Network Traffic Filter Placement for Balanced Monitoring Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network monitoring systems lack an efficient method for automating the balanced configuration of filters to monitor production network traffic, leading to suboptimal resource utilization and increased load on monitoring fabrics.
Innovation Solution
A filter agent that interacts with production and monitoring fabric controllers to identify suitable network devices based on criteria such as hardware capabilities, resource availability, and permissions, and programs rules to balance traffic monitoring across these devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If manual configuration of monitoring filters is performed by network operators, then monitoring coverage can be achieved, but the complexity of operation increases and resource utilization becomes suboptimal
Solution Approach 1:
The system enables self-service through automated filter configuration where the monitoring fabric controller automatically discovers network devices, evaluates their capabilities, and programs optimal filter placements without manual operator intervention. The controller autonomously queries device capabilities, analyzes traffic monitoring requirements, and distributes filters to appropriate devices based on hardware resources and current load conditions.
Solution Approach 2:
The system performs preliminary action by pre-discovering and cataloging network device capabilities, hardware resources, and topology information before monitoring requirements arise. The controller maintains an updated database of device capabilities including TCAM resources, buffer sizes, and processing powers, enabling rapid automated decision-making when filter configuration is needed without manual intervention.
2Reliability
If more network devices are used for traffic monitoring, then monitoring capability is improved, but the load on the monitoring fabric increases
Solution Approach 1:
The system applies local quality by placing monitoring filters at the most appropriate network devices based on their specific capabilities and local conditions. Instead of uniform filter placement, the controller evaluates each device's hardware resources (TCAM, buffers, CPU), current load, and proximity to monitored traffic, then programs filters only on devices that can handle them efficiently, optimizing the balance between monitoring coverage and fabric load.
Solution Approach 2:
The system dynamically changes parameters by continuously monitoring device resource utilization and adjusting filter placements accordingly. When device load or resource availability changes, the controller re-evaluates and redistributes filters to maintain optimal monitoring capability while preventing any single device or the monitoring fabric from becoming overloaded, adapting to changing network conditions in real-time.
3Productivity
If filters are programmed on production network devices, then traffic capture efficiency is improved, but device resource consumption increases
Solution Approach 1:
The system applies partial action by selectively programming filters only on network devices that have sufficient unused hardware resources and appropriate capabilities. The controller evaluates each device's available TCAM entries, buffer capacity, and processing power before assigning filters, ensuring that filter placement improves traffic capture efficiency without exceeding device resource thresholds or creating excessive load on any single device.
4Productivity
If automated filter configuration is implemented, then resource utilization is optimized, but system complexity increases
Solution Approach 1:
The system achieves universality through a multi-functional monitoring fabric controller that consolidates multiple responsibilities: network device discovery, capability evaluation, filter generation, optimal placement decision-making, and automated programming. This single controller handles all aspects of automated filter configuration, reducing the need for multiple separate management systems and simplifying the overall architecture while maintaining sophisticated automation capabilities.
Data Source
AI summary
The disclosure relates to automating a balanced configuration of traffic monitoring filters to monitor traffic in a production network. A deployment in accordance with the disclosure includes a production network and a monitoring fabric. The production network includes a network controller to configure and provide information about the production network, and likewise the monitoring fabric includes a controller to configure and provide information about the monitoring fabric. A filter agent can create traffic monitoring rules that constitute user-defined traffic monitoring filters, and deploy the rules in a balanced fashion across devices in the production network and in the monitoring fabric using information queried from the production network controller and the monitoring fabric controller. The filter agent can redeploy traffic monitoring rules in response to changes in the operating environment.