Network Switch Mirror Traffic Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In communication networks, the generation of multiple mirror copies of packets leads to inefficiencies, as some analyzer tools require only a single copy, while others need all copies, causing resource overload and reduced analysis bandwidth due to the need for duplicate packet removal.
Innovation Solution
A network switch with processing circuitry that marks packets with a duplicate indication, allowing for selective forwarding of mirror copies to appropriate analyzer tools, ensuring only non-duplicate packets are sent to tools requiring a single copy and all copies are sent to those that need them, using a predefined bit in packet headers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple mirror copies of packets are generated for monitoring, then comprehensive packet analysis is enabled, but resource overload and reduced analysis bandwidth occur due to duplicate packets
Solution Approach 1:
The network switch performs preliminary action by marking packets with mirror-duplicate indications before they reach the analyzer. This allows the analyzer to receive all mirror copies initially but then selectively drop duplicates based on the pre-set markings, avoiding resource waste on processing redundant packets while maintaining complete analysis capability.
Solution Approach 2:
The invention extracts the duplicate identification function from the packet data and places it in the packet header as a separate field. This allows the analyzer to separate and process only the necessary packet information, extracting duplicate packets from the mirror traffic stream based on the markings and dropping them selectively to improve bandwidth efficiency.
2Loss of information
If all mirror copies are forwarded to analyzer tools, then complete packet data is provided, but tools requiring only a single copy experience resource overload
Solution Approach 1:
The invention applies local quality by differentiating the treatment of packets based on their duplicate status. Packets are marked with mirror-duplicate indications that allow the analyzer to locally identify which packets are duplicates and which are unique. This enables selective forwarding where tools receiving only single copies can discard marked duplicates, while tools needing all copies receive everything, optimizing resource utilization for each analyzer type.
3Productivity
If duplicate packet removal is performed at the analyzer, then resource efficiency is improved, but processing complexity and time are increased
Solution Approach 1:
The network switch performs the duplicate marking action preliminarily before packets reach the analyzer. This shifts the burden from the analyzer to perform complex duplicate detection to a simpler marking operation performed upstream. The analyzer then only needs to read the pre-set markings and drop corresponding packets, significantly reducing processing time and complexity while maintaining resource efficiency.
Data Source
AI summary
A network switch includes multiple ports that serve as ingress ports and egress ports for connecting to a communication network, and processing circuitry. The processing circuitry is configured to receive packets via the ingress ports, select one or more of the packets for mirroring, create mirror copies of the selected packets and output the mirror copies for analysis, mark the packets for which mirror copies have been created with mirror-duplicate indications, and forward the packets to the egress ports, including the packets that are marked with the mirror-duplicate indications.