Automated Capture Filter Distribution for Microservice Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing troubleshooting and monitoring methods for cloud native applications are inefficient and complex due to the distributed and dynamic nature of microservices, requiring manual processes that are time-consuming and prone to errors, especially when dealing with encrypted traffic flows.
Innovation Solution
A method and system for automatically generating and distributing capture filters across network nodes to capture and decrypt traffic between microservices, reducing manual intervention and enhancing efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual traffic capture processes are used in distributed microservice networks, then traffic can be captured, but the process becomes time-consuming and error-prone
Solution Approach 1:
The system pre-configures capture filters and automatically distributes them to relevant nodes before traffic capture begins. The orchestrator node receives capture requests, generates appropriate filters, and proactively pushes them to target nodes, eliminating manual configuration time and reducing errors through automated preliminary setup.
Solution Approach 2:
The traffic capture system performs self-configuration through automated filter generation and distribution. The orchestrator automatically determines which nodes need capture filters, generates the appropriate filters based on capture parameters, and distributes them without human intervention, making the system self-sufficient and reducing manual effort.
2Ease of operation
If capture filters are manually configured for each node, then traffic capture can be performed, but the complexity of the process increases
Solution Approach 1:
The system merges the filter generation and distribution functions into a single orchestrator node that centralizes control. Instead of manually configuring each node separately, the orchestrator consolidates the complexity of filter management and automatically distributes filters to multiple nodes, simplifying the user experience while handling the complexity internally.
Solution Approach 2:
The orchestrator node acts as an intermediary between the user and the distributed capture nodes. It receives high-level capture requests from users, translates them into specific filter configurations, and manages distribution to appropriate nodes, shielding users from the underlying complexity of distributed filter configuration.
3Loss of information
If all packets traversing network interfaces are captured by default, then complete traffic data is obtained, but it is inconvenient for troubleshooting which only requires reduced relevant traffic flows
Solution Approach 1:
The system applies different capture qualities to different nodes and traffic flows based on local requirements. The orchestrator analyzes capture requests and generates customized filters for each node, capturing only the specific relevant traffic flows needed for troubleshooting at each location, rather than uniformly capturing all traffic everywhere.
Solution Approach 2:
Instead of capturing all traffic (excessive action), the system uses automated filters to capture only the partial set of relevant traffic flows needed for specific troubleshooting scenarios. The orchestrator intelligently determines the minimal necessary capture scope based on the capture request parameters, reducing unnecessary data collection while maintaining troubleshooting effectiveness.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
There is provided a method for capturing traffic in a network. The method is performed by a first entity in response to a first request to initiate a session in which to capture traffic between microservices. The microservices are distributed across a plurality of nodes in the network. The method comprises initiating (300) transmission of a second request towards one or more second entities. The second request is a request that the one or more second entities initiate the session and the second request comprises one or more capture filters generated for use by the one or more second entities to capture the traffic between the microservices.