Dynamic Remote Packet Capture via Routing Device Filters

Solution Overview

Problem

Current traffic analysis systems require routing devices to send unnecessary traffic to analysis devices, leading to high-bandwidth requirements and increased costs, as well as inefficient use of processing resources.

Innovation Solution

Implementing a system where a traffic analysis device configures filters on routing devices to forward only traffic of interest, using existing network analysis software tools and APIs, thereby reducing the need for high-bandwidth connections and minimizing processing resources by eliminating the forwarding of non-relevant traffic.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If routing devices send all traffic to analysis devices, then complete traffic analysis is achieved, but network bandwidth consumption increases and costs increase

Engineering Contradiction:

Improvetraffic analysis completenessVSAvoidnetwork bandwidth consumption

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The system performs preliminary action by configuring filters on routing devices before traffic analysis begins. These filters pre-identify and mark traffic of interest at the routing device, so that only relevant traffic is forwarded to the analysis device, eliminating the need to send all traffic and thus reducing bandwidth consumption while maintaining analysis completeness

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention extracts only the necessary component (traffic of interest) from the whole traffic stream by using filters configured on routing devices. The filter information specifies conditions that identify relevant traffic, which is then separated and forwarded to the analysis device, while unnecessary traffic remains at the routing device, reducing network bandwidth consumption without compromising analysis effectiveness

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If routing devices send all traffic to analysis devices, then comprehensive traffic monitoring is achieved, but processing resources are wasted

Engineering Contradiction:

Improvetraffic monitoring comprehensivenessVSAvoidprocessing resource efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system performs preliminary action by configuring filters on routing devices before traffic analysis begins. These filters pre-identify and mark traffic of interest at the routing device, so that only relevant traffic is forwarded to the analysis device, eliminating the need to send all traffic and thus reducing bandwidth consumption while maintaining analysis completeness

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention extracts only the necessary component (traffic of interest) from the whole traffic stream by using filters configured on routing devices. The filter information specifies conditions that identify relevant traffic, which is then separated and forwarded to the analysis device, while unnecessary traffic remains at the routing device, reducing network bandwidth consumption without compromising analysis effectiveness

Inventive Principle:

Principle #2Taking out (Extraction)

3Quantity of substance

If high-bandwidth connections are used for traffic analysis, then all traffic can be forwarded, but costs increase

Engineering Contradiction:

Improvetraffic volume forwardedVSAvoidsystem cost

Core Design Contradiction:

Quantity of substanceVSEase of manufacture

Solution Approach 1:

The invention extracts only the necessary component (traffic of interest) from the whole traffic stream by using filters configured on routing devices. The filter information specifies conditions that identify relevant traffic, which is then separated and forwarded to the analysis device, while unnecessary traffic remains at the routing device, reducing network bandwidth consumption without compromising analysis effectiveness

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system changes the parameter of traffic volume by using filter information to selectively forward only traffic matching specified conditions. This parameter change from forwarding all traffic to forwarding only relevant traffic reduces the bandwidth requirements and associated costs while maintaining the ability to perform comprehensive analysis on traffic of interest

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS9350630B2Dynamic remote packet capture

Publication Date: 2016.05.24 JUNIPER NETWORKS INC

AI summary

A device may be configured to receive information regarding one or more ports associated with a routing device; output, to the routing device, filter information associated with at least a particular port, of the one or more ports associated with the routing device, the filter information specifying one or more conditions associated with traffic of interest; receive, from the routing device, and based on the outputted filter information, information regarding traffic of interest received or sent by the routing device via the particular port, the traffic of interest being less than or equal to all traffic received or sent by the routing device via the particular port; and store or output a representation of at least a portion of the received information regarding the traffic of interest.