SD-WAN Trace Monitoring for Cross-Node Anomaly Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SD-WANs face challenges in isolating and identifying traffic impairments across thousands of nodes due to the lack of efficient methods for correlating issues and dynamically isolating anomalies in application traffic, leading to performance degradation.
Innovation Solution
A method for detecting and remediating anomalies in SD-WANs using a controller, edge nodes with packet processing stages, and trace monitoring agents that generate and aggregate trace monitoring results, allowing for hierarchical anomaly detection and remediation through a user interface.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional methods are used to track and trace failures by capturing debug logs through multiple direct SSH sessions to each node, then detailed packet flow information can be obtained, but the time and energy required to correlate issues across thousands of nodes becomes prohibitive
Solution Approach 1:
The system segments the packet processing function into multiple independent stages (ingress, routing, firewall, QoS, NAT, egress) at each node. Each stage processes packets sequentially and can independently generate trace monitoring data. This segmentation allows the system to obtain detailed packet flow information without needing to correlate data from all nodes simultaneously, as each stage operates independently and contributes to the overall traceability.
Solution Approach 2:
The controller acts as an intermediary between edge nodes and administrators. It receives trace monitoring rules from administrators, distributes them to relevant nodes, collects trace monitoring results from nodes, and presents consolidated information through a user interface. This intermediary approach eliminates the need for administrators to directly connect to thousands of nodes via SSH sessions, significantly reducing the time and energy required for issue correlation while maintaining comprehensive packet flow visibility.
2Reliability
If trace monitoring is implemented at all packet processing stages, then comprehensive anomaly detection is achieved, but the complexity of the packet processing system increases
Solution Approach 1:
The trace monitoring framework is designed as a universal system that operates across all packet processing stages without requiring stage-specific custom implementations. Each stage (ingress, routing, firewall, QoS, NAT, egress) uses the same trace monitoring mechanism, allowing comprehensive anomaly detection while avoiding the complexity of implementing different monitoring approaches for each stage. The controller provides unified rule management and result aggregation, further simplifying the overall system architecture.
3Productivity
If dynamic anomaly isolation across all nodes is implemented, then real-time issue identification is improved, but the system requires sophisticated correlation mechanisms that increase operational complexity
Solution Approach 1:
The system implements feedback mechanisms where edge nodes continuously send trace monitoring results back to the controller. The controller analyzes these results in real-time and can dynamically identify anomalies across nodes. When anomalies are detected, the system can provide feedback to administrators through the user interface, enabling real-time issue identification without requiring complex manual correlation operations. The automated feedback loop simplifies operational complexity while maintaining high anomaly identification speed.
Data Source
AI summary
Some embodiments of the invention provide a method for detecting and remediating anomalies in an SD-WAN that includes a controller, an enterprise datacenter, and multiple branch sites each having at least one edge node that includes a set of packet processing stages. At the controller, the method receives from a particular node of a particular branch site a flow notification indicating detection of an anomaly on the particular node. Based on the anomaly, the method dynamically generates trace monitoring rules that specify one or more flows to be traced and provides the trace monitoring rules to the particular node and at least one other node of another branch site. From the particular node and the at least one other node, the method receives trace monitoring results collected in response to the provided trace monitoring rules, and analyzes the results to identify any anomalies and dynamic actions to correct the anomalies.