Offloading IPFIX Lookup Operations to Observation Cloud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The IPFIX protocol is resource-intensive due to lookups and translations required for IPFIX data export, necessitating significant memory resources and limiting its implementation to expensive physical devices, and traditional technologies fail to account for commonalities across sets of observation domains, leading to inefficiencies.
Innovation Solution
Implementing an observation cloud that offloads IPFIX lookup and translation operations from observation domains, allowing observation domains to export observable properties directly and the observation cloud to handle derivable properties, thereby reducing the need for complete Forwarding Information Base (FIB) and memory requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPFIX lookup and translation operations are performed by the observation domain, then IPFIX data can be exported with deduplication of commonalities within observation points, but the observation domain consumes significant memory resources and requires expensive physical devices
Solution Approach 1:
The patent segments the IPFIX processing functionality by introducing an observation cloud that handles lookup and translation operations separately from the observation domain. The observation domain exports raw flow data while the observation cloud performs the resource-intensive FIB lookups and translations, dividing the workload to reduce memory requirements in the observation domain.
Solution Approach 2:
The observation cloud acts as an intermediary between the observation domain and the IPFIX collector. It receives raw export data from the observation domain, performs the necessary FIB lookups and translations using its own FIB table, and then exports the translated data to the collector, thereby eliminating the need for the observation domain to maintain a complete FIB.
2Measurement precision
If a complete Forwarding Information Base (FIB) is maintained in the observation domain, then accurate IPFIX lookups and translations can be performed, but the device complexity and cost increase significantly
Solution Approach 1:
The patent extracts the FIB table and lookup/translation functionality from the observation domain and places them in the observation cloud. This extraction allows the observation domain to export IPFIX data without maintaining a complete FIB, thereby reducing device complexity while the observation cloud maintains the necessary FIB for accurate lookups and translations.
3Speed
If observation domains perform IPFIX lookups and translations, then data can be exported in real-time, but resource consumption and processing overhead increase
Solution Approach 1:
The patent merges the observation domain's data collection capability with the observation cloud's lookup and translation capability. The observation domain quickly exports raw flow data without performing resource-intensive operations, while the observation cloud handles the FIB lookups and translations, combining their strengths to achieve real-time export with reduced processing overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A disclosed method may include (1) receiving, at an IPFIX collector, a IPFIX message from an IPFIX exporter implemented on a remote device, (2) identifying, within the IPFIX message, a data set exported by the IPFIX exporter implemented on the remote device, (3) identifying, within the IPFIX message, a data-level indicator that indicates whether the data set is (A) a primary data set observed by an observation domain implemented on the remote device or (B) a secondary data set derived by an observation cloud implemented on the remote device, (4) identifying, at the IPFIX collector, a database that corresponds to the data-level indicator identified within the IPFIX message, (5) storing the data set in the database in accordance with the data-level indicator, and then (6) performing an action based at least in part on the data set stored in the database. Various other systems and methods are also disclosed.