Smart Filter Generator for Second-Order Network Traffic Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing packet brokers in visibility networks cannot filter traffic based on second-order parameters that are not explicitly present in the replicated traffic, leading to increased computational and storage requirements when analyzing such parameters, which raises costs and complexity.
Innovation Solution
Implement a smart filter generator that maintains mappings between second-order and first-order parameters, translating user-defined filters for second-order parameters into first-order parameters usable by the packet broker, enabling filtering without resource-intensive post-hoc analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If all replicated traffic is forwarded to analytic probes for post-hoc analysis to identify second-order parameters, then filtering capability based on second-order parameters is achieved, but compute and storage resources increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing mappings between first-order parameters (present in replicated traffic) and second-order parameters (not explicitly present) in a knowledge base before filtering operations. This allows the packet broker to perform efficient filtering based on second-order parameters without needing to perform resource-intensive post-hoc analysis on all replicated traffic, thus achieving filtering capability while minimizing compute and storage resource usage during operation.
Solution Approach 2:
The patent introduces a smart filter generator as an intermediary component that translates user-defined filters based on second-order parameters into equivalent filters using first-order parameters. This intermediary translates the filtering requirement from the user's perspective (second-order parameters) into the packet broker's operational language (first-order parameters), enabling efficient filtering without direct access to second-order parameters in the replicated traffic.
2Adaptability or versatility
If existing packet brokers are used without smart filter generation, then device complexity is low, but filtering capability based on second-order parameters is lost
Solution Approach 1:
The smart filter generator acts as an intermediary layer between the user and the packet broker. It receives user-defined filters based on second-order parameters, translates them into first-order parameter filters, and submits them to the packet broker. This intermediary approach enables advanced filtering capability while keeping the packet broker itself relatively simple, as the complex translation logic resides in the smart filter generator rather than requiring fundamental changes to the packet broker architecture.
Solution Approach 2:
The system performs preliminary action by pre-establishing a knowledge base containing mappings between first-order and second-order parameters. This pre-computed knowledge base allows the smart filter generator to perform translations efficiently without requiring complex real-time analysis, thus enabling enhanced filtering capability while maintaining relatively low device complexity during operation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for implementing a smart filter generator in a visibility network are provided. In one set of embodiments, the smart filter generator can maintain at least one mapping between (1) a first-order parameter found in network traffic replicated from a core network monitored by the visibility network, and (2) a second-order parameter related to the first-order parameter, where the second-order parameter is not found in the network traffic replicated from the core network. The smart filter generator can further receive, from a user, a user-defined packet filter definition comprising a filtering criterion that makes use of the second-order parameter. The smart filter generator can then translate, based on the at least one mapping, the filtering criterion into a version that makes use of the first-order parameter, and can generate a new packet filter comprising the translated version of the filtering criterion.