Multi-tier Network Switches for Passive Frame Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional networking hardware modifies data frames when redirecting them for analysis, making it difficult to identify and resolve network communication issues, and customized monitoring hardware is prohibitively expensive for large-scale networks.
Innovation Solution
Ordinary network switches are organized into multiple tiers with flow tables to identify and redirect specific frames to analysis devices without modification, using a loop topology and priority levels to manage frame processing and drop irrelevant data, and can be selected for low latency and minimal hardware attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional networking hardware is used to redirect frames to analysis mechanisms, then frame redirection is achieved, but frames are modified which hides the source of network communication issues
Solution Approach 1:
The system segments network traffic handling into two distinct paths: a monitoring path that copies frames to analysis mechanisms without modification, and a forwarding path that handles normal traffic flow. This segmentation allows frame redirection for analysis while preserving the original frame integrity for troubleshooting.
Solution Approach 2:
The patent implements a copying mechanism where network switches create copies of data frames for transmission to analysis computing devices. The original frames continue their intended transmission unchanged, while the copied frames are analyzed separately. This copying approach ensures that analysis mechanisms receive frame information without modifying the original traffic flow.
2Loss of information
If customized networking hardware is used to provide unmodified frames to analysis mechanisms, then frame integrity is maintained, but the cost becomes prohibitively expensive for large-scale networks
Solution Approach 1:
The patent makes ordinary network switches perform multiple functions: normal traffic forwarding and passive frame copying for monitoring. By configuring standard switches with flow tables to identify and copy specific frames, the system achieves customized monitoring capabilities without requiring specialized expensive hardware. This multi-functionality allows commercial off-the-shelf equipment to replace costly custom-built solutions.
Solution Approach 2:
The system uses inexpensive, readily available ordinary network switches instead of expensive customized monitoring hardware. These standard switches can be deployed widely across large-scale networks at minimal cost, providing the necessary frame copying and forwarding capabilities through software configuration rather than expensive proprietary hardware.
3Ease of manufacture
If ordinary network switches are used for passive network monitoring, then cost is reduced, but the ability to handle large-scale network traffic without modification is compromised
Solution Approach 1:
The system performs preliminary frame identification and copying at the network switch level before frames reach analysis mechanisms. Flow tables are pre-configured to identify specific frame types that need monitoring, and copies are made proactively during normal switching operations. This preliminary action ensures that frames are captured for analysis without disrupting their intended transmission path or requiring complex real-time processing.
Solution Approach 2:
Ordinary network switches serve as intermediaries between the monitored network traffic and analysis computing devices. The switches receive frames from the network, perform copying based on flow table rules, and forward both original and copied frames appropriately. This intermediary role allows standard switches to reliably handle large-scale traffic while providing the necessary monitoring functionality.
Data Source
AI summary
Passive monitoring of a large-scale network using multiple tiers of ordinary network switches, as opposed to purpose-built network monitoring hardware, is accomplished by initially providing network communications to an initial tier of monitoring switches, either from existing switches that copy frames and provide them to the monitoring switches, or from network taps to which the monitoring switches are connected. The initial tier of monitoring switches comprises flow tables that initially simply drop all frames provided to those switches and, subsequently, when specific network issues arise, they are modified to include a specification particular frame criteria whose frames are either forwarded to subsequent tiers of monitoring switches, or statistics regarding those frames are collected. Subsequent tiers of monitoring switches receive frames from the initial tier and direct them to one or more appropriate analysis computing devices. Ordinary network switches are selected based on their ability to provide low latency forwarding.