Network Traffic Mirroring via Randomized Packet Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network traffic mirroring technologies fail to account for the port speed and capacity of monitoring devices, leading to packet overflow and poorly distributed subsets of data traffic, which results in dropped packets and biased statistics.
Innovation Solution
Implementing a randomized selection algorithm in the mirroring engine to determine which data packets are mirrored, ensuring a well-distributed subset of network traffic is sent to the monitoring device, with optional weighted sampling based on packet types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all network traffic is mirrored to the monitoring device, then complete traffic monitoring is achieved, but packet overflow occurs and monitoring device capacity is exceeded
Solution Approach 1:
The patent applies partial action by mirroring only a subset of packets rather than all traffic. The system uses sampling methods (random sampling, weighted sampling based on packet types, or sampling based on traffic flow) to select a representative portion of packets for mirroring, preventing buffer overflow while maintaining monitoring effectiveness.
Solution Approach 2:
The patent changes the parameter of packet selection from deterministic (all packets) to probabilistic (sampled packets). By introducing sampling rates, weights for different packet types, and randomization, the system transforms the mirroring process to adapt to monitoring device capacity while preserving traffic distribution characteristics.
2Device complexity
If conventional mirroring logic is used without considering monitoring device capacity, then simple implementation is maintained, but packet distribution becomes poor and statistics become biased
Solution Approach 1:
The patent mirrors only a carefully selected subset of packets using sampling techniques. By applying random sampling or weighted sampling based on packet types (e.g., giving higher weight to TCP handshake packets or higher-layer protocol packets), the system obtains representative statistics without mirroring all traffic, thus improving accuracy while managing complexity.
Solution Approach 2:
The patent introduces sampling parameters such as sampling rate, packet type weights, and selection criteria to control which packets are mirrored. These parameters allow the system to adjust the mirroring behavior to achieve representative statistics while keeping the implementation manageable through configurable options.
3Loss of information
If every packet is sent to the mirror port, then no packet information is lost, but monitoring device buffer overflow occurs and packets are dropped
Solution Approach 1:
The patent sends only a sampled subset of packets to the mirror port instead of all packets. Using random sampling or weighted sampling ensures that the mirrored subset represents the overall traffic characteristics, preventing buffer overflow while maintaining sufficient information for effective monitoring and analysis.
Solution Approach 2:
The patent changes the throughput parameter by controlling the packet selection rate. By adjusting sampling rates and weights, the system regulates the flow of mirrored packets to match the monitoring device's processing capacity, preventing overflow while maintaining representative traffic distribution.
Data Source
AI summary
One embodiment disclosed relates to a method of mirroring network traffic. A data packet is received by a network device, and an algorithm including randomization is applied to determine whether the data packet is selected to be mirrored. The packet is sent to a destination port, and if the data packet is selected to be mirrored, then the packet is also sent to a mirror port. Another embodiment of the invention relates to a networking device. The networking device includes at least a plurality of ports, a switching/routing engine, and a mirroring engine. The plurality of ports receive and transmit packets therefrom, and the switching/routing engine is coupled to the ports for transferring the packets therebetween. The mirroring engine is configured to apply an algorithm including randomization to select data packets for mirroring. Other embodiments are also disclosed.