Traffic Profile Packet Collection Across Multiple Network Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems face challenges in efficiently capturing and managing duplicated packets from multiple nodes due to cumbersome data merging and large file sizes, which slow down troubleshooting efforts.
Innovation Solution
A server computing system with a graphical user interface allows users to define traffic profiles, transmit them to nodes, and collect duplicated packets at a centralized location, using intelligent traffic mirroring and network tunnels to manage packet capture efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If packets are captured from multiple nodes, then comprehensive packet capture views are achieved, but data merging becomes cumbersome and file sizes increase
Solution Approach 1:
The system segments packet capture by creating separate capture streams for different nodes and uses traffic profiles to divide packets into relevant and irrelevant categories. Each node captures packets independently according to its specific traffic profile, avoiding the need to merge all node data while maintaining comprehensive coverage of relevant traffic.
Solution Approach 2:
The system extracts only the relevant packets that match the traffic profile criteria from the total packet stream at each node. By applying filter criteria (protocol, port, source/destination address), the system extracts only necessary packets for analysis, reducing the volume of data that needs to be merged and stored across multiple nodes.
2Loss of information
If packets are captured from multiple nodes, then comprehensive packet capture views are achieved, but file sizes become large
Solution Approach 1:
The system extracts only relevant packets matching traffic profile criteria from each node, significantly reducing the volume of captured data. By applying filters for protocol type, port numbers, and address ranges, the system captures only necessary packets for troubleshooting rather than all packets from all nodes.
Solution Approach 2:
Each node applies its own traffic profile filters locally before capturing packets, so that each node only captures packets relevant to its specific configuration. This local filtering approach ensures that data volume at each node is minimized while maintaining the ability to reconstruct comprehensive views of relevant traffic across the network.
3Loss of information
If traffic profiles are applied to filter packets, then relevant packets are captured, but packet capture speed decreases
Solution Approach 1:
The system performs preliminary filtering of packets at each node before they are captured and transmitted to the data collector. By applying traffic profile filters locally at the node level, relevant packets are identified and separated early in the process, reducing the amount of data that needs to be processed later while maintaining capture speed.
Solution Approach 2:
The system creates copies of packets that match the traffic profile criteria and transmits only these copies to the data collector. This copying approach allows the node to maintain its normal packet processing speed while filtering and selecting only relevant packets for transmission, avoiding the bottleneck of processing all packets at the data collector.
Data Source
AI summary
A method for collecting duplicated packets from a plurality of nodes provided on a network includes receiving a traffic profile which includes one or more parameters of packets which are to be captured by the plurality of nodes. The method further includes transmitting the traffic profile to each of the plurality of nodes provided on the network and receiving duplicated packets from the plurality of nodes. The duplicated packets correspond to packets which have been duplicated from packets which are captured by the plurality of nodes and satisfy the traffic profile.