one or more network interfaces in one of the first capture session and the connection between the packet capture service and the packet capture client to create a second capture session for capturing packets associated with the connection to the second container. In the first example, the capture request is approved when one or more network interfaces in the network path of the second connection do not exist in the first capture session and the connection between the packet capture service and the packet capture client. Therefore, when there is no network interface overlap, the packet capture service determines that there is no possibility of self-recording, and therefore the capture request is approved.

[0028] In a second example, the method 200 also includes generating, by the packet capture service, a filter associated with the capture request for capturing packets associated with the connection to the second container before approving the capture request. When at least one of the one or more network interfaces is present in the first capture session or in the connection between the packet capture service and the packet capture client, the packet capture service is configured to establish a filter including one or more filter expressions for filtering packets associated with the first capture session and one or more of the packets originating from the packet capture service. After successfully deploying the generated filter, the packet capture service approves the capture request because the generated filter eliminates the self-recording of the packet capture service. However, before generating the filter, the packet capture service is configured to determine whether there is already a filter associated with the overlapping network interface, and accordingly, if there is already a filter, the packet capture service does not generate the filter. In one example, the packet capture service does not approve the capture request because it is impossible to deploy two filters for the same network interface. In another example, in the case where the capture request is approved, the existing filter is modified to eliminate the self-recording. The aspects of the filter are explained below with an example.

[0029] In one example, as mentioned above, the packet capture service 110 is connected to a packet capture client via the reverse proxy device through the first network interface of the reverse proxy device 150. The packet capture client has an IP address of 1.2.3.4 and is connected to the reverse proxy device 150 via TCP port 55555. The first network interface of the reverse proxy device 150 has an IP address of 192.168.1.2 and is connected to the packet capture client via TCP port 80. Similarly, the packet capture service has an IP address of 1.1.3.4 and is connected to the reverse proxy device 150 via the first network interface at TCP port 49456.

[0030] The packet capture service 110 receives a capture request for capturing packets between applications 120 and 130, which are connected via the reverse proxy device 150 via the second network interface of the reverse proxy device 150. The second network interface of the reverse proxy device 150 has an IP address of 172.17.2.1 and is connected to the applications 120 and 130 via TCP port 49987 and TCP port 49123. The capture request specifies that packet capture should occur on the first interface and the second interface of the reverse proxy device 150. Since the first network interface exists in the connection between the packet capture client and the packet capture service, the packet capture service generates and deploys a filter before approving the capture request. The filter contains an expression with a "not" operator to exclude packets containing the combination of (IP address and port address) 1.2.3.4:55555 and 192.168.1.2:80, where either the IP address and the port address may exist in the packet source or the packet destination. Thus, the filter excludes the recording of all packets originating from the packet capture client and sent to the reverse proxy device 150, as well as all packets transmitted from the reverse proxy device and transmitted to the packet capture client.

[0031] In one example, the packet capture service includes a path finder module for determining a network path as mentioned above. In one example, in order to determine the network interface used in the connection between the packet capture client and the packet capture service, the packet capture client and each reverse proxy device are configured to write corresponding network information into the capture request. This information is used together with the network topology to determine the network interface used between the packet capture service and the packet capture client. In one example, the packet capture service includes a filter generator module for generating filters as mentioned above.

[0032] Thus, the present invention describes a method for ensuring that packet capture is not bloated by the use of HTTP proxies and servers, while being able to utilize packets with standardized headers that provide path information only from the network layer (layer 3 of the ISO / OSI layer model) upwards. By combining standardized available path information with topology information at each layer of the network, the possibility of self-recording is eliminated. Thus, a new recording is only started when the network interface to be recorded is not on any previous path (or part) of an active capture session, or when the network interface to be recorded is not on a path to communicate with a packet capture client.

[0033] Furthermore, although the above method 200 has been explained in conjunction with a packet capture service, the method 200 may be implemented using one or more devices. For example, the method 200 may be implemented via a device such as Figure 3The packet capture device 300 shown is implemented.

[0034] The packet capture device 300 includes a network interface 310 for transmitting and receiving packets and one or more processors 320. The one or more processors 320 are connected to a memory module 330, which includes a plurality of instructions that, when executed on the one or more processors, cause the processor to receive a capture request for capturing packets associated with a connection to a second container from one or more containers, wherein the connection is between the second container and a network destination for transmitting one or more packets; determine a network path associated with the connection to the second container, wherein the network path indicates one or more network interfaces used by packets of the connection from the second container to the network destination; determine the existence of one or more network interfaces in one of a first capture session and a connection between a packet capture service and a packet capture client; and approve the capture request based on the existence of one or more network interfaces in one of the first capture session and a connection between the packet capture service and the packet capture client to create a second capture session for capturing packets associated with the connection to the second container.

[0035] It should be noted that although the above disclosure has been explained with respect to a packet capture device, the above method can be implemented in another device or multiple devices. For example, method 200 can be implemented in an edge server. Therefore, the present invention can take the form of a computer program product, which includes a program module accessible from a computer-usable or computer-readable medium storing program code, which is used by one or more computers, processing units, or instruction execution systems or used in combination with them. For the purposes of this description, a computer-usable or computer-readable non-transitory storage medium can be any device that can contain, store, communicate, propagate, or transmit a program used by or in combination with an instruction execution system, device, or device. The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or device or device) or a propagation medium that itself serves as a signal carrier. The definition of a physical computer-readable medium includes semiconductor or solid-state memory, magnetic tape, removable computer disk, random access memory (RAM), read-only memory (ROM), hard disk, and optical disk, such as compact disk read-only memory (CD-ROM), compact disk read / write, and DVD. As known to those skilled in the art, the processing units and program codes used to implement each aspect of the technology can be centralized or distributed (or a combination thereof).

[0036] As described herein, in view of the present invention, various modifications and variations may occur to those skilled in the art without departing from the scope of the various embodiments of the present disclosure. Therefore, the scope of the present disclosure is indicated by the appended claims rather than the foregoing description. All changes, modifications and variations within the meaning and equivalent range of the claims are considered to be within their scope. All advantageous embodiments claimed in the method claims may also apply to the device / non-transitory storage medium claims.

Claims

1. A method (200) of capturing packets from one or more applications (120, 130, 140) hosted on one or more containers connected to one or more network interfaces in a portion of an industrial network (100) via a packet capture service (110), wherein: The packet capture service (110) is connected to a packet capture client (180) for transmitting captured packets to the packet capture client (180), and the method (200) comprises: a. receiving (210) a capture request for capturing packets associated with a connection of a second container of the one or more containers (120, 130, 140), wherein the connection is between the second container and a network destination for transmitting one or more packets; b. determining (220) a network path associated with the connection of the second container, wherein the network path indicates the one or more network interfaces used by packets of the connection from the second container to the network destination; c. determining (230) the presence of the one or more network interfaces in one of a first capture session and a connection between the packet capture service (110) and the packet capture client (180), wherein the first capture session is used to capture packets associated with a first container, wherein at least one network interface of the one or more network interfaces is present in one of a network path of the first capture session and a connection between the packet capture service (110) and the packet capture client (180); and d. approving (240) the capture request to create a second capture session for capturing packets associated with the connection to the second container, The method (200) further comprises, before approving the capture request, generating a filter associated with the capture request for capturing packets associated with the connection to the second container, wherein the filter comprises one or more filter expressions for filtering one or more packets associated with the first capture session and packets originating from or transmitted to the packet capture service (110).

2. The method (200) according to claim 1, wherein: Granting the capture request includes detecting a presence of another filter associated with the one or more network interfaces, wherein the capture request is not granted when the another filter is detected.

3. The method (200) according to claim 1, wherein: The capture request is transmitted by the packet capture client (180), and the capture request includes network information associated with the packet capture client (180).

4. The method (200) according to claim 1, wherein: The capture request includes network information associated with the second container, and wherein determining the network path includes determining one or more intermediate network interfaces based on the network information associated with the second container and a network topology associated with the portion of the industrial network (100).

5. The method (200) according to claim 1, wherein: The method (200) further determines a first set of network interfaces to be used in a connection between the packet capture service (110) and the packet capture client (180) based on network information of the packet capture client (180) and a network topology associated with the portion of the industrial network (100).

6. The method (200) according to claim 4, wherein: The one or more intermediate network interfaces belong to at least one reverse proxy device (150).

7. The method (200) according to claim 5, wherein: The network topology includes IP / TCP address configuration and IP routing information of the one or more containers (120, 130, 140) and the one or more network interfaces.

8. A packet capture device (300) for capturing packets from one or more applications hosted on a container (120, 130, 140) connected to one or more network interfaces in a portion of an industrial network (100), wherein: The packet capture device (300) is connected to a packet capture client (180) for transmitting captured packets to the packet capture client (180) and includes a first capture session for capturing packets associated with a first container, the packet capture device (300) comprising: a. One or more processors (320) configured to: i. receiving a capture request for capturing packets associated with a connection of a second container of the one or more containers (120, 130, 140), wherein the connection is between the second container and a network destination for transmitting one or more packets; ii. determining a network path associated with the connection of the second container, wherein the network path indicates one or more network interfaces used by packets of the connection from the second container to the network destination; iii. determining the presence of the one or more network interfaces in one of the first capture session and a connection between a packet capture service (110) and the packet capture client (180); iv. generating a filter associated with the capture request for capturing packets associated with the connection to the second container when at least one network interface of the one or more network interfaces is present in the first capture session and the connection between the packet capture service (110) and the packet capture client (180), and v. approving the capture request based on the presence of the one or more network interfaces in one of the first capture session and the connection between the packet capture service (110) and the packet capture client (180) to create a second capture session for capturing packets associated with the connection to the second container.

Images