Network Traffic Sampling via CAM Lookup and Selective Mirroring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network traffic mirroring technologies do not account for the port speed or capacity of monitoring devices, leading to packet overflow and poor distribution of data traffic subsets, causing monitoring devices to drop packets and obtain unrepresentative data.
Innovation Solution
A method and apparatus that utilize a sampling circuit and content addressable memory to selectively mirror network traffic by creating a look-up word from packet information, querying a sampling circuit to determine if packets should be mirrored, and sending them to both the destination and mirror ports, ensuring only relevant packets are mirrored.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional mirroring logic sends all packets to the monitoring device, then complete traffic monitoring is achieved, but the monitoring device input buffer overflows and packets are dropped
Solution Approach 1:
The patent applies partial action by selectively mirroring only a sampled subset of packets rather than all packets. The sampling circuit chooses specific packets based on sampling rates, extracting only the necessary portion of traffic for monitoring purposes while leaving the bulk of packets to flow normally without overwhelming the monitoring device.
Solution Approach 2:
The patent extracts a representative subset of packets from the full traffic stream using the sampling circuit. This extracted sample is then sent to the monitoring device, separating the monitoring function from the complete traffic flow and preventing buffer overflow while maintaining monitoring effectiveness.
2Quantity of substance
If random packet sampling is used, then monitoring device buffer overflow is prevented, but the distributed subset of data may not accurately represent network traffic
Solution Approach 1:
The patent performs preliminary classification of packets using CAM tables before sampling. By pre-identifying and categorizing packet types, sources, and destinations, the system ensures that the sampling process focuses on relevant traffic patterns, improving the representativeness of the captured subset while maintaining controlled packet volumes.
Solution Approach 2:
The patent applies different sampling rates and mirroring strategies to different packet types, sources, or destinations based on their importance. Critical traffic types receive higher sampling priority, while less important traffic receives lower priority, ensuring that the monitoring subset accurately reflects the diverse characteristics of overall network traffic.
3Loss of information
If packet mirroring is implemented without sampling, then complete traffic analysis is possible, but monitoring device capacity is exceeded and performance degrades
Solution Approach 1:
The patent implements partial action by mirroring only a carefully selected sample of packets rather than the complete traffic stream. This approach maintains sufficient data completeness for effective traffic analysis while operating within the processing capacity constraints of the monitoring device.
Solution Approach 2:
The sampling circuit acts as an intermediary between the network traffic and the monitoring device. It filters and selects packets before they reach the monitoring device, mediating the data flow to ensure that the monitoring device receives a manageable subset that still provides meaningful traffic insights.
Data Source
AI summary
One embodiment disclosed relates to a method of sampling network traffic. A data packet is received by a network device. Information is extracted from fields in the data packet, and a look-up word is created using the extracted information. A content addressable memory is searched for entries matching the look-up word. If a match is found, then a sampling circuit is queried, and a response is received therefrom. The data packet may be sent to a destination port. In addition, if the response from the sampling circuit indicates that the data packet is chosen to be mirrored, then the data packet may be also sent to a mirror port. Other embodiments are also disclosed.