Hardware-Triggered Traffic Mirroring for Reduced Data Redundancy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing traffic mirroring technologies struggle with inefficient and resource-intensive initiation and termination of mirroring processes, particularly in high-speed networks, leading to excessive redundant data generation and processor load.
Innovation Solution
The hardware of a switch, such as the ASIC, triggers mirroring based on specific events detected at the hardware level, allowing for selective and timely initiation and termination of the mirroring process, reducing the volume of mirrored data by focusing on relevant packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traffic mirroring is initiated by software based on packet analysis, then mirroring can be selectively applied to specific traffic patterns, but the initiation and termination process is inefficient and generates excessive redundant data in high-speed networks
Solution Approach 1:
The patent replaces software-based mirroring initiation with hardware-based triggering using ASIC circuits. The hardware monitor circuit directly detects trigger conditions (such as specific packet patterns or flow states) and initiates mirroring immediately without software intervention, substituting the mechanical software processing path with a faster hardware path that eliminates the inefficiency and redundant data generation associated with software-based detection and decision-making.
Solution Approach 2:
The patent implements preliminary configuration of trigger conditions and mirroring parameters in hardware before traffic flow occurs. The ASIC is pre-programmed with trigger conditions (such as specific source/destination addresses, port combinations, or traffic patterns), so when matching traffic arrives, the mirroring action is immediately activated without requiring real-time software analysis, enabling proactive rather than reactive mirroring initiation.
2Reliability
If software-based mirroring is used to monitor all traffic for trigger conditions, then comprehensive traffic analysis is possible, but processor load increases significantly
Solution Approach 1:
The patent substitutes software-based trigger condition monitoring with hardware-based detection circuits in the ASIC. These hardware circuits continuously monitor traffic flows and directly compare incoming packets against pre-configured trigger conditions, maintaining comprehensive and accurate detection capability while eliminating the need for software processor involvement, thereby significantly reducing processor load and energy consumption.
Solution Approach 2:
The hardware monitor circuit performs self-service by autonomously detecting trigger conditions and initiating mirroring actions without requiring software processor intervention. The ASIC contains dedicated circuits that automatically compare traffic patterns against stored trigger conditions, generate trigger signals when matches occur, and control the mirroring process entirely in hardware, making the system self-sufficient and freeing the software processor from this energy-intensive task.
3Loss of information
If mirroring is initiated by copying packets for analysis, then traffic patterns can be monitored, but the volume of mirrored data becomes excessively large in high-speed networks
Solution Approach 1:
The patent uses hardware-based trigger detection to precisely identify and mirror only the specific traffic flows that match configured conditions, rather than mirroring broad categories of traffic. The ASIC circuits can detect and respond to specific packet patterns, addresses, or flow states with high precision, ensuring that only relevant traffic is mirrored, thus maintaining complete information about critical traffic patterns while minimizing the total volume of mirrored data.
Solution Approach 2:
The patent applies different mirroring behaviors to different traffic flows based on their specific characteristics. Instead of uniform mirroring of all traffic or large traffic categories, the system applies mirroring selectively to specific local traffic patterns that match trigger conditions, such as individual source-destination pairs, specific protocols, or traffic exhibiting particular behaviors, thereby preserving information quality for relevant traffic while reducing overall data volume.
Data Source
AI summary
A system for facilitating packet mirroring triggered by a hardware module of a switch is provided. During operation, the hardware module can process a received packet and determine whether the processing of the packet changes a state of the hardware module. If a change to the state is detected, the hardware module can determine whether the changed state of the hardware module satisfies a trigger condition for initiating packet mirroring, and if does, issue a hardware interrupt. The system can then identify a set of packets that are to be mirrored based on one or more mirroring parameters indicated by the trigger condition. Here, the set of packets are subsequent to the packet and to be processed by the hardware module. Accordingly, the system can mirror the set of packets to a target. If the trigger condition is expired, the system can terminate the mirroring of the set of packets.