VM Network Stack Mirroring for Agentless Traffic Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic inspection methods in computer systems face challenges such as the use of software agents that create bottlenecks and require high security privileges, and cloud-based node-level mirroring that is expensive and limited in granularity.
Innovation Solution
Implementing a network stack within a Virtual Machine (VM) to mirror selected network traffic without requiring any permanent agent, allowing fine-grained selection and minimal computational overhead, using a programmable mirroring module within the guest OS to duplicate and send mirrored traffic to an analyzer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software agents are used for network traffic inspection, then traffic can be monitored and inspected, but bottlenecks are created and high security privileges are required
Solution Approach 1:
The patent extracts the traffic mirroring functionality from the main network data path, creating a separate copy of traffic that can be inspected without interfering with normal network operations. This eliminates the bottleneck problem by not placing inspection demands on the primary traffic flow path.
Solution Approach 2:
The patent introduces a network stack as an intermediary layer that sits between the network adapter and the software processes. This intermediary enables traffic mirroring without requiring software agents on the actual application nodes, thereby reducing system complexity and security privilege requirements while maintaining inspection capability.
2Reliability
If cloud-based node-level mirroring is used, then traffic inspection is enabled, but high costs are incurred and granularity is limited
Solution Approach 1:
The patent segments the network traffic inspection capability to the process level within a virtual machine, allowing individual software processes to be selected for inspection. This fine-grained segmentation enables inspection of specific processes rather than requiring node-level mirroring, providing both cost efficiency and enhanced granularity.
Solution Approach 2:
The patent implements local quality by allowing different mirroring configurations for different software processes within the same virtual machine. Each process can be individually selected for traffic mirroring based on specific inspection needs, enabling precise control over which traffic is inspected without incurring full node-level mirroring costs.
3Measurement precision
If fine-grained traffic selection is implemented, then inspection precision is improved, but computational overhead increases
Solution Approach 1:
The patent performs preliminary action by establishing the network stack and configuring traffic mirroring rules in advance, before actual traffic inspection begins. This allows the system to pre-configure which processes should have their traffic mirrored, reducing computational overhead during active inspection by avoiding real-time decision-making about which traffic to capture.
Data Source
AI summary
An apparatus includes a physical network adapter and one or more processors. The physical network adapter is configured to communicate over a network. The one or more processors are configured to host a Virtual Machine (VM) that runs software processes, to run a network stack of the VM, the network stack enabling the software processes to communicate network traffic over the network via the physical network adapter, to program the network stack to mirror at least a selected part of the network traffic of one or more of the software processes, and, using the programmed network stack, to mirror at least the selected part of the network traffic for inspection.