Network Packet De-duplication via Authoritative Observation Ports
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed network monitoring environments, duplicated network packets from different parts of the network interfere with analysis and metric computation, leading to double counting and inaccurate monitoring results.
Innovation Solution
A network monitoring system identifies authoritative observation ports to distinguish primary network packets from duplicates, using characteristics like hop counts, TTL values, and latency, and discards non-authoritative packet duplicates to ensure accurate analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If network monitors receive packet copies from multiple observation ports in distributed network monitoring environments, then network coverage and monitoring scope are improved, but duplicate packets interfere with analysis and metric computation leading to double counting and inaccurate results
Solution Approach 1:
The patent segments the monitoring system into multiple observation ports, each responsible for specific network segments. By dividing the monitoring function across multiple ports and implementing de-duplication logic, the system achieves both broad coverage and accurate measurement by processing packets from different segments while eliminating duplicates.
Solution Approach 2:
The patent introduces an intermediary de-duplication mechanism that sits between multiple observation ports and the analysis engine. This intermediary component receives packets from various ports, identifies duplicates using characteristics like hop counts and TTL values, and filters them before forwarding to analysis, thereby resolving the contradiction between comprehensive monitoring and accurate measurement.
2Loss of information
If all received network packets are processed for analysis, then complete network traffic analysis is achieved, but processing burden on analysis engines increases due to duplicate packets
Solution Approach 1:
The patent applies preliminary de-duplication action before packets reach the analysis engine. By performing duplicate detection and filtering in advance using packet characteristics such as hop counts, TTL values, and latency measurements, the system reduces the volume of packets requiring full analysis while ensuring no unique packets are lost, thus improving processing efficiency without compromising analysis completeness.
3Reliability
If duplicate packets are discarded based on observation port authority, then data integrity and analysis accuracy are improved, but additional complexity is introduced in identifying authoritative ports
Solution Approach 1:
The patent uses parameter changes in packet headers (hop counts, TTL values, latency measurements) to identify and eliminate duplicate packets. By leveraging these existing packet parameters rather than introducing complex new identification mechanisms, the system achieves reliable duplicate detection while minimizing additional system complexity.
Data Source
AI summary
Embodiments are directed to monitoring network traffic over a network. A monitoring engine may monitor flows of network packets in the network. The monitoring engine may determine an observation port that provided the network packets. The monitoring engine may determine primary network packets provided by an authoritative observation port based on which observation port provided the network packets and provide them to an analysis engine. The monitoring engine may discard a remainder of the network packets that may be associated with non-authoritative observation ports. The analysis engine may analyze the one or more primary network packets.