Sampled Packet Inspection for Network Application Flow Analytics

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies face challenges in efficiently monitoring the status of applications used by a network, particularly in large networks where processing power requirements are high, making it impractical to deploy monitoring devices at every switch.

Innovation Solution

A system and method that utilize control circuitry to generate mirroring parameters, which are transmitted to switches on the network. These switches mirror specific types of packets to a central server, allowing the control circuitry to analyze the packets and determine the status of applications used by the network.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If packet mirroring is deployed at every switch to monitor network application status, then measurement precision is improved, but device complexity and processing power requirements increase

Engineering Contradiction:

Improvenetwork application status monitoring accuracyVSAvoidmonitoring system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the network monitoring function by deploying lightweight monitoring agents at individual switches rather than requiring full monitoring capabilities at every switch. Each agent selectively mirrors specific packet types (e.g., SYN, DNS, DHCP packets) to a central server, dividing the monitoring task into manageable segments that can be distributed across the network infrastructure.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent extracts only the essential monitoring functions from each switch, implementing lightweight agents that perform specific packet mirroring tasks rather than full packet analysis. This extraction approach removes the burden of complex processing from individual switches while maintaining centralized monitoring capabilities.

Inventive Principle:

Principle #2Taking out (Extraction)

2Measurement precision

If all packets are mirrored to central server for analysis, then measurement precision is improved, but loss of energy increases

Engineering Contradiction:

Improveapplication status determination accuracyVSAvoidprocessing power consumption

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The patent applies local quality by configuring different mirrors at different switches based on their specific roles and traffic patterns. Each switch mirrors only the packet types relevant to its function, creating a customized monitoring approach that reduces overall energy consumption while maintaining comprehensive network visibility.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent implements partial action by selectively mirroring only specific packet types (such as SYN packets for connection tracking, DNS packets for domain resolution monitoring, and DHCP packets for device discovery) rather than mirroring all packets. This partial approach provides sufficient monitoring data without the excessive energy cost of full packet capture.

Inventive Principle:

Principle #16Partial or excessive action

3Loss of energy

If selective packet mirroring is implemented, then loss of energy is reduced, but measurement precision may deteriorate

Engineering Contradiction:

Improveprocessing power requirementsVSAvoidnetwork health insight accuracy

Core Design Contradiction:

Loss of energyVSMeasurement precision

Solution Approach 1:

The patent applies preliminary action by pre-configuring mirrors at switches to capture specific packet types before they reach the central server. This preliminary filtering ensures that only relevant packets are transmitted and processed, maintaining measurement precision while reducing energy consumption by avoiding unnecessary packet handling.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback mechanisms where the central server analyzes mirrored packets and generates insights about network application status, which can be used to adjust mirroring configurations. This feedback loop ensures that selective mirroring maintains adequate measurement precision by adapting to changing network conditions and requirements.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20250293959A1Systems and methods for determining flow and path analytics of an application of a network using sampled packet inspection

Publication Date: 2025.09.18 EXTREME NETWORKS INC

AI summary

Systems and methods are disclosed herein for monitoring health of each switch of a plurality of switches on a network by selectively mirroring packets transmitted by each switch of the plurality of switches. In some embodiments, control circuitry generates a plurality of mirroring parameters, each mirroring parameter comprising an instruction to mirror a respective type of packet. The control circuitry transmits the plurality of mirroring parameters to each switch of the plurality of switches on the network, and receives, from a switch, a packet that was mirrored by the switch according to a mirroring parameter of the plurality of mirroring parameters. The control circuitry determines the respective type of the packet, executes an analysis of contents of the packet based on the respective type of the packet, and determines a health of the switch based on results of the analysis.