Network Traffic Mirroring via Look-Up Table Packet Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional mirroring solutions are highly intrusive and limited in flexibility, requiring network monitoring devices to be physically attached to the monitored devices, and only allow mirroring based on source ports and VLANs, restricting remote monitoring capabilities.
Innovation Solution
A method and apparatus that enable mirroring of network traffic from various source types by using configurable circuitry and code in networking devices, allowing for multiple mirror sessions with multiple sources and destinations, and utilizing look-up tables to select packets based on MAC, IP, subnet, and ACL criteria, with dynamic state information for packet selection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the network analysis device is directly attached to the networking device being monitored, then the mirroring function can be implemented, but the network administrator must physically dispatch to the device location, reducing ease of operation
Solution Approach 1:
The patent introduces a mirror source device and mirror destination device as intermediaries between the network administrator and the monitored networking device. The mirror source device receives mirroring instructions and data packets from the networking device, then forwards selected packets to the mirror destination device. This intermediary architecture allows remote configuration and monitoring without requiring physical access to the networking device location.
2Adaptability or versatility
If conventional mirroring solutions are used with direct physical attachment, then mirroring can be implemented, but the solutions are highly intrusive and limited in flexibility
Solution Approach 1:
The patent segments the mirroring function into distinct modular components: a mirror source device that receives instructions and data packets, a mirroring engine that processes selection criteria, and a mirror destination device that receives mirrored packets. This segmentation allows each component to perform its specific function independently, increasing flexibility and reducing intrusiveness on the overall network operation.
Solution Approach 2:
The patent implements dynamic mirroring where the mirror source device can receive different types of data packets (unicast, multicast, broadcast) and apply various selection criteria (MAC address, IP address, protocol type, port number) to dynamically determine which packets to mirror. This dynamic capability allows the system to adapt to different monitoring requirements without physical reconfiguration.
3Adaptability or versatility
If conventional mirroring is implemented with physical attachment, then basic mirroring works, but it only allows mirroring based on source ports and VLANs, limiting adaptability
Solution Approach 1:
The mirror source device is designed with multi-functionality to handle various packet types (unicast, multicast, broadcast) and apply multiple selection criteria (MAC address, IP address, protocol type, port number, VLAN ID). This universal design allows a single device to perform multiple mirroring functions that would traditionally require different configurations or devices, thereby increasing adaptability without proportionally increasing complexity.
Data Source
AI summary
One embodiment disclosed relates to a method for mirroring of select network traffic. A data packet is received by a network device. A determination is made as to whether a designated aspect of the packet matches a flagged entry in a look-up table on the network device. If a match is found, then copy of the packet is sent to an associated mirror destination. Another embodiment disclosed relates to a networking apparatus. The apparatus includes at least an operating system, a look-up table, and a mirroring engine. The operating system includes routines utilized to control the apparatus, and the look-up table includes selection information for mirror sources. The mirroring engine forwards copies of selected packets to a corresponding mirror destination. Another embodiment disclosed relates to a method of selecting packets to mirror that includes checking state information relating to the network traffic against dynamic mirroring criteria.