US20110087771A1 - Method, apparatus and system for a layer of stacked network captured traffic distribution devices - Google Patents
Method, apparatus and system for a layer of stacked network captured traffic distribution devices Download PDFInfo
- Publication number
- US20110087771A1 US20110087771A1 US12/898,529 US89852910A US2011087771A1 US 20110087771 A1 US20110087771 A1 US 20110087771A1 US 89852910 A US89852910 A US 89852910A US 2011087771 A1 US2011087771 A1 US 2011087771A1
- Authority
- US
- United States
- Prior art keywords
- network
- captured
- traffic distribution
- traffic
- distribution device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/12—Network monitoring probes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0803—Configuration setting
- H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
- H04L41/0816—Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/04—Processing captured monitoring data, e.g. for logfile generation
- H04L43/045—Processing captured monitoring data, e.g. for logfile generation for graphical visualisation of monitoring data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/02—Standardisation; Integration
- H04L41/0213—Standardised network management protocols, e.g. simple network management protocol [SNMP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
- H04L41/122—Discovery or management of network topologies of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/028—Capturing of monitoring data by filtering
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Mining & Analysis (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Methods, systems, computer-readable media, and devices for transmitting received captured traffic through a stacked topology of network captured traffic distribution devices are provided. An exemplary system may include a source of captured network traffic, a plurality of stacked network captured traffic distribution devices arranged in a stacked topology, and an external device. On some occasions, one or more of the network captured traffic distribution devices may be associated with unique IP address and the system may further include a web browser. The web browser may be enabled to communicate with each of the plurality of stacked network captured traffic distribution devices via their respective unique IP address.
Description
- This application is a NONPROVISIONAL of, claims priority to and incorporates by reference U.S. Provisional Patent Application 61/248,837, filed 5 Oct. 2009.
- The present invention relates to systems and methods that employ a source of captured network traffic, a plurality of stacked network captured traffic distribution devices arranged in a stacked topology, and one or more external devices.
- Traditionally, network traffic is captured locally using a mirror port present on a network switch or a network tap in conjunction with an inline traffic capture point positioned along a communication link coupling two or more communicating devices. Network traffic captured in this way is typically monitored locally, thus requiring a port on a monitor for every individual capture point and mirror port in the network. This localization leads to great infrastructure and bandwidth costs and, consequently, many networks are inadequately monitored.
- Another drawback to traditional network monitoring systems is that all captured traffic is sent to each monitoring device. With increased specialization, many conventional monitoring devices monitor a specific category or range of categories of network traffic. Thus, when a monitoring device receives all captured traffic, it is inundated with an excess of information, only a portion of which is useful. This results in an inefficient use of both bandwidth and monitoring capacity because, as a first step to monitoring the captured traffic, the monitor must first filter, or otherwise manipulate, the traffic to remove unnecessary information.
- A further drawback to traditional network monitoring systems is that conventional taps do not communicate with one another. Thus, each tap must be individually configured. In the event of a desired change in the configuration information, each tap must then be individually reconfigured.
- A system including a source of captured network traffic, a plurality of stacked network captured traffic distribution devices arranged in a stacked topology, and an external device is herein provided. The system may be compatible with, for example, a carrier Ethernet system, a network forensic security system, a carrier voice over Internet provider (VoIP) system, an Internet protocol television (IPTV) system, a network security system, a network intrusion detection system, and a telecommunications system. Exemplary arrangements for the stacked topology include a ring topology, a mesh topology, a star topology, a topology of single links, a topology of multiple links, a topology including one or more redundant links, and some combination thereof. On some occasions the source, stacked network captured traffic distribution devices, and/or external device may operate at locations that are geographically disperse from one another.
- The source may, for example, capture network traffic transmitted between two nodes and/or receive captured traffic via a mirror port of a network switch. The plurality of stacked network captured traffic distribution devices may be arranged in the stacked topology such that each network captured traffic distribution device is communicatively coupled via a communication link with at least one additional stacked network captured traffic distribution device and each stacked network captured traffic distribution device may automatically exchange configuration information with at least some of the plurality stacked network captured traffic distribution devices in the stacked topology. At least one network captured traffic distribution device of the plurality of network captured traffic distribution devices may be configured to receive captured network traffic from the source and/or transmit received captured traffic to an external device via a communication link.
- One or more of the network captured traffic distribution devices may be configured to determine a target destination for received captured network traffic, pre-calculate a route for the transmission of received captured network traffic from an origin, through the stacked topology, to a target destination, determine an optimum route for the transmission of captured network traffic from an origin, through the stacked topology, to a target destination, load balance a distribution of received captured traffic through the stacked topology, load spread a distribution of received captured traffic through the stacked topology, groom received captured network traffic, filter received network traffic according to a criterion, aggregate received network traffic, and/or evaluate a current operating condition of the stacked topology.
- The external device may be configured to receive captured network traffic from at least one of the stacked network captured traffic distribution devices via a communication link. The communication links may be, for example, an Ethernet cable, a coaxial cable, a fiber optic cable, and a wireless link and communication along one or more communication links may be bi-directional.
- In some embodiments, the system may include a plurality of external devices and each external device may be configured to, for example, monitor or analyze a category of captured network traffic. A network captured traffic distribution device included in the plurality of network captured traffic distribution devices may be configured to groom received captured traffic according to the category of captured network traffic the external device is configured to monitor or analyze. Exemplary external devices include a communication device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an Internet protocol television (IPTV) analyzer, an application analyzer, a voice analyzer, a telecommunications analyzer, and a forensic analyzer.
- On some occasions, one or more of the network captured traffic distribution devices may be associated with unique IP address and the system may further include a web browser. The web browser may be enabled to communicate with each of the plurality of stacked network captured traffic distribution devices via their respective unique IP address. The communication may include, for example, an exchange of configuration information, an association of a function with a network captured traffic distribution device and/or a port included in a network captured traffic distribution device, and a disassociation of a function with a network captured traffic distribution device and/or a port included in a network captured traffic distribution device.
- Methods, systems, computer-readable media, and devices for transmitting received captured traffic through a stacked topology of network captured traffic distribution devices are also herein provided. A stacked topology of network captured traffic distribution devices and/or a network captured traffic distribution device included in the stacked topology may receive captured network traffic from a plurality of captured network traffic sources. The received captured traffic may then be analyzed by, for example, at least one network captured traffic distribution device included in the stacked topology. A target destination of the received captured traffic may then be determined based on the analysis and the received captured traffic may be transmitted through the stacked topology toward the target destination.
- In one embodiment, one or more routes for the transmission of the received captured network traffic through the stacked topology to the target destination may be calculated. The calculated routes may then be analyzed according to, for example, one or more criterion, and an optimum route may be selected responsively to the analysis.
- In some embodiments, a route for the transmission of received captured network traffic from an origin through the stacked topology to a target destination may be pre-calculated, a distribution of received captured traffic through the stacked topology may be load balanced, an operating condition of the stacked topology or a device coupled to the stacked topology may be evaluated and/or a distribution of received captured traffic through the stacked topology may be load spread. In other embodiments, received captured network traffic transmitted through the stacked topology may be groomed, filtered, and/or aggregated.
- A network captured traffic distribution device comprising a plurality of bi-directional ports, an egress port, a stacking port, and a processor is also herein disclosed. The bi-directional ports, the egress port, and/or the stacking port may be compatible with, for example, of a 10/100 Ethernet cable, a 1 gigabit Ethernet cable, a 10 gigabit Ethernet cable, a copper cable, and/or a fiber cable.
- The plurality of bi-directional ports may be, for example, configured to receive captured network traffic and/or echo received captured network traffic to one or more of the plurality of bi-directional ports and/or an external device. The egress port may be configured to, for example, transmit received captured network traffic to an external device.
- The stacking port may be configured to enable, via a communication link, the stacking of the network captured traffic distribution device with a plurality of network captured traffic distribution devices in a stacked topology. The stacking includes an exchange of configuration information between the network captured traffic distribution device and the plurality of network captured traffic distribution devices. The stacking port may further be configured to enable the network captured traffic distribution device to be stacked in at least one of a ring topology, a mesh topology, a star topology, a topology of single links, a topology of multiple links, a topology including one or more redundant links, and some combination thereof. On some occasions, the stacking port may be a monitor port.
- The processor may be configured to, for example, manage distribution of received captured network traffic through the network captured traffic distribution device and/or the stacked topology of network captured traffic distribution devices.
- In one embodiment, the network captured traffic distribution device may include a data storage configured to store, for example, an Internet protocol (IP) address associated with the network captured traffic distribution device, configuration information for the network captured traffic distribution device, data regarding at least one additional network captured traffic distribution device included in the stacked topology, and/or data regarding at least one of received captured network traffic and management of received captured network traffic.
- In another embodiment, the network captured traffic distribution device may further include an application specific integrated circuit (ASIC) configured to, for example, distribute the captured traffic through the network captured traffic distribution device.
- The present invention is illustrated by way of example, and not limitation, in the figures of the accompanying drawings in which:
-
FIG. 1A is a block diagram illustrating an exemplary network captured traffic distribution device, in accordance with an embodiment of the present invention; -
FIG. 1B is a block diagram further illustrating an exemplary network captured traffic distribution device, in accordance with an embodiment of the present invention; -
FIG. 2 is a flowchart illustrating an exemplary process for configuring a network captured traffic distribution device to operate within a stacked topology, in accordance with an embodiment of the present invention; -
FIGS. 3A-3C are screenshots illustrating exemplary graphical user interfaces (GUIs), in accordance with an embodiment of the present invention; -
FIG. 4 is a flowchart illustrating an exemplary process for stacking two or more network captured traffic distribution devices in order to form a stacked topology, in accordance with an embodiment of the present invention; -
FIGS. 5A-5E are block diagrams depicting exemplary stacked topologies of network captured traffic distribution devices, in accordance with embodiments of the present invention; -
FIG. 6A is a flowchart illustrating an exemplary process for the transmission of captured network traffic via a stacked topology, in accordance with an embodiment of the present invention; -
FIG. 6B is a block diagram illustrating an exemplary system for capturing network traffic, in accordance with an embodiment of the present invention; -
FIGS. 7A and 7B are block diagrams illustrating exemplary stacked topologies of network captured traffic distribution devices configured as a layer intervening between a communication infrastructure layer and an external device layer, in accordance with an embodiment of the present invention; -
FIGS. 8A-8C are diagrams illustrating exemplary carrier Ethernet systems utilizing a stacked topology of network captured traffic distribution devices, in accordance with an embodiment of the present invention; -
FIGS. 9A-9C are diagrams illustrating exemplary carrier VoIP systems utilizing a stacked topology of network captured traffic distribution devices, in accordance with an embodiment of the present invention; -
FIGS. 10A-10C are diagrams illustrating exemplary IPTV systems utilizing a stacked topology of network captured traffic distribution devices, in accordance with an embodiment of the present invention; -
FIGS. 11A-11C are diagrams illustrating exemplary security systems utilizing a stacked topology of network captured traffic distribution devices, in accordance with an embodiment of the present invention; -
FIG. 12 is a flowchart illustrating an exemplary process for inserting a VLAN tag into a data packet, in accordance with an embodiment of the present invention; -
FIGS. 13A and 13B are diagrams illustrating exemplary data packets, in accordance with an embodiment of the present invention; -
FIG. 14 is a flowchart illustrating an exemplary process for determining an optimum route through a stacked topology of network captured traffic distribution devices, in accordance with an embodiment of the present invention; -
FIG. 15 is a flowchart illustrating an exemplary process for determining an optimum route through a stacked topology of network captured traffic distribution devices, in accordance with an embodiment of the present invention; -
FIG. 16 is a block diagram illustrating an exemplary stacked topology of network captured traffic distribution devices, in accordance with an embodiment of the present invention; -
FIG. 17 is a flowchart illustrating an exemplary process for filtering captured network traffic, in accordance with an embodiment of the present invention; -
FIG. 18 is a flowchart illustrating a process for filtering and aggregating captured network traffic, in accordance with an embodiment of the present invention; -
FIG. 19 is a flowchart illustrating an exemplary process for aggregating captured network traffic, in accordance with an embodiment of the present invention; -
FIG. 20 is a flowchart illustrating an exemplary process for aggregating captured network traffic, in accordance with an embodiment of the present invention; -
FIGS. 21A and 21B are flowcharts illustrating exemplary processes for monitoring a stacked topology of network captured traffic distribution devices, in accordance with an embodiment of the present invention; and -
FIG. 22 is a flowchart depicting an exemplary process for exchanging configuration information between two or more network captured traffic distribution devices included in a stacked topology, in accordance with an embodiment of the present invention. -
FIG. 1A is a block diagram illustrating an exemplary network capturedtraffic distribution device 100. Network capturetraffic distribution device 100 may include a plurality ofbidirectional ports 110, a plurality ofegress ports 120, a plurality of stacking 130 ports, amanagement port 140, and apower input 150. -
Bidirectional ports 110 may be connected, via a communication link, to one or more sources of captured network traffic and may be compatible with, for example, a 10/100 Ethernet cable, a 1 gigabit (Gb) Ethernet cable, a 10 Gb Ethernet cable, a copper cable, a fiber optic cable and/or any combination thereof.Egress port 120 may be coupled to one or more external devices such as a monitoring device, a network analyzing device, a communication device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an Internet protocol television (IPTV) analyzer, an application analyzer, a voice analyzer, a telecommunications analyzer, and a forensic analyzer via a communication link such as a 10/100 Ethernet cable, a 1 Gb Ethernet cable, a 10 Gb Ethernet cable, a copper cable, a fiber optic cable and/or any combination thereof. On some occasions, one ormore egress ports 120 may be configured as a monitor port or network analyzer port such that it is compatible with, for example, one or more external network monitor or analysis devices. In some cases, information associated withbidirectional ports 110 and/oregress ports 120 may be provided to a user and/or administrator via a user interface such as a graphic user interface (GUI) as discussed below with regard toFIGS. 3A-3C and/or an Internet browser. - Stacking
ports 130 may enable the stacking of network capturedtraffic distribution device 100 with one or more additional network captured traffic distribution devices arranged in a stacked topology. Stacking a network captured traffic distribution device may include, but is not limited to, an exchange of data and configuration information between two or more communicatively coupled, or stacked, network captured traffic distribution devices. Stackingport 130 may be compatible with, for example, a 10/100 Ethernet cable, a 1 Gb Ethernet cable, a 10 Gb Ethernet cable, a copper cable, a fiber optic cable, and/or any combination thereof. In some embodiments, stackingports 130 may be similar toegress ports 120. -
Power input 150 may be any appropriate device via which electrical power may be supplied to network capturedtraffic distribution device 100 such as, but not limited to, an electric plug or an electric cable that may be coupled to a conventional electric wall outlet. - Network captured
traffic distribution device 100 may be coupled to one or more networks such as a telecommunications network, a carrier Ethernet network, a voice over Internet protocol (VoIP) network, the Internet, a local area network (LAN), and/or a wireless LAN (WLAN) via one or morebidirectional ports 110 and/oregress ports 120. -
Management port 140 may be coupled directly and/or indirectly to a user and/or administrator (i.e., a device accessible to/employed by such an individual) of network capturedtraffic distribution device 100 and/or a stacked topology of which network capturedtraffic distribution device 100 is a member. Instructions and/or information may be received by network capturedtraffic distribution device 100 viamanagement port 140. Additionally or alternatively, configuration information associated with network capturedtraffic distribution device 100 and/or one or more functions performed by network capturedtraffic distribution device 100 may be accessed or managed via a graphical user interface (GUI) such asGUI FIGS. 3A through 3C . -
FIG. 1B is a block diagram of a network capturedtraffic distribution device 100 configured in accordance with an embodiment of the present invention. Network capturedtraffic distribution device 100 includesbidirectional ports 110,management port 140,egress ports 120, stackingports 130 andpower input 150.Bidirectional ports 110 may be connected to an application specific integrated circuit (ASIC) 160.ASIC 160 may be configured to distribute captured network traffic through network capturedtraffic distribution device 100. In some embodiments,ASIC 160 may be one or more analog or electric field effect transistor switches.ASIC 160 may further be configured to perform one or more switching functions thereby facilitating the switching and/or distribution of captured network traffic through network capturedtraffic distribution device 100 and/or the echoing of captured network traffic via one or morebidirectional ports 110.ASIC 160 may be coupled to aprocessor 170.Processor 170 may be any appropriate computer-processing device or devices such as a microprocessor, digital signal processor or similar device. -
Processor 170 may be configured (e.g., under the control of suitable computer-executable instructions) to manage the distribution of received captured network traffic through the network capturedtraffic distribution device 100 and may be coupled to one or more data storage devices ormemories 180. Distribution management executed byprocessor 170 may include, for example, the management of a flow of received captured traffic through network capturedtraffic distribution device 100 and/or a stacked topology that includes network capturedtraffic distribution device 100. Optionally, the distribution management may include, for example, determining a target destination for received captured network traffic; pre-calculating at least one route for the transmission of received captured network traffic from network capturedtraffic distribution device 100, through the stacked topology, to a target destination; determining an optimum route for the transmission of captured network traffic from network capturedtraffic distribution device 100, through the stacked topology, to a target destination; load balancing a distribution of received captured traffic through network capturedtraffic distribution device 100 and/or the stacked topology, load spreading a distribution of received captured traffic through network capturedtraffic distribution device 100 and/or the stacked topology and evaluating the current operating conditions of the stacked topology. - In some cases,
processor 170 may also be configured to groom received captured traffic. Grooming received captured traffic may include, for example, filtering received captured network traffic transmitted through network capturedtraffic distribution device 100 and/or the stacked topology according to one or more criteria, aggregating received captured network traffic with the same target destination, and modifying the content of one or more data packets included in the received captured traffic. Exemplary modification of the content of a data packet include adding data to the data packet, subtracting data from the data packet, truncating the data packet, and modifying data included in the data packet. - The
processor 170 may further be configured to enable peer-to-peer communication and/or peer-to-peer management between network capturedtraffic distribution device 100 and an additional stacked network captured traffic distribution device included in a stacked topology. In some instances,processor 170 may be enabled to manage the distribution of received captured network traffic through a stacked topology of network captured traffic distribution devices. -
Memory 180 may be coupled, directly or indirectly, toprocessor 170 and/orASIC 160 and may store one or more instructions executable byprocessor 170 and/orASIC 160.Memory 180 may be configured to store an Internet protocol (IP) address assigned to network capturedtraffic distribution device 100. In some embodiments, the IP address assigned to network capturedtraffic distribution device 100 may be unique for each individual network captured traffic distribution device present in a stacked topology.Memory 180 may further store, for example, configuration information associated with network capturedtraffic distribution device 100, data regarding captured network traffic received by network capturedtraffic distribution device 100, and the distribution and/or management of received captured network traffic by network capturedtraffic distribution device 100. - One or more stacking
ports 130 may be configured to enable network capturedtraffic distribution device 100 to be stacked and/or communicatively coupled to at least one additional network captured traffic distribution device in a stacked topology. Exemplary configurations for stacked topologies include, but are not limited to, a ring topology, a mesh topology, a star topology, a topology of single links, a topology of multiple links, a topology including one or more redundant links, and/or any combination thereof. In some cases, stackingports 130 may be configured as a monitoring port and may be compatible with one or more external devices. - When two or more network captured
traffic distribution devices 100 are communicatively coupled, or stacked, in a topology, configuration information resident in one or more of network capturedtraffic distribution devices 100 may be exchanged between the two or more network capturedtraffic distribution devices 100. Exemplary configuration information may relate to, for example, the operation of the network captured traffic distribution device, the stacked topology, and/or a device or network coupled to the network captured traffic distribution device. For example, configuration information may include operational statistics associated with network capturedtraffic distribution device 100 such as an available ingress or egress transmission speed, a number of ports available, a level of congestion for ingressing or egressing traffic, and an indicator of whether network capturedtraffic distribution device 100 is fully or partially operational. - Optionally, configuration information may also include instructions regarding the determination of a target destination, such as an external device and/or an egress port resident in the network captured traffic distribution device for captured network traffic. On some occasions, configuration may relate to the pre-calculation of at least one route for the transmission of received captured network traffic from a location, such as a source of network captured network traffic, network captured
traffic distribution device 100, or a port resident in network capturedtraffic distribution device 100, through the stacked topology, to a target destination or the retrieval of one or more pre-calculated routes from a data source such asmemory 180 or an external device. - Configuration information may also relate to the determining an optimum route for the transmission of captured network traffic through the stacked topology to a target destination, load balancing a distribution of received captured traffic through the network captured traffic distribution device and/or stacked topology, load spreading a distribution of received captured traffic through the network captured traffic distribution device and/or stacked topology, grooming received captured traffic according to one or more criterion, filtering received captured network traffic according to one or more criterion, aggregating the received captured network traffic according to one or more criterion, and evaluating current operating conditions of the stacked topology and/or devices coupled to the stacked topology.
-
FIG. 2 is a flowchart illustrating anexemplary process 200 for the configuration of one or more ports resident in a stackable network captured traffic distribution device, such as network capturedtraffic distribution device 100, as a stacking port. Execution ofprocess 200 may enable the stacking of the network captured traffic distribution device with one or more additional network captured traffic distribution devices.Process 200 may be executed by any of the systems and/or devices described herein and may be executed via, for example, a command line interface, a GUI like GUIs 300-302 as discussed below with reference toFIGS. 3A-3C , and/or instructions provided via, for example, management port 140 a GUI. - In
step 205, access to one or more ports of the network captured traffic distribution device may be provided to a user and/or administrator, wherein at least one of the ports is a stacking port. Access may be provided via, for example, physical access to the ports, a processor resident in the network captured traffic distribution device, likeprocessor 170, a management port, likemanagement port 140 and/or a display device such as video monitor and/or a computer monitor. Access to the one or more ports may be facilitated by a network, such as a LAN, a WLAN, or the Internet. In Internet applications, access to the one or more ports may be facilitated by via an Internet browser using, for example, a unique IP address associated with the network captured traffic distribution device. In some cases, access to the ports may be provided via an interactive list displayed on a GUI, such as GUI 300-302 as discussed below with regard toFIGS. 3A-3C . - Then, in
step 210, a selection of a port to be configured as a stackable port may be received. This selection may be received from a user and/or administrator via the medium by which access to the ports is provided. Such a selection may be made by, for example, physically connecting a port to a communication link and/or additional network captured traffic distribution device or selecting a port provided via a GUI. In some cases,process 200 may also include receiving an instruction to associate a function with at least one port of the network captured traffic distribution device and associating the selected function with the at least one port according to the received instruction. - Next, in
step 215, the selected port may be configured as a stacking port. Step 215 may be executed by the network captured traffic distribution device. Then, instep 220, communication between the configured stacking port and a stacking port resident on an additional network captured traffic distribution device may be enabled. This may be enabled by, for example, the turning on of the communication, and/or the completion of a physical coupling between the two network captured traffic distribution devices and/or the selection or finalization of a selection by a user when selecting a port to be configured as a stackable port via, for example, a GUI. Once communication between the two stacking ports is established, the network captured traffic distribution device forms a stacked topology with the additional network captured traffic distribution device or becomes a member of an existing stacked topology including the additional network captured traffic distribution device. Followingstep 220,process 200 may end. -
FIGS. 3A through 3C are screenshots of exemplary GUIs 300-302 that may be used to stack, or communicatively couple, two or more network captured traffic distribution device like network capturedtraffic distribution device 100 in a stacked topology, and/or add the network captured traffic distribution device to an existing stacked topology. In some embodiments, GUIs 300-302 may be used to facilitate (e.g., through manipulation of the graphical elements rendered therein or provision of information therethrough) any of the processes described herein. -
FIG. 3A illustrates anexemplary GUI 300 that includes a status summary for three network captured traffic distribution devices like network capturedtraffic distribution device 100 that are included in a stacked topology. At the top ofGUI 300 is adialog box 305 indicating an exemplary IP address for one of the network captured traffic distribution devices included in the stacked topology.Window 310 includes information relevant to the stacked topology such as aninteractive menu 315 of options and/or functions available viaGUI 300 and aninteractive list 320 of network captured traffic distribution devices included in the stacked topology. -
Interactive menu 315 may include multiple options relating to use ofGUI 300 such that selection of a menu item displayed ininteractive menu 315 may initiate the display of various additional GUIs relating to the selected menu option. Exemplary options included ininteractive menu 315 relate to the status of a network topology, the settings of a network topology including, but not limited, to system settings, port settings, simple network management protocol (SNMP) settings, access control settings, filter settings, a filter library, an option to save settings and an option to load setting.Interactive menu 315 may also include selectable options relating to technical assistance or support, such as help software, available to a user of the network captured traffic distribution device and a link to contact a support service for the network captured traffic distribution device.Interactive menu 315 may also include an option for a user and/or administrator to log in and/or log out ofGUI 300, the network captured traffic distribution device, and/or the stacked topology and may also include model and/or software identifying information relevant to the network captured traffic distribution device. -
Interactive list 320 may include one or more boxes or windows of information relating to one or more network captured traffic distribution devices included in the stacked topology. For example,interactive list 320 includes a listing of information related to a network capturedtraffic distribution device 1 which indicates that port M1 connects network capturedtraffic distribution device 1 to network capturedtraffic distribution device 2 325. Likewise, similar information is displayed for network capturedtraffic distribution devices -
FIG. 3B illustrates anexemplary GUI 301 that includes selectable options that enable access to port settings for a selected network captured traffic distribution device.GUI 301 includesdialog box 305 indicating an exemplary IP address for one of the network captured traffic distribution devices included in the stacked topology andinteractive menu 315. -
GUI 301 further includes and awindow 340 displaying a list ofselectable tabs 345 relating to ingress or bidirectional ports, likebidirectional ports 110 associated with a network captured traffic distribution device and a list ofselectable tabs 350 relating to egress and/or monitoring ports, likeegress ports 120 associated with the network captured traffic distribution device. By selecting one of the tabs provided inlists 345 and/or 350 a user may access information related to the port associated with the selected tab. This information may include, for example, an ingressing and/or egressing port speed, port identifying information, a port type, a port class and a selectable stackingoption 355 which may enable the port to be configured as either a monitor port or a stacking port. For example, when port M1 is selected fromlist 350, information associated with port M1 is displayed inwindow 340.Window 340 may further include asave button 360 that, when selected, initiates the saving of any changes to the configuration of the port. -
FIG. 3C is a screenshot of anexemplary GUI 302 showing an interactive list of ports available on a network captured traffic distribution device and an interactive list of functions that may be associated with one or more ports provided in the interactive list of ports.GUI 302 may includeinteractive menu 315, a list ofavailable filters 380, alist 385 of bidirectional ports, alist 390 of egress/monitor ports and a plurality ofdelete options 395. -
Exemplary filter list 380 may include one or more drop down boxes that may include various selectable filtering options, such as a filter for HTTP traffic, telnet traffic, and/or non-match received captured traffic. Additional functions that may be included infilter list 380 and/or on a separate selectable list provided viaGUI 302 include, but are not limited to, determining a target destination for received captured traffic, pre-calculating a route for the transmission of received captured traffic from the network captured traffic distribution device, through the stacked topology, to a target destination, determining an optimum route, load balancing a distribution of received captured traffic through the stacked topology, load spreading a distribution of received captured traffic through the stacked topology, grooming the received captured traffic according to one or more criteria, filtering the received captured traffic, and aggregating received captured traffic transmitted through the stacked topology. -
Bidirectional port list 385 may include selectable options for one or more bidirectional ports included in the network captured traffic distribution device and egress/monitor port list 390 may include a list of egress/monitor ports included in the network captured traffic distribution device and/or an additional network captured traffic distribution devices available or connected to network topology. Selection of adelete option 395 may initiate the deletion of one or more selectable options available viaGUI 302. -
FIG. 4 is a flowchart illustrating an exemplary process 400 for establishing or setting up a stacked topology of two or more network captured traffic distribution devices, like network capturedtraffic distribution device 100 and/or adding a network captured traffic distribution device to an existing stacked topology. Process 400 may be executed by any of the systems and/or devices described herein. - In
step 405, instructions to enable the stacking of a first and second network captured traffic distribution device may be received by, for example, a first network captured traffic distribution device, such as network capturedtraffic distribution device 100, or a processor, such asprocessor 170. The instructions ofstep 405 may be received from, for example, a user or administrator via, for example, a GUI such asGUIs memory 180, and/or a physical link between the first and second network captured traffic distribution devices. - Then, in
step 410, the first and second network captured traffic distribution devices may be stacked and/or communicatively coupled according to the instructions received instep 405. The stacking of the first and second network captured traffic distribution device may form a new stacked topology or add the first network captured traffic distribution device to an existing stacked topology including the second network captured traffic distribution device. Exemplary stacked topology configurations include a ring topology, a mesh topology, a star topology, a topology of single links, a topology of multiple links, a topology including one or more redundant links and/or any combination thereof. - Next, in
step 415, configuration information may be exchanged between the first and second network captured traffic distribution devices and/or between the first network captured traffic distribution device and the stacked topology of network captured traffic distribution devices. The configuration information exchanged may include, for example, instructions regarding a determination of a target destination for received captured network traffic, a pre-calculation of one or more routes for the transmission of received captured network traffic from the first network captured traffic distribution device, through the stacked topology, to a target destination, and a determination of an optimum route for the transmission of received captured network traffic from the first network captured traffic distribution device, through the stacked topology, to a target destination. - Exchanged configuration information may also include instructions regarding the grooming of received captured network traffic. Grooming received captured network traffic may include manipulating a traffic flow of received captured traffic and/or a data packet included in the traffic flow of received captured traffic according to one or more instructions or criterion. For example, grooming received network traffic may include removing unwanted information from one or more data packets included in the received captured network traffic, truncating one or more data packets included in the received captured network traffic, filtering the received captured network traffic according to a criterion, aggregating data packets and/or sets of data packets included in the received captured network traffic, altering the content of the received captured network traffic, modifying a data packet included in the received captured traffic so that it is compatible with one or more external devices, truncating one or more data packets included in the received captured network traffic, adding information to one or more data packets included in the received captured network traffic, and subtracting information from one or more data packets included in the received captured network traffic.
- Exchanged configuration information may further include instructions regarding load balancing a distribution of the received captured network traffic through a network captured traffic distribution device and/or stacked topology and load spreading a distribution of the received captured network traffic through a network captured traffic distribution device and/or stacked topology.
- Exchanged configuration information may also include information regarding the capabilities, such as current operating conditions, of the first or second network captured traffic distribution device, a communication link between the first and second network captured traffic distribution device, and a stacked topology including the second network captured traffic distribution device. For example, exchanged configuration information may include information regarding the link speed of a port included in the first or second network captured traffic distribution device or a communication link between the first and second network captured traffic distribution device, a number of ports included in the first and/or second network captured traffic distribution device, configuration information associated with a port of the first or second network captured traffic distribution device, routing information, and information regarding a failure or error within the stacked topology and/or first or second network captured traffic distribution device.
- Next, in
step 420, one or more routes for the transmission of captured network traffic from the first network captured traffic distribution device, through the stacked topology, to a target destination may be determined or calculated. Exemplary target destinations include another network captured traffic distribution device included in the stacked topology, external devices, monitoring devices, protocol analyzers, flight recorders, intrusion detection systems, media analyzers, signaling analyzers, web analyzers, database analyzers, voice signaling analyzers, IPTV analyzers, application analyzers, voice analyzers and forensic analyzers. In some embodiments, received captured traffic may be groomed prior to its transmission toward its target destination. Then, instep 425, at least one optimum route through the stacked topology may be determined. Further details regarding the determination of an optimum route are provided below with regard toFIGS. 14 and 15 . - Finally in
step 430, the received captured network traffic may be transmitted from the first network captured traffic distribution device toward a target destination via, for example, the determined optimum route ofstep 425. Followingstep 430, process 400 may end. -
FIGS. 5A through 5E are block diagrams illustrating exemplary stacked topologies of network captured traffic distribution devices, like network capturedtraffic distribution device 100.FIG. 5A illustrates an exemplarystacked topology 501 of two network capturedtraffic distribution devices 100 communicatively coupled, or stacked, via acommunication link 500.Communication link 500 may be wired or wireless and may be enabled to facilitate communication between the network capturedtraffic distribution devices 100. For example,communication link 500 may be a wireless link capable of transmitting network traffic at a rate of, for example, 1 or 10 Gb/s or a wired link such as a 10/100 Ethernet cable, a 1 Gb Ethernet cable, a 10 Gb Ethernet cable, a copper cable, and/or a fiber cable. -
FIG. 5B illustrates an exemplarystacked topology 502 of two network captured traffic distribution devices communicatively coupled via twocommunication links 500. Instacked topology 501,communication links 500 may link two separate stacking ports resident on each of network capturedtraffic distribution devices 100 and, on some occasions,communication links 500 may be redundant and/or communication along communication links may be similar or redundant. -
FIG. 5C illustrates network capturedtraffic distribution devices 100 arranged in an exemplary complex, or mesh, stackedtopology 503. Complex, or mesh, stackedtopology 503 includes four network capturedtraffic distribution devices 100 coupled viamultiple communication links 500 such that every network capturedtraffic distribution device 100 is communicatively coupled, directly and/or indirectly, to every other network capturedtraffic distribution device 100 included instacked topology 503. -
FIG. 5D illustrates network an exemplary ring stackedtopology 504 wherein five network captured traffic distribution devices are communicatively coupled to one another in a round-robin or ring configuration arrangement via communication links 500. -
FIG. 5E illustrates an exemplary star stackedtopology 505 wherein five network capturedtraffic distribution devices 100 are communicatively coupled to one another in a star shaped arrangement via communication links 500. -
FIG. 6A illustrates aprocess 600 for the transmission of captured network traffic via a stacked topology using a layered approach.Process 600 may be executed by, for example, any system or device disclosed herein. - In step 1606, captured network traffic may be received by, for example, a network captured traffic distribution device included in a stacked topology, like network captured
traffic distribution device 100. The captured traffic may be received from one or more sources and, instep 611, it may be determined whether the source of the received captured network traffic is, for example, an inline traffic capture point, such as inline capturedtraffic point 665 or a mirror port, such as mirror port 660 (seeFIG. 6B ). When the captured network traffic is received via an inline capture point, the received captured network traffic may be echoed to a bidirectional port, such asbidirectional port 110, for eventual transition to, for example, a communication device intended to receive the network traffic prior to its capture (step 616). - Whether the network captured traffic is received via an inline capture point or a mirror port, the received captured traffic may be analyzed according to, for example, one or more criteria (step 621). The analysis of
step 621 may include determining whether a VLAN tag was inserted into a captured network data packet included in the received captured network traffic, as discussed below with regard toprocess 1200 andFIG. 12 . Then, instep 626, a target destination of the received captured traffic may be determined based on, for example, the analysis ofstep 621. In some cases, received captured traffic may have multiple target destinations such as multiple external devices. - Next, in
step 631, one or more routes for the transmission of the received captured network traffic from the network captured traffic distribution device, through the stacked topology, to the target destination determined via, for example, step 626 may be determined. The determined routes may then be analyzed (step 636) and an optimum route may be selected (step 641) based on, for example, the analysis ofstep 636. Further details regarding the analysis ofstep 636 and the selection of an optimum route (step 641) are provided below inprocesses FIGS. 14 and 15 . - On some occasions, the received captured traffic may be groomed and/or modified according to one or more criteria or instructions (step 646). Finally, in
step 651, the received and/or groomed captured traffic may be transmitted from the network captured traffic distribution device through the stacked topology toward the target destination. Followingstep 651,process 600 may end. -
FIG. 6B is block diagram depicting anetwork communication system 600.System 600 may be, for example, any network system capable of transmitting and/or receiving data packets. In one embodiment,system 600 is a telecommunication system such as a Global System for Mobile communication (GSM) system or a multi-protocol label switching (MPLS) system. In some embodiments,system 600 may be Gateway General Packet Radio Service (GPRS) system, an Enhanced Data Rates for GSM Evolution (EDGE) system, an Enhanced GPRS (EGPRS) system, an International Mobile Telecommunications-2000 (IMT-2000) system, an IMT Single Carrier (IMT-SC) system, an Universal Mobile Telecommunications System (UMTS) system, a Long Term Evolution (LTE) system, a Code Division Multiple Access (CDMA) system, a system compliant with the IEEE 802.1 Q standard for configuring virtual LANs (VLAN), or a system enabled to transmit and/or receive data packets including VLAN tags.System 600 may also be, for example, a carrier Ethernet system, an IPTV system, a network security system, and/or a VoIP system. -
System 600 may include two ormore communication devices 610 coupled to one another via communication links 500.Communication devices 610 may be any device capable of generating, receiving, transmitting, and/or forwarding network traffic or a data packet, such asdata packet 640 to, for example, anothercommunication device 610 and/or arouting device 620 viacommunication link 500.Exemplary communication devices 610 include personal computers, mobile computing devices, and mobile telephones.Data packet 640 may be any type of data packet or amount of data transmitted viasystem 600.Communication device 610 may also receivedata packet 640 viacommunication link 500 from anothercommunication device 610 and/orrouting device 620.Routing device 620 may be any router enabled to route data packets throughcommunication system 600. - One or
more communication devices 610 may be coupled to a network capturedtraffic distribution device 100 viacommunication link 500. Exemplary network capturedtraffic distribution devices 100 include network captured traffic distribution devices, network taps, network bypass devices, network fail-safe devices, link bypass appliances, and firewalls. - Network captured
traffic distribution device 100 may also be communicatively coupled so as to provide information to and/or receive instructions from a user and/oradministrator 655. User/administrator 655 may be, for example, a user and/or administrator ofsystem 600 and/or network capturedtraffic distribution device 100. - Network captured
traffic distribution device 100 may be communicatively coupled viacommunication link 500 to amirror port 660 present onrouting device 620 and may receive a traffic flow of captured data packets, includingdata packet 640, from routingdevice 620 viamirror port 660. Network capturedtraffic distribution device 100 may also be communicatively coupled to an inlinetraffic capture point 665 located along a communication link betweencommunication devices 610 and/or betweencommunication device 610 androuting device 620. Network capturedtraffic distribution device 100 may capture data packets, likedata packets 640 and/or receive captured data packets, via inlinenetwork traffic point 665. Network capturedtraffic distribution device 100 may further be coupled anexternal device 650 via, for example, an egress port. Exemplaryexternal devices 650 include a network monitor, a network analyzing device, a communication device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an Internet protocol television (IPTV) analyzer, an application analyzer, a voice analyzer, a telecommunications analyzer, and a forensic analyzer. Network capturedtraffic distribution device 100 may also echo one or more data packets to, for example,communication device 610 and/orexternal device 650. -
FIG. 7A is a block diagram illustrating alayered system 700 including an exemplary stacked topology of network captured traffic distribution devices wherein the stacked topology is a layer intervening between a layer of communication infrastructure devices and a layer of external devices such as monitoring devices and/or analyzing devices.System 700 includes three layers; acommunication infrastructure layer 710, a capturedtraffic distribution layer 720, and anexternal device layer 730. -
Communication infrastructure layer 710 includes a plurality ofcommunication infrastructure device 620, such as routers and switches. One ormore communication devices 620 may be communicatively coupled with one another, and/or one or more network capturedtraffic distribution devices 100 as included in the capturedtraffic distribution layer 720 via, for example, inlinetraffic capture point 665 ormirror port 660. Capturedtraffic distribution layer 720 may include multiple network capturedtraffic distribution devices 100 arranged in a stacked topology. Some, or all, network capturedtraffic distribution devices 100 may further be communicatively coupled to one or more large capacity network capturedtraffic distribution devices 705. Large capacity network capturedtraffic distribution devices 705 may be capable of, for example, aggregating captured network traffic received from a plurality of network capturedtraffic distribution devices 100, filtering captured network traffic received from a plurality of network capturedtraffic distribution devices 100 and/or grooming captured traffic received from a plurality of network capturedtraffic distribution devices 100. On some occasions, large capacity network capturedtraffic distribution device 705 may groom or specifically tailor the network captured traffic transmitted to anexternal device 650 according to one or more criteria specific to theexternal device 650. One or more large capacity network capturedtraffic distribution devices 705 may be communicatively coupled to one or more external devices as provided inexternal device layer 730. -
FIG. 7B is a diagram illustrating an exemplarylayered system 701 including an exemplary stacked topology of network captured traffic distribution devices wherein the stacked topology is a layer intervening between a layer of communication infrastructure devices and a layer of external devices such as monitoring devices and/or analyzing devices.System 701 includescommunication infrastructure layer 710, capturedtraffic distribution layer 720, andexternal device layer 730. Some or all communication links included insystem 701 may include an inlinetraffic capture point 665. -
Communication infrastructure layer 710 includes agateway layer 735, acore layer 740, adistribution layer 745, and anaccess layer 750.Gateway layer 735 may include, for example, anetwork cloud 760 communicatively coupled to a plurality offirewalls 755 that are communicatively coupled via a communication link, likecommunication link 500, to a plurality ofcommunication infrastructure devices 620.Communication infrastructure devices 620 ofgateway layer 735 may be communicatively coupled via a communication link, likecommunication link 500, to a plurality ofcommunication infrastructure devices 620 included incore layer 740.Communication infrastructure devices 620 ofcore layer 740 may be communicatively coupled via a communication link, likecommunication link 500, to a plurality ofcommunication infrastructure devices 620 included indistribution layer 745.Communication infrastructure devices 620 ofdistribution layer 745 may be communicatively coupled via a communication link, likecommunication link 500, to a plurality ofcommunication infrastructure devices 620 included inaccess layer 750. - One or more
communication infrastructure devices 620 ofcommunication infrastructure layer 710 may be communicatively coupled via, for example, a communication link, like communication link 500 or inlinetraffic capture point 665 or a mirror port, likemirror port 660, to one or more network capturedtraffic distribution devices 100 included in capturedtraffic distribution layer 720. Capturedtraffic distribution layer 720 may include a plurality of network capturedtraffic distribution devices 100 communicatively coupled to one another or arranged in a stacked topology via communication links 500. Network capturedtraffic distribution devices 100 may be further coupled to large capacity network traffic captureddistribution devices 705. Large capacity network capturedtraffic distribution devices 705 may be coupled to acentral management device 780 via amanagement communication link 765.Management communication link 765 may be any appropriate wired or wireless link that enables communication between high capacity network capturedtraffic distribution device 705 andcentral management device 780. Exemplarycentral management devices 780 include a computer monitor or computer system as may be managed by a user and/or administrator such asuser administrator 655. Large capacity network capturedtraffic distribution devices 705 may be further coupled to one or moreexternal devices 650 as included inexternal device layer 730. -
FIGS. 8A through 8C are diagrams illustrating exemplary carrier Ethernet embodiments of the present invention.FIG. 8A is a diagram illustrating acarrier Ethernet system 801 including a plurality ofcommunication devices 610, or structures that supportcommunication devices 610 such as residences, office buildings and antennas, via which multiple users are communicatively coupled via a communication link, likecommunication link 500, to one or morecommunication infrastructure devices 620. Exemplarycommunication infrastructure devices 620 included insystem 801 are switches, routers, Ethernet network intrusion devices (NID), edge routers, and optical line termination (OLT)devices 815. A plurality ofcommunication infrastructure devices 620 ofsystem 801 may be arranged in a topology, such as a local metro ring, via communication links, like communication links 500. - Communication links between
communication infrastructure devices 620 and/or betweencommunication infrastructure devices 620 andcommunication devices 610 may be communicatively coupled to a stacked topology of network capturedtraffic distribution devices 100 via, for example, inline traffic capture points 665. The stacked topology of network capturedtraffic distribution devices 100 may also be coupled to one or moreexternal devices 650 via communication links, like communication links 500. -
FIG. 8B is a diagram illustrating acarrier Ethernet system 802 of the present invention. InFIG. 8B a plurality ofcommunication devices 610, such as wireless antenna are communicatively coupled to one or morenetwork security devices 810, such as a network forensic security device or a network intrusion detection device.Network security devices 810 may then be coupled via communication links, likecommunication links 500, to one orcommunication infrastructure devices 620 arranged in a local metro ring topology. One or more ofcommunication infrastructure devices 620 located along the local metro ring may be communicatively coupled to, for example, a public switched data network (PSDN) 825 and/or a radio network controller (RNC) 820 via communication links, like communication links 500.PSDN 825 andRNC 820 may also be communicatively coupled to one another via communication links, like communication links 500. Along these communication links may be one or more inline traffic capture points 665. Network traffic capture points 665 may be communicatively coupled to one or more network capturedtraffic distribution devices 100 arranged in a stacked topology. Network capturedtraffic distribution devices 100 may also be coupled to large capacity network capturedtraffic distribution devices 705 via communication links, like communication links 500. Large capacity network capturedtraffic distribution devices 705 may also be communicatively coupled to one or moreexternal devices 650. -
FIG. 8C is a diagram illustrating a layeredcarrier Ethernet system 803.Carrier Ethernet system 803 includes five layers; acommunication device layer 830,communication infrastructure layer 710, amedia communication layer 835, capturedtraffic distribution layer 720, andexternal device layer 730. Devices included in the layers ofsystem 803 may be communicatively coupled via communication links like communication links 500. One or more of the communication links insystem 803 may include inlinetraffic capture point 665. -
Communication device layer 830 includesmultiple communication devices 610, such as a triple play fiber to the home (FTTH)/very high bit rate DSL (VDSL) device, a wireless backhaul antenna, commercial or business Ethernet services. -
Communication infrastructure layer 710 may include three layers; anaccess layer 750,IP edge layer 745, and an IP/MPLS core layer 740.Access layer 750 may include multiplecommunication infrastructure devices 620, such as routers, PC-MAN routers, and switches that are communicatively coupled tocommunication infrastructure devices 620 included inIP edge layer 745.Communication infrastructure devices 620 present inIP edge layer 745 may be communicatively coupled to one or morecommunication infrastructure devices 620 included in IP/MPLS core 740.Communication infrastructure devices 620 included in IP/MPLS core 740 may serve to switch and/or route communications tomedia communication layer 835. - On some occasions,
media communication layer 835 may include a IMF system and/or an IPTV system. Exemplary IMF systems include a media gateway controller function (MGCF), a master switch or router, a media gateway (MGW), a high-speed serial interface (HSS), a central router may also be communicatively, and a proxy call session control function (P-CSCF). IPTV system may include a router communicatively coupled to an encryption device. The encryption device may be communicatively coupled to a distribution server, a voice on demand (VoD) server, and/or an audio voice on demand (VoDA) server. The distribution server and/or the VoD server may also be communicatively coupled to an encoder. - Captured
traffic distribution layer 720 may be coupled to one or more devices included incommunication device layer 830,communication infrastructure layer 710, andmedia communication layer 835 via, for example, inlinetraffic capture point 665 and/ormirror port 660. Capturedtraffic distribution layer 720 may include one or more network capturedtraffic distribution devices 100 arranged in a stacked topology andcentral management device 780. One or more of the network capturedtraffic distribution devices 100 may be communicatively coupled to a large capacity network capturedtraffic distribution device 705. Large capacity network captured traffic distribution device may further be coupled to one or more external devices included inexternal device layer 730. -
FIG. 9A is a block diagram depicting an exemplary carrier voice over IP (VoIP)system 901.System 901 may include one or more communication infrastructure components such asservers 930, firewalls 775,communication infrastructure devices 620,media gateways 910,core devices 915,EGV devices 920 and/orbase stations 925 communicatively coupled to one another via communication links, like communication links 500. One or more communication links may include inline traffic capture points 665. -
System 901 may further include a plurality of network captured traffic distribution devices arranged in a stacked topology. One or more of the components ofcommunication layer 710 may be communicatively coupled to network capturedtraffic distribution device 100 via inlinetraffic capture point 665. Network capturedtraffic distribution devices 100 may be coupled to one or more large capacity network capturedtraffic distribution devices 705 that may be communicatively coupled to one or moreexternal devices 650.External devices 650 may further be coupled to anapplication server 935. -
FIG. 9B is a block diagram illustrating an exemplarycarrier VoIP system 902.System 902 includes multiplecommunication infrastructure devices 620, such as service GPRS support node (SGSN) servers, communicatively coupled to one another 620 via communication links like communication links 500. Communication links betweencommunication infrastructure devices 620 may include one or more inline traffic capture points 665 via which one or more network captured traffic distribution devices such as network capturedtraffic distribution devices 100 may receive captured traffic. Network captured traffic distribution devices are arranged in a stacked topology and are communicatively coupled to one or more large capacity network capturedtraffic distribution devices 705. Large capacity network capturedtraffic distribution device 705 may be communicatively coupled to one or moreexternal devices 650. -
FIG. 9C is a block diagram illustrating an exemplarycarrier VoIP system 903.System 903 has four layers; a communication infrastructure/communication device layer 710/830, anapplication layer 950, capturedtraffic distribution layer 720 andexternal device layer 730. Components within communication infrastructure/communication device layer 710/830 andapplication layer 950 may be communicatively coupled via a media link, shown inFIG. 9C as a dashed line, and/or a signaling link, shown inFIG. 9C as a bold line, to one another. One or more media links and/or signaling links ofsystem 903 may include an inlinetraffic capture point 665. -
Communication infrastructure layer 710 includes components of a public switch telephone network (PSTN) and an IP network. Exemplary PSTN components includecommunication devices 610, such as a telephone, communicatively coupled tocommunication infrastructure devices 620 such as a media gateway (MGW) 955 and a signal transfer point (STN) 965. - Exemplary IP network components include
communication devices 610, such as a telephone or mobile phone, communicatively coupled to anIAB 960 or anetwork 760. The IP network may also includecommunication infrastructure device 620, such as a switch, router, or edge router communicatively coupled to one or more components ofapplication layer 950 or PSTN. -
Application layer 950 includes communication infrastructure devices like a proxy call session control function (P-CSCF)device 980 that may be coupled to one or more components of IP network via a media and/or signaling link.Application layer 950 further includes amedia gateway 920 and a high speed serial interface 975 (HSS). BothHSS 975 andmedia gateway 920 may be communicatively coupled to P-CSCF 980.Application layer 950 may be communicatively coupled to a network capturedtraffic distribution layer 720 via, for example, one or more inline traffic capture points 665. - Network captured
traffic distribution layer 720 may include one or more network capturedtraffic distribution devices 100 arranged in a stacked topology. Network capturedtraffic distribution devices 100 may be communicatively coupled to a large capacity network capturedtraffic distribution device 705. Capturedtraffic distribution layer 720 may further include acentral management device 780 which may operate to manage one or more network capturedtraffic distribution devices 100 and/or large capacity network capturedtraffic distribution devices 705. The devices present in capturedtraffic distribution layer 720 may be coupled to one or more external devices included inmonitoring layer 730. -
FIG. 10A is a block diagram illustrating anexemplary IPTV system 1001.System 1001 includes multiplecommunication infrastructure devices 620, such as an insertion server, a key server, and a plurality of VoD servers, communicatively coupled with one another via communication links, likecommunication link 500. One or more inline traffic capture points 665 may be present along the communication links via which the communication links are coupled to a stacked topology of network capturedtraffic distribution devices 100. Captured network traffic may be received by network capturedtraffic distribution device 100 via inline traffic capture points 665 or a mirror port likemirror port 660. Network capturedtraffic distribution devices 100 included in the stacked topology may also be communicatively coupled via communication links, likecommunication link 500, to one or more large capacity network capturedtraffic distribution devices 705. Large capacity network capturedtraffic distribution devices 705 may further be coupled to one or moreexternal devices 650. -
FIG. 10B is a block diagram illustrating anexemplary IPTV system 1002.System 1002 includesmultiple communication devices 610 communicatively coupled to one or morecommunication infrastructure devices 620 via communication links, likecommunication link 500. Insystem 1002,communication infrastructure devices 620 may be digital subscriber line access multiplexers (DSLAM). Communication links between one ormore communication devices 610 and/orcommunication infrastructure devices 620 may include inline traffic capture points 665 that are communicatively coupled to one or more network capturedtraffic distribution devices 100 arranged in a stacked topology. Network capturedtraffic distribution devices 100 may also be communicatively coupled to one or moreexternal devices 650. -
FIG. 10C is a diagram illustrating an exemplarylayered IPTV system 1003.System 1003 includes communicatingdevice layer 830, multiple communication infrastructure layers 710, capturedtraffic distribution layer 720, andexternal device layer 730. Devices included in the layers ofsystem 1003 may be communicatively coupled via communication links like communication links 500. One or more of the communication links insystem 1003 may include inlinetraffic capture point 665. - Exemplary devices included in
communication device layer 705 include one or more residential communication devices or residential gateways. One or more of the communicatingdevices 610 present incommunication device layer 830 may be communicatively coupled to one or morecommunication infrastructure devices 620, such as a DSAM router resident in a first communication infrastructure layer, oraccess layer 710. One or morecommunication infrastructure devices 620 resident in first communication infrastructure layer may be communicatively coupled to one or more additionalcommunication infrastructure devices 620 resident in a secondcommunication infrastructure layer 710. - Second
communication infrastructure layer 710 may include a head end system, a distribution system, and a local video office system. Exemplary head end systems include multiplecommunication infrastructure devices 620, such as switches, encryption devices, VoD server, a distribution server, and an encoder, communicatively coupled to one another. Exemplary distribution systems may include one or morecommunication infrastructure devices 620, such as routers and/or switches that may be communicatively coupled to the local office video system. Exemplary local office video system may include multiplecommunication infrastructure devices 620, such as a switch or router communicatively coupled to infrastructure servers, ACS, encryption devices, VoD servers, and/or content providers. - One or more of the communication links communicatively coupling the devices of
communication device layer 830 andcommunication infrastructure layer 710 may include an inlinetraffic capture point 665 via which captured network traffic may be communicated to one or more network capturedtraffic distribution devices 100 arranged in a stacked topology present in capturedtraffic distribution layer 720. Network capturedtraffic distribution devices 100 may also be communicatively coupled to large capacity network capturedtraffic distribution device 705. Large capacity network capturedtraffic distribution device 705 may also be communicatively coupled tocentral management device 780 and one or more external devices present inexternal device layer 730. -
FIG. 11A is a diagram illustrating an exemplarynetwork security system 1101.System 1101 includes multiplecommunication infrastructure devices 620, such as switches, communicatively coupled via an active and/or passive communication link, likecommunication link 500, to one ormore firewalls 755. Active communication links are depicted inFIG. 11A as bold lines while passive communication links are depicted inFIG. 11A as dotted lines. - One or more network traffic capture points 665 may be located along active and/or passive links between
communication infrastructure devices 620 and firewalls 775 via which captured network traffic may be communicated to one or more network capturedtraffic distribution devices 100 arranged in a stacked topology. Network capturedtraffic distribution devices 100 may also be communicatively coupled to one or more large capacity network capturedtraffic distribution devices 705 which may be communicatively coupled to one or moreexternal devices 650 via an active and/or passive communication link. -
FIG. 11B is a diagram illustrating an exemplarynetwork security system 1102.Network security system 1102 includes a plurality ofcommunication infrastructure devices 620, such as routers, switches, application gateways, vports, load balancers, secure switches, firewalls 755 and networks 760 (e.g., public networks, application server networks, electronic commerce gateway networks, and/or private networks (databases)), in communication with one another via one or more communication links, like communication links 500. The communication links may include one or more inline traffic capture points 665 via which captured network traffic may be communicated to one or more network capturedtraffic distribution devices 100 arranged in a stacked topology. Network capturedtraffic distribution devices 100 may further be communicatively coupled to one or more large capacity network capturedtraffic distribution devices 705 which may, in turn, be coupled to one or moreexternal devices 650. -
FIG. 11C illustrates an exemplarynetwork security system 1103 includingcommunication infrastructure layer 710, capturedtraffic distribution layer 720, andexternal device layer 730. Exemplary components included incommunication infrastructure layer 710 includecommunication infrastructure devices 620, such asnetworks 760,firewalls 755, routers, switches, load balancers, etc. One or more components ofcommunication infrastructure 710 may be communicatively coupled to one or another via a communication link, likecommunication link 500. These communication links may include one or more inline traffic capture points 665 via which captured network traffic may be communicated to one or more network capturedtraffic distribution devices 100 arranged in a stacked topology resident in capturedtraffic distribution layer 720. Network capturedtraffic distribution devices 100 may be communicatively coupled to one or more large capacity network capturedtraffic distribution devices 705. Capturedtraffic distribution layer 720 may further include acentral management device 780 communicatively coupled to large capacity network capturedtraffic distribution device 705. Large capacity network capturedtraffic distribution device 705 may further be coupled to one or moreexternal devices 650. -
FIG. 12 is a flow chart illustrating anexemplary process 1200 for inserting a virtual LAN (VLAN) tag into one or more received captured data packets.Process 1200 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 1205, one or more data packets of captured network traffic may be received by a network captured traffic distribution device included in a stacked topology, such as network capturedtraffic distribution device 100. The captured data packet may be received from one or more sources and, in step 1210, it may be determined whether the source of the received captured data packet is, for example, an inline traffic capture point, such as inline capturedtraffic point 665 or a mirror port, such asmirror port 660. When the captured data packet is received via an inline capture point, the received captured data packet may be echoed to a bidirectional port, such asbidirectional port 110, for eventual transition to, for example, a communication device intended to receive the captured data packet (step 1215). Whether the captured data packet was received via an inline traffic capture point or a mirror port, a target network captured traffic distribution device included in the stacked topology for the captured data packet may be determined (step 1220). - Then, in
step 1225, a VLAN tag may be inserted into the captured data packet. The VLAN tag may serve to indicate, for example, identifying information associated with the data packet, such as an origin of the data packet, a target network captured traffic distribution device for the data packet, data packet size, and data packet type. The inserted VLAN tag may remain in the data packet during its transport through successive network captured traffic distribution devices included in the stacked topology. - Next, in
step 1230, an optimum route for transmission of the captured data packet from the receiving network captured traffic distribution device to the target network captured traffic distribution device may be determined. The optimum route for the captured data packet may be determined via, for example,process 1400 and/or 1500 as discussed below with reference toFIGS. 14 and 15 . Then, instep 1235, the captured data packet may be transmitted to a second network captured traffic distribution device in the stacked topology along the optimum route. The data packet may then be analyzed at the second network captured traffic distribution device (step 1240) to determine, for example, the target network captured traffic distribution device of the data packet based on the inserted VLAN tag (step 1245). Next, instep 1250, it may be determined whether the second network captured traffic distribution device is the target destination of the captured data packet based on, for example, information included in the VLAN tag inserted atstep 1225. When the second network captured traffic distribution device is not the target destination, steps 1230 through 1250 may repeat themselves. - When the second network captured traffic distribution device is the target network captured traffic distribution device, the VLAN tag inserted at
step 1225 may be removed (step 1255) by, for example, the second network captured traffic distribution device. Finally, atstep 1260, the captured data packet may be transmitted towards an egress port of the second network captured traffic distribution device via which, in some embodiments, the captured data packet may be transmitted to one or more external devices. Exemplary external devices include a monitoring device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an IPTV analyzer, an application analyzer, a voice analyzer, a telecommunications analyzer, and a forensic analyzer. Followingstep 1260,process 1200 may end. -
FIG. 13A is a block diagram of anexemplary data packet 1301.Data packet 1301 includes aheader 1305, apayload 1315, and an old frame check sequence (FCS) and/or cyclic redundancy check (CRC)block 1320. In some embodiments,data packet 1301 may resembledata packet 640.Header 1305 may include, for example, address information and other information, as needed, for the transmission ofdata packet 1305 through a network communication system, like network communication system 601.Payload 1315 may include any payload or data appropriate fordata packet 1301. Old FCS/CRC block 1320 may include information necessary for compliance with one or more system protocols, communication protocols, and/or the routing ofdata packet 1301 through a network communication system, like network communication system 601. -
FIG. 13B illustrates an exemplary modifieddata packet 1302 includingheader 1305,payload 1315, aVLAN tag 1310, and a new FCS/CRC 1330. In some cases modifieddata packet 1302 may be a modified form ofdata packet 1301 and/or 640.Modified data packet 1302 may be generated via a process for inserting a VLAN tag into a data packet, such asprocess 1200, as discussed above with reference toFIG. 12 . AlthoughFIG. 13B indicates a location ofVLAN tag 1310 that is immediately afterheader 1305,VLAN tag 1310 may be inserted into any location within modifieddata packet 1302. New FCS/CRC 1330 may include information indicating thatdata packet 1302 includes a VLAN tag and in some cases may be an updated version of old FCS/CRC 1320. -
FIG. 14 is a flowchart illustrating aprocess 1400 for determining an optimum route for the transmission of captured network traffic and/or a captured data packet included in captured network traffic through a stacked topology of two or more network captured traffic distribution devices.Process 1400 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 1405, a traffic flow of captured network traffic may be received at, for example, a network captured traffic distribution device included in a stacked topology, such as network capturedtraffic distribution device 100. The captured traffic may be received from one or more sources of captured traffic. Next, instep 1410 it may be determined whether the source of the received captured network traffic is, for example, an inline traffic capture point, such as inline capturedtraffic point 665 or a mirror port, such asmirror port 660. When the captured network traffic is received via an inline capture point, the received captured network traffic may be echoed to a bidirectional port, such asbidirectional port 110, for eventual transition to, for example, a communication device and/or external device intended to receive the captured network traffic (step 1215). - Whether the captured traffic was received via an inline captured traffic point or a mirror port, a target destination of the captured traffic may be determined (step 1420). Exemplary target destinations of the captured network traffic include a network captured traffic distribution device included in the stacked topology, a monitoring device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an IPTV analyzer, an application analyzer, a voice analyzer, a telecommunications analyzer, and a forensic analyzer.
- Next, in
step 1425 one or more routes, or transmission pathways, from the receiving network captured traffic distribution device through the stacked topology to the target destination may be determined. In some cases, a route may be determined in real time or on an as-needed basis. In one embodiment, the determination ofstep 1425 may include accessing one or more pre-calculated routes for the transmission of received captured network traffic through the stacked topology to a target destination. Pre-calculated routes may be stored at, for example, the network captured traffic distribution device in a memory, such asmemory 180, accessed via another network captured traffic distribution device included in the stacked topology and/or accessed from an external storage location via, for example, a management port, such asmanagement port 140 and/orbidirectional port 110. In another embodiment, one or more routes may be determined via a download or exchange from a web browser by the network captured traffic distribution device. In some cases,step 1425 may include accessing previously stored determined routes and/or selected optimum routes. Further details regarding the determination ofstep 1425 are discussed below with reference toFIG. 15 andprocess 1500. - In
step 1430, the determined and/or pre-calculated routes may be analyzed according to one or more criterion. In some cases, the analysis ofstep 1430 may include determining a transmission capacity or transmission/link speed available for each route and/or segment of a route determined instep 1420. The analysis may also include determining, for each route, the number of network captured traffic distribution devices in the stacked topology that received captured data packets will pass through prior to arrival at the target destination. The analysis ofstep 1430 may further include determining a load balanced route through the stacked topology and/or determining a load spread route through the stacked topology. - In some cases, the analysis of
step 1430 may indicate two or more similar, or redundant optimum routes through the stacked topology. Redundant optimum routes may be routes through the stacked topology that are equivalent according to the analysis criteria. In some embodiments, the selection of one similar, or redundant route over another may be made in light of a load balancing and/or load spreading consideration. - Then, in
step 1435, it may be determined whether load balancing for the network captured traffic distribution device is enabled. Whether load balancing is enabled or not, it may be further determined instep 1440 whether load spreading is enabled. When load spreading is enabled, an optimum load spread route for received captured network traffic may be determined (step 1445). When load spreading is not enabled, the transmission capacity of possible optimum load balanced routes and/or optimum load spread routes may be analyzed (step 1455). - When load balancing is enabled in
step 1435, an optimum load balanced route for the received captured network traffic may be determined (step 1450). Then the transmission capacity of possible optimum load balanced routes and/or optimum load spread routes may be analyzed (step 1455). - Next, in
step 1460, an optimum route for transmission of the captured network traffic may be selected based upon, for example, the analysis ofstep 1455. Following this selection, the received captured network traffic may be transmitted toward the target destination via the selected optimum route (step 1455). The target destination may be, for example, another network captured traffic distribution device included in the stacked topology or an external device coupled to one or more network captured traffic distribution devices included in the stacked topology. - Optionally, in
step 1465, the determined routes ofstep 1425 and/or the selected optimum route ofstep 1460 may be stored in, for example, the network captured traffic distribution device, in a memory, such asmemory 180, and/or may be communicated to one or more network captured traffic distribution devices included in the stacked topology or an external device. -
FIG. 15 is a flowchart illustrating anoptional process 1500 or steps included in the analysis ofstep 1430 as discussed above with regard toFIG. 14 .Process 1500 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 1505, information regarding some or all data paths available or included in a stacked topology may be received by, for example, a network captured traffic distribution device, such as network capturedtraffic distribution device 100. The information may be received via, for example, an exchange of configuration information, between the network captured traffic distribution device and an additional network captured traffic distribution device included in the stacked topology or a message from, for example, an additional network captured traffic distribution device included in the stacked topology, a communication device, or an external device. - Optionally, in
step 1510, a link/transmission speed of some or all of the communication links and network captured traffic distribution devices included in the stacked topology and/or communication devices and external devices coupled to the stacked topology may be determined. Then, instep 1515, a level of congestion for some or all of the communication links and network captured traffic distribution devices included in the stacked topology and/or communication devices and external devices coupled to the stacked topology may be determined. - Optionally, in
step 1520, the number of hops or intervening network captured traffic distribution devices along a route may be determined. Finally, instep 1525, it may be determined whether some or all of the data paths included in a route are operational. This determination may include a determination of whether a data path is online, transmitting at an optimum link speed, and/or congested. -
FIG. 16 is a block diagram illustrating an exemplary mesh network of four network captured traffic distribution devices, such as network capturedtraffic distribution devices 100.FIG. 16 shows four network captured traffic distribution devices; a network capturedtraffic distribution device 100 A, a network capturedtraffic distribution device 100 B, a network capturedtraffic distribution device 100 C, and a network capturedtraffic distribution device 100 D. Network captured traffic distribution devices 100 A-100 D are communicatively coupled to one another via one or more communication links 500. For example, network capturedtraffic distribution device 100 A is communicatively coupled to network capturedtraffic distribution device 100 B via twocommunication links traffic distribution device 100 A is also communicatively coupled to network capturedtraffic distribution device 100 D via acommunication link 500 A-D. Network capturedtraffic distribution device 100 A is further connected to network capturedtraffic distribution device 100 C via acommunication link 500 A-C. Network capturedtraffic distribution device 100 B is connected to network capturedtraffic distribution device 100 D via acommunication link 500 B-D and network capturedtraffic distribution device 100 C is communicatively coupled to network capturedtraffic distribution device 100 D via acommunication link 500 C-D. - In cases where the link speed of all
communication links 500 pictured inFIG. 16 is the same and traffic received by network capturedtraffic distribution device 100 A were to go to network capturedtraffic distribution device 100 C, then network capturedtraffic distribution device 100 A would determine thatcommunication link 500 A-C would be the optimum route for the transmission of captured network traffic as it is the most direct route between network capturedtraffic distribution device 100 A and network capturedtraffic distribution device 100 C. In the event thatcommunication link 500 A-C has failed or is not operating properly, network capturedtraffic distribution device 100 A may then select a new optimum route for the transmission of captured data packets to network capturedtraffic distribution device 100 C. Again, given that allcommunication links 500 are transmitting at the same speed, the next optimum route selected by network capturedtraffic distribution device 100 A may be viacommunication link 500 A-D to network capturedtraffic distribution device 100. Once received, the target destination of captured network traffic is determined at network capturedtraffic distribution device 100 D and communication link 500 C-D may be selected by network capturedtraffic distribution device 100 D for transmission of the received captured traffic from network capturedtraffic distribution device 100 D to network capturedtraffic distribution device 100 C. - In a case where the link speed for all
communication links 500 illustrated inFIG. 16 is not the same and, for example, the transmission speed ofcommunication link 500 A-C is slower than the remaining links, network capturedtraffic distribution device 100 A may selectcommunication links traffic distribution device 100 A to network capturedtraffic distribution device 100 B, although it is a longer route through the stacked topology than the direct link between network capturedtraffic distribution devices communication links communication link 500 A-C. -
FIG. 17 is a flowchart illustrating anexemplary process 1700 for filtering captured network traffic according to one or more criteria by a network captured traffic distribution device included in a stacked topology of network captured traffic distribution devices.Process 1700 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 1705, instructions to filter received captured network traffic may be received by, for example, a network captured traffic distribution device included in a stacked topology of network captured traffic distribution devices, such as network capturedtraffic distribution device 100. The instructions may be received from, for example, a user and/or administrator of the captured network distribution device, such as user/administrator 655 via, for example, a GUI such as GUIs 300-302 as discussed above with regard toFIGS. 3A-3C and/or a management port, such asmanagement port 140. The instructions may also be received as, for example, exchanged configuration information from a network captured traffic distribution device included in the stacked topology. The instructions ofstep 1705 may also be received by a processor, likeprocessor 170, from, for example, a memory, such asmemory 180. - The received instructions may indicate that received captured network traffic is to be filtered according to a criterion or combination of criteria. Exemplary criterion include, but are not limited to, an origin of the captured network traffic, a target destination of the captured network traffic, a source of the captured network traffic, a type the captured network traffic, a protocol used to encode the captured network traffic, a size of one or more data packets included in the captured network traffic, a speed at which the captured network traffic is received, and an operating condition within the stacked topology, a receiving network captured traffic distribution device, and/or a target destination.
- In some embodiments, filtration instructions may enable the filtering of captured network traffic based on an amount of available capacity associated with the stacked topology, a communication link, a receiving network captured traffic distribution device, a target destination, a communication device coupled to the stacked topology and/or an external device coupled to the stacked topology. Indicators of available capacity include a maximum transmission or intake speed for captured traffic and a level of congestion associated with the stacked topology, a communication link, a receiving network captured traffic distribution device, and/or a target destination.
- In one embodiment, filtration instructions may be specific to one or more characteristics of the captured network traffic such that, for example, all captured traffic received from a source or via a particular bidirectional port included in the network captured traffic distribution device is filtered.
- In yet another embodiment, filtration instructions may enable the filtering of captured network traffic based on a target destination associated with the captured network traffic. Exemplary target destinations include a network captured traffic distribution device included in the stacked topology, a monitoring device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an IPTV analyzer, an application analyzer, a voice analyzer, and a forensic analyzer.
- Next, in
step 1710, captured network traffic may be received by, for example, the network captured traffic distribution device, according to, for example, any of the methods described herein. Then, instep 1715, it may be determined whether the captured network traffic was received via an inline traffic capture point, such as inlinetraffic capture point 665 and/or a mirror port, such asmirror port 660. When the captured network traffic is received via an inline capture point, the received network captured traffic may be echoed to a bidirectional port, such asbidirectional port 110, resident on the network captured traffic distribution device (step 1720). Whether the captured network traffic is received via an inline capture point or a mirror port, the received captured traffic may be filtered according to, for example, the instructions received in step 1705 (step 1725). - Then, in
step 1730, a target destination for the received captured network traffic may be determined according to, for example,process 1400 and/or 1500 as discussed above with regard toFIGS. 14 and 15 , respectively. The filtered captured network traffic may then be transmitted toward the target destination determined via, for example, step 1730 (step 1735). Followingstep 1735,process 1700 may end. -
FIG. 18 is a flowchart illustrating anexemplary process 1800 for filtering and/or aggregating received captured network traffic by a network captured traffic distribution device included in a stacked topology of network captured traffic distribution devices.Process 1800 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 1805, captured network traffic may be received by, a network captured traffic distribution device included in a stacked topology of network captured traffic distribution devices, like network capturedtraffic distribution device 100. Then, instep 1810, it may be determined whether the captured network traffic was received via an inline traffic capture point such as inlinetraffic capture point 665 and/or a mirror port, such asmirror port 660. When the captured network traffic is received via an inline capture point, the received network captured traffic may be echoed to another bidirectional port, such asbidirectional port 110, resident on network captured traffic distribution device (step 1815). - Whether the captured network traffic is received via an inline traffic capture point or a mirror port, a plurality of filters may be applied to the received captured network traffic using, for example, process 1700 (step 1820) and thereby generating a plurality of filtered traffic sets (step 1825). Then, in
step 1830, a target destination of each of the filtered traffic sets included in the plurality of filtered traffic sets may be determined via, for example,process 1400 and/or 1500 as discussed above with regard toFIGS. 14 and 15 . - Next, in
step 1835, filtered traffic sets with the same target destination may be aggregated together. Further details regarding the aggregation ofstep 1835 are provided below with regard toFIG. 19 andprocess 1900. Finally, instep 1840, the aggregated filtered traffic sets may be transmitted toward the determined target destination.Step 1840 may be performed via one or more network captured traffic distribution devices included in the stacked topology of network captured traffic distribution devices. Followingstep 1840,process 1800 may end. -
FIG. 19 illustrates anexemplary process 1900 for aggregating sets of captured network traffic received by a network captured traffic distribution device included in a stacked topology of network captured traffic distribution devices.Process 1900 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 1905, a first set of captured network traffic may be received by, for example, a network captured traffic distribution device included in a stacked topology of network captured traffic distribution devices, such as network capturedtraffic distribution device 100. Then, in step 1910, it may be determined whether the captured network traffic was received via an inline traffic capture point, such as inlinetraffic capture point 665 and/or a mirror port, such asmirror port 660. When the captured network traffic is received via an inline capture point, the received captured network traffic may be echoed to another bidirectional port resident on the network captured traffic distribution device, such asbidirectional port 110, for eventual transmission to, for example, a communication or external device. - Whether the first set of captured traffic is received via an inline traffic capture point or a mirror port, in
step 1920, a target destination for the first set of captured network traffic may be determined via, for example, processes 1400 and/or 1500 as discussed above with regard toFIGS. 14 and 15 . Next, instep 1925, a route from the network captured traffic distribution device, through the stacked topology of network captured traffic distribution devices, to a determined target destination may be determined. - Then, in step 1930 a second set of captured network traffic may be received by, for example, the network captured traffic distribution device. On some occasions, following
step 1930,steps 1910 and 1915 may repeat themselves. Then, instep 1935, a target destination of the second set of captured network traffic may be determined. Again, this determination may be made via, for example, processes 1400 and/or 1500 as discussed above with regard toFIGS. 14 and 15 . Next, instep 1940, it may be determined whether the target destination of the second set of traffic is similar to the target destination of the first set of traffic. When the target destination for the second set of traffic is not similar to the target destination of the first set of traffic, the target destination for the second set of captured network traffic may be determined (step 1945). The first and second sets of captured network traffic may then be transmitted toward their respective target destinations (step 1955). - When the target destination of the second set of captured network traffic is similar to, or the same as, the target destination of the first set of captured network traffic, the first and second set of captured network traffic may be aggregated together (step 1950). Then, the aggregated first and second sets of captured network traffic may be transmitted toward the determined target destination (step 1955). Following
step 1955,process 1900 may end. - In some embodiments, the first and second sets of captured network traffic may be received from the same source, while in other embodiments, the first set of captured network traffic may be received from a first source and the second set of captured network traffic may be received from a second source. In some cases, the first and second sources may be positioned in geographically disperse positions. For example, a first source may be located on the first floor of an office building, while the second source of captured network traffic may be located on the second floor of the office building, an adjacent office building, and/or an office building miles away from the first source. In some cases, the first and second sources may not be located within the same city, region, or country as one another.
-
FIG. 20 is a flowchart illustrating anexemplary process 2000 for aggregating sets of captured network traffic received by a network captured traffic distribution device included in a stacked topology of network captured traffic distribution devices.Process 2000 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 2005, a plurality of sets of captured network traffic may be received by, for example, a network captured traffic distribution device coupled to a plurality of network captured traffic distribution devices arranged in a stacked topology, such as network capturedtraffic distribution device 100. The plurality of sets of captured network traffic may be received from a plurality of geographically dispersed sources. - Then, in
step 2010, it may be determined whether the captured network traffic was received via an inline traffic capture point, such as inlinetraffic capture point 665 and/or a mirror port, such asmirror port 660. When the captured network traffic is received via an inline capture point, the received network captured traffic may be echoed to another bidirectional port, such asbidirectional port 110, resident on network captured traffic distribution device (step 2015). - Whether one or more of the plurality of sets of captured network traffic is received via an inline traffic capture point or a mirror port, in step 1220 a target destination for each set of received captured network traffic may be determined.
Step 2020 may be executed using, for example, processes 1400 and/or 1500 as discussed above with regard toFIGS. 14 and 15 . Next, instep 2025, it may be determined whether any of the received sets of captured network traffic have the same target destination. Then, instep 2030, sets of captured network traffic with the same target destination may be aggregated together and transmitted toward the target destination (step 2035). -
FIG. 21A is a flowchart depicting anexemplary process 2100 for monitoring a stacked topology of network captured traffic distribution devices and/or a device communicatively coupled to the stacked topology.Process 2100 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 2105, a status of a stacked topology and/or a device, such as a network captured traffic distribution device included in the stacked topology, a network communicatively coupled to the stacked topology, a network device communicatively coupled to the network, a communication device communicatively coupled to the stacked topology, a communication link included in the stacked topology, and/or an external device communicatively coupled to the stacked topology may be monitored.Step 2105 may be executed by, for example, one or more network captured traffic distribution devices included in the stacked topology, such as network capturedtraffic distribution device 100. - The monitored status of
step 2105 may relate to, for example, a level of congestion present at the stacked topology and/or a monitored device, an operational status of the stacked topology and/or a monitored device, and any changes in the make-up of the stacked topology, including, but not limited to, an addition or subtraction of a network captured traffic distribution device to/from the stacked topology or a change in a function associated with a port. In some cases, the monitored status ofstep 1205 may also relate to an intrusion, or the detection of an intrusion, by an unauthorized user to, for example, the stacked topology or a device coupled to the stacked topology. In some embodiments, the monitored status may also relate to the detection of unauthorized activity occurring on the stacked topology or a device coupled to the stacked topology. - Then, in
step 2110, a change in the status of the stacked topology and/or a monitored device may be detected by, for example, the network captured traffic distribution device. Exemplary detected changes include a failure, a security breach, a loss of power, a level of congestion that exceeds a threshold amount, the addition of a new network captured traffic distribution device to the stacked topology, the removal of a network captured traffic distribution device from the stacked topology, and a change in the status of a network device included coupled to the stacked topology. - Then, in
step 2115, the configuration information included in the network captured traffic distribution device may be adjusted responsively to the detected change. For example, when a failure of a network captured traffic distribution device included in the stacked topology is detected, the network captured traffic distribution device may update its configuration information to reflect the change and/or calculate alternative routes from the network captured traffic distribution device, through the stacked topology, to target destinations that do not include the failed network captured traffic distribution device. - Next, in
step 2120, a detected change and/or adjusted configuration information may be transmitted to one or more additional network captured traffic distribution devices included in the stacked topology. On some occasions,step 2120 may be selectively executed such that only network captured traffic distribution devices that may be affected by the detected change and/or adjusted configuration information may have the detected change and/or adjusted configuration information transmitted to them. On other occasions, a detected change and/or adjusted configuration information may be transmitted from the network captured traffic distribution device to all network captured traffic distribution devices present in the stacked topology and/or devices coupled to the stacked topology. - In one embodiment,
step 2120 may also include transmission of a message indicating the detected change and/or adjusted configuration information to a network captured traffic distribution device included in the stacked topology and/or a device coupled to the stacked topology. The message may be designed and/or transmitted such that it is transmitted to each network captured traffic distribution device or device only once thus resolving a cyclical or repeated sending of detected changes and/or adjusted configuration information throughout the stacked topology. - Next, in
step 2125, the transmitted detected change and/or adjusted configuration information may be received at one or more additional network captured traffic distribution devices. Then, instep 2130, the configuration information of the additional network captured traffic distribution devices may be adjusted to incorporate the received detected change and/or adjusted confirmation information. Followingstep 2130,process 2100 may end. -
FIG. 21B illustrates anexemplary process 2101 for updating configuration information associated with one or more network captured traffic distribution devices included in the stacked topology.Process 2100 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 2150, a traffic flow of captured data packets may be received by, for example, a network captured traffic distribution device included in a stacked topology, like network capturedtraffic distribution device 100. Then, instep 2155, a target destination of a captured data packet included in the received traffic flow of captured data packets may be determined. Next,step 2160, a plurality of routes through the stacked topology from the network captured traffic distribution device to the target destination may be determined. In some cases,step 2160 may be performed according toprocesses 1400 and/or 1500 as described above with reference toFIGS. 14 and 15 . - In
step 2165, a change in the status of the stacked topology and/or a device communicatively coupled to the stacked topology may be detected according to, for example,process 2100, as discussed above, with reference toFIG. 21A . Followingstep 2165, the plurality of routes determined instep 2160 may be updated to incorporate the detected change (step 2170). For example, in the case of a newly added network captured traffic distribution device, one or more routes may be updated to include, for example, the addition of a network captured traffic distribution device to the stacked topology. - Next, in
step 2175, each of the updated routes may be analyzed according to one or more criteria. The analysis ofstep 2175 may be similar to the analysis ofstep 1430 as discussed above with regard toFIG. 14 . Then, instep 2180, an optimum route may be selected based upon the analysis.Step 2180 may be similar to, for example,step 1460 discussed above with regard toFIG. 14 . Finally, instep 2185, the captured data packet may be transmitted toward the target destination via the selected optimum route. Followingstep 2185,process 2101 may end. -
FIG. 22 illustrates anexemplary process 2200 for exchanging configuration information between two or more network captured traffic distribution devices arranged in a stacked topology.Process 2200 may be executed by, for example, any of the devices and/or systems disclosed herein. - In
step 2205, a first network captured traffic distribution device, like network capturedtraffic distribution device 100, may be communicatively coupled to a stacked topology of network captured traffic distribution devices via a coupling with a second network captured traffic distribution device included in the stacked topology. In some embodiments,step 2205 may be executed according toprocess 200 as discussed above with regard toFIG. 2 . Some or all of the network captured traffic distribution devices present in the stacked topology may be associated with configuration information. Exemplary configuration information relates to one or more of determining a target destination for received captured traffic, pre-calculating a route for the transmission of received captured traffic from a receiving network captured traffic distribution device, through the stacked topology, to a target destination, determining an optimum route for the transmission of received captured network traffic from the network captured traffic distribution device through, the stacked topology, to a target destination. On some occasions, configuration information may also relate to evaluating the current operating conditions of the stacked topology. - In one embodiment, the configuration information may relate to grooming received captured network traffic according to one or more criteria, load balancing a distribution of received captured network traffic through the network captured traffic distribution device and/or the stacked topology, removing unwanted information from one or more data packets included in the received captured network traffic, truncating one or more data packets included in the received captured network traffic, and load spreading a distribution of received captured network traffic through the stacked topology. Configuration information relating to grooming the received captured network traffic may also relate to filtering the received captured network traffic according to one or more criterion, aggregating one or more sets of captured network traffic transmitted through the stacked topology, altering the content of the received captured network traffic, adding information to one or more data packets included in the received captured network traffic, and subtracting information from one or more data packets included in the received captured network traffic.
- On some occasions, the communicative coupling of
step 2205 may include physically coupling the first network captured traffic distribution device to the stacked topology via a physical communication link such as, for example, an Ethernet cable, an optical fiber cable, and/or a copper cable. On some occasions, the communicative coupling of the first network captured traffic distribution device to the stacked topology may include wirelessly coupling the first network captured traffic distribution device to the stacked topology via a wireless communication link. - Then, in
step 2210, the first network captured traffic distribution device may recognize the second network captured traffic distribution device included in the stacked topology. On some occasions,step 2210 may include the transmission of a message from the first network captured traffic distribution device to the second network captured traffic distribution device and the receipt of an acknowledgement message from a second network captured traffic distribution device by the first network captured traffic distribution device responsively to the transmitted message. - Next, in
step 2215, a portion of the configuration information associated with the first network captured traffic distribution devices may be automatically exchanged with the second network captured traffic distribution device and/or a portion of the configuration information associated with the second network captured traffic distribution devices may be automatically exchanged with the first network captured traffic distribution device. In one embodiment, the automatic exchange of configuration information ofstep 2215 may include the transmission of a request from the first to the second network captured traffic distribution device for a portion of the configuration information associated with the second network captured traffic distribution device. The first network captured traffic distribution device may then receive the requested configuration information responsively to the transmitted request. - In
step 2220, the configuration information of the first and/or second network captured traffic distribution devices may be automatically updated responsively to some or all of the exchanged configuration information. Optionally, instep 2225, one or more operations may be executed by the first and/or second network captured traffic distribution devices responsively to the exchanged configuration information. For example, when determining an optimum route through a stacked topology, the first network captured traffic distribution device may incorporate configuration information regarding the link speed of various links present in the stacked topology received from the second network captured traffic distribution device into the calculation of an optimum route through the stacked topology. Followingstep 2225,process 2200 may end. - In the preceding discussion various embodiments of the present invention were discussed as being implemented with the aid of computer-implemented processes or methods (a.k.a. programs or routines). Such programs may be rendered in any computer-readable language and, in general, are meant to encompass any series of logical steps performed in a sequence to accomplish the stated purpose. Any part of the foregoing description that was presented in terms of algorithms and/or symbolic representations of operations on data within a computer memory should be understood as steps requiring physical manipulations of physical quantities (usually represented in the form of electrical or magnetic signals) within computer-readable storage devices. Accordingly, throughout the preceding description of the present invention, terms such as “processing”, “computing”, “calculating”, “determining”, “displaying” or the like, should be understood as referring to the actions and processes of an appropriately programmed computer processor, or similar electronic device, that manipulates and transforms data represented as physical (electronic) quantities within the computer processor's registers and any associated memories or other storage devices into other data similarly represented as physical quantities within those memories or registers or other such information storage devices. The programs comprise computer-executable instructions stored on one or more such computer-readable storage mediums accessible to the computer processor, for example any type of disk including hard disks, floppy disks, optical disks, compact disk read only memories (CD-ROMs), and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), erasable programmable read only memories (EPROMs), electrically erasable programmable read only memories (EEPROMs), flash memories, other forms of electrical, magnetic or optical storage media accessible to the computer processor.
Claims (19)
1. A system comprising:
a source of captured network traffic, wherein the source performs at least one of capturing network traffic transmitted between two nodes and receiving captured traffic via a mirror port of a network switch;
a plurality of stacked network captured traffic distribution devices arranged in a stacked topology such that each network captured traffic distribution device is communicatively coupled via a communication link with at least one additional stacked network captured traffic distribution device and each stacked network captured traffic distribution device automatically exchanges configuration information with at least some of the plurality stacked network captured traffic distribution devices in the stacked topology, wherein at least one network captured traffic distribution device of the plurality of network captured traffic distribution devices is configured to receive captured network traffic from the source, and at least one network captured traffic distribution device of the plurality of network captured traffic distribution devices is configured to transmit received captured traffic to an external device via a communication link; and
the external device for receiving captured network traffic from at least one of the stacked network captured traffic distribution devices via a communication link.
2. The system of claim 1 , wherein each of the plurality of stacked network captured traffic distribution devices is associated with a unique Internet protocol (IP) address, the system further comprising:
a web browser enabled to communicate with each of the plurality of stacked network captured traffic distribution devices via the unique IP address, wherein the communication includes at least one of an exchange of configuration information, an association of a function with at least one of a network captured traffic distribution device and a port included in a network captured traffic distribution device, and a disassociation of a function with at least one of a network captured traffic distribution device and a port included in a network captured traffic distribution device.
3. The system of claim 1 , wherein the stacked topology is arranged as at least one of a ring topology, a mesh topology, a star topology, a topology of single links, a topology of multiple links, a topology including one or more redundant links, and some combination thereof.
4. The system of claim 1 , wherein the communication link is at least one of an Ethernet cable, a coaxial cable, a fiber optic cable, and a wireless link.
5. The system of claim 1 , wherein communication along the communication link is bi-directional.
6. The system of claim 1 , wherein at least one of the network captured traffic distribution devices is configured to perform at least one of determining a target destination for received captured network traffic, pre-calculating at least one route for the transmission of received captured network traffic from an origin, through the stacked topology, to a target destination, determining an optimum route for the transmission of captured network traffic from an origin, through the stacked topology, to a target destination, load balancing a distribution of received captured traffic through the stacked topology, load spreading a distribution of received captured traffic through the stacked topology, grooming received captured network traffic, filtering received network traffic according to a criterion, aggregating received network traffic, and evaluating a current operating condition of the stacked topology.
7. The system of claim 1 , further comprising:
a plurality of external devices, wherein each external device is configured to perform at least one of a monitoring a category of captured network traffic and analyzing a category of captured network traffic.
8. The system of claim 7 , wherein a network captured traffic distribution device included in the plurality of network captured traffic distribution devices is further configured to groom received captured traffic according to the category of captured network traffic the external device is configured to monitor or analyze.
9. The system of claim 1 , wherein the external device is at least one of a communication device, a protocol analyzer, a flight recorder, an intrusion detection system, a media analyzer, a signaling analyzer, a web analyzer, a database analyzer, a voice signaling analyzer, an Internet protocol television (IPTV) analyzer, an application analyzer, a voice analyzer, a telecommunications analyzer, and a forensic analyzer.
10. The system of claim 1 , wherein at least one of the nodes, the stacked network captured traffic distribution devices, and the external device operate at locations that are geographically disperse from one another.
11. The system of claim 1 , wherein the system is compatible with a carrier Ethernet system, a network forensic security system, a carrier voice over Internet provider (VoIP) system, an Internet protocol television (IPTV) system, a network security system, a network intrusion detection system, and a telecommunications system.
12. A method comprising:
receiving, by a stacked topology of communicatively coupled network captured traffic distribution devices, captured network traffic from a plurality of captured network traffic sources;
analyzing, by at least one network captured traffic distribution device included in the stacked topology, the received captured traffic;
determining, by at the least one network captured traffic distribution device included in the stacked topology, a target destination of the received captured traffic based on the analysis; and
transmitting, by at the least one network captured traffic distribution device included in the stacked topology, the received captured traffic through the stacked topology toward the target destination.
13. The method of claim 12 , further comprising:
calculating, by at least one network captured traffic distribution device included in the stacked topology, one or more routes for the transmission of the received captured network traffic through the stacked topology to the target destination;
analyzing, by at the least one network captured traffic distribution device included in the stacked topology, the calculated routes; and
selecting, by at the least one network captured traffic distribution device included in the stacked topology, an optimum route responsively to the analysis.
14. The method of claim 12 , further comprising at least one of:
determining, by at the least one network captured traffic distribution device included in the stacked topology, a target destination for received captured network traffic;
pre-calculating, by at the least one network captured traffic distribution device included in the stacked topology, at least one route for the transmission of received captured network traffic from an origin through the stacked topology to a target destination;
load balancing, by at the least one network captured traffic distribution device included in the stacked topology, a distribution of received captured traffic through the stacked topology;
load spreading, by at the least one network captured traffic distribution device included in the stacked topology, a distribution of received captured traffic through the stacked topology;
grooming, by at the least one network captured traffic distribution device included in the stacked topology, received captured network traffic transmitted through the stacked topology;
filtering, by at the least one network captured traffic distribution device included in the stacked topology, received network traffic transmitted through the stacked topology according to a criterion;
aggregating, by at the least one network captured traffic distribution device included in the stacked topology, received network traffic transmitted through the stacked topology; and
evaluating, by at the least one network captured traffic distribution device included in the stacked topology, a current operating condition of the stacked topology.
15. A network captured traffic distribution device, comprising:
a plurality of bi-directional ports configured to perform at least one of receiving captured network traffic and echoing received captured network traffic to one or more of the plurality of bi-directional ports;
an egress port configured to transmit received captured network traffic to an external device;
a stacking port configured to enable, via a communication link, the stacking of the network captured traffic distribution device with a plurality of network captured traffic distribution devices in a stacked topology wherein the stacking includes an exchange of configuration information between the network captured traffic distribution device and the plurality of network captured traffic distribution devices; and
a processor configured to manage distribution of received captured network traffic through the network captured traffic distribution device and the stacked topology of network captured traffic distribution devices.
16. The network captured traffic distribution device of claim 15 , further comprising:
a data storage configured to store an Internet protocol (IP) address associated with the network captured traffic distribution device, configuration information for the network captured traffic distribution device, data regarding at least one additional network captured traffic distribution device included in the stacked topology, and data regarding at least one of received captured network traffic and management of received captured network traffic.
17. The network captured traffic distribution device of claim 15 , wherein the stacking port is configured to enable the network captured traffic distribution device to be stacked in at least one of a ring topology, a mesh topology, a star topology, a topology of single links, a topology of multiple links, a topology including one or more redundant links, and some combination thereof.
18. The network captured traffic distribution device of claim 15 , wherein at least one of the bi-directional ports, the egress port, and the stacking port is compatible with at least one of a 10/100 Ethernet cable, a 1 gigabit Ethernet cable, a 10 gigabit Ethernet cable, a copper cable, and a fiber cable.
19. The network captured traffic distribution device of claim 15 , further comprising:
an application specific integrated circuit configured to distribute the captured traffic through the network captured traffic distribution device.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US12/898,529 US20110087771A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for a layer of stacked network captured traffic distribution devices |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US24883709P | 2009-10-05 | 2009-10-05 | |
US12/898,529 US20110087771A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for a layer of stacked network captured traffic distribution devices |
Publications (1)
Publication Number | Publication Date |
---|---|
US20110087771A1 true US20110087771A1 (en) | 2011-04-14 |
Family
ID=43823094
Family Applications (9)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/898,529 Abandoned US20110087771A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for a layer of stacked network captured traffic distribution devices |
US12/898,536 Active 2032-04-29 US8832222B2 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for inserting a VLAN tag into a captured data packet |
US12/898,578 Active 2031-10-26 US8903964B2 (en) | 2009-10-05 | 2010-10-05 | Auto-configuration of network captured traffic device |
US12/898,572 Active 2032-05-01 US9148358B2 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for filtering captured network traffic |
US12/898,540 Active 2031-06-18 US8717901B2 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for determining an optimum route for transmission of a captured data packet through a stacked topology of network captured traffic distribution devices |
US12/898,515 Abandoned US20110082936A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for transmission of captured network traffic through a stacked topology of network captured traffic distribution devices |
US12/898,549 Active 2031-11-05 US9014198B2 (en) | 2009-10-05 | 2010-10-05 | Apparatus and system for aggregating captured network traffic |
US12/898,501 Abandoned US20110087979A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for stacking network captured traffic distribution devices |
US12/898,583 Abandoned US20110080829A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for monitoring network conditions via a stacked topology of network captured traffic distribution devices |
Family Applications After (8)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/898,536 Active 2032-04-29 US8832222B2 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for inserting a VLAN tag into a captured data packet |
US12/898,578 Active 2031-10-26 US8903964B2 (en) | 2009-10-05 | 2010-10-05 | Auto-configuration of network captured traffic device |
US12/898,572 Active 2032-05-01 US9148358B2 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for filtering captured network traffic |
US12/898,540 Active 2031-06-18 US8717901B2 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for determining an optimum route for transmission of a captured data packet through a stacked topology of network captured traffic distribution devices |
US12/898,515 Abandoned US20110082936A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for transmission of captured network traffic through a stacked topology of network captured traffic distribution devices |
US12/898,549 Active 2031-11-05 US9014198B2 (en) | 2009-10-05 | 2010-10-05 | Apparatus and system for aggregating captured network traffic |
US12/898,501 Abandoned US20110087979A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for stacking network captured traffic distribution devices |
US12/898,583 Abandoned US20110080829A1 (en) | 2009-10-05 | 2010-10-05 | Method, apparatus and system for monitoring network conditions via a stacked topology of network captured traffic distribution devices |
Country Status (1)
Country | Link |
---|---|
US (9) | US20110087771A1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110597226A (en) * | 2019-09-17 | 2019-12-20 | 中车青岛四方机车车辆股份有限公司 | Abnormity early warning method and device for vehicle-mounted Ethernet |
US10819535B2 (en) * | 2017-12-13 | 2020-10-27 | Siemens Aktiengesellschaft | Method for data packet transmission and/or reception |
Families Citing this family (89)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8782654B2 (en) | 2004-03-13 | 2014-07-15 | Adaptive Computing Enterprises, Inc. | Co-allocating a reservation spanning different compute resources types |
EP1738258A4 (en) | 2004-03-13 | 2009-10-28 | Cluster Resources Inc | System and method for providing object triggers |
US20070266388A1 (en) | 2004-06-18 | 2007-11-15 | Cluster Resources, Inc. | System and method for providing advanced reservations in a compute environment |
US8176490B1 (en) | 2004-08-20 | 2012-05-08 | Adaptive Computing Enterprises, Inc. | System and method of interfacing a workload manager and scheduler with an identity manager |
CA2586763C (en) | 2004-11-08 | 2013-12-17 | Cluster Resources, Inc. | System and method of providing system jobs within a compute environment |
US8863143B2 (en) | 2006-03-16 | 2014-10-14 | Adaptive Computing Enterprises, Inc. | System and method for managing a hybrid compute environment |
US9231886B2 (en) | 2005-03-16 | 2016-01-05 | Adaptive Computing Enterprises, Inc. | Simple integration of an on-demand compute environment |
EP3203374B1 (en) | 2005-04-07 | 2021-11-24 | III Holdings 12, LLC | On-demand access to compute resources |
US8041773B2 (en) | 2007-09-24 | 2011-10-18 | The Research Foundation Of State University Of New York | Automatic clustering for self-organizing grids |
US8533341B2 (en) * | 2007-10-17 | 2013-09-10 | Netopex, Inc. | System and method for modeling, monitoring and managing telecommunications networks and infrastructure |
US20130107444A1 (en) | 2011-10-28 | 2013-05-02 | Calxeda, Inc. | System and method for flexible storage and networking provisioning in large scalable processor installations |
US9465771B2 (en) | 2009-09-24 | 2016-10-11 | Iii Holdings 2, Llc | Server on a chip and node cards comprising one or more of same |
US9054990B2 (en) | 2009-10-30 | 2015-06-09 | Iii Holdings 2, Llc | System and method for data center security enhancements leveraging server SOCs or server fabrics |
US8599863B2 (en) * | 2009-10-30 | 2013-12-03 | Calxeda, Inc. | System and method for using a multi-protocol fabric module across a distributed server interconnect fabric |
US9077654B2 (en) | 2009-10-30 | 2015-07-07 | Iii Holdings 2, Llc | System and method for data center security enhancements leveraging managed server SOCs |
US9876735B2 (en) | 2009-10-30 | 2018-01-23 | Iii Holdings 2, Llc | Performance and power optimized computer system architectures and methods leveraging power optimized tree fabric interconnect |
US20110103391A1 (en) | 2009-10-30 | 2011-05-05 | Smooth-Stone, Inc. C/O Barry Evans | System and method for high-performance, low-power data center interconnect fabric |
US20110087771A1 (en) * | 2009-10-05 | 2011-04-14 | Vss Monitoring, Inc. | Method, apparatus and system for a layer of stacked network captured traffic distribution devices |
US9311269B2 (en) | 2009-10-30 | 2016-04-12 | Iii Holdings 2, Llc | Network proxy for high-performance, low-power data center interconnect fabric |
US9648102B1 (en) * | 2012-12-27 | 2017-05-09 | Iii Holdings 2, Llc | Memcached server functionality in a cluster of data processing nodes |
US10877695B2 (en) | 2009-10-30 | 2020-12-29 | Iii Holdings 2, Llc | Memcached server functionality in a cluster of data processing nodes |
US9680770B2 (en) | 2009-10-30 | 2017-06-13 | Iii Holdings 2, Llc | System and method for using a multi-protocol fabric module across a distributed server interconnect fabric |
US11720290B2 (en) | 2009-10-30 | 2023-08-08 | Iii Holdings 2, Llc | Memcached server functionality in a cluster of data processing nodes |
WO2011072274A1 (en) * | 2009-12-11 | 2011-06-16 | Juniper Networks, Inc. | Media access control address translation in virtualized environments |
US8467680B2 (en) * | 2010-12-07 | 2013-06-18 | At&T Intellectual Property I, Lp | Optical bandwidth control device |
US8738754B2 (en) | 2011-04-07 | 2014-05-27 | International Business Machines Corporation | Systems and methods for managing computing systems utilizing augmented reality |
WO2011107036A2 (en) * | 2011-04-14 | 2011-09-09 | 华为技术有限公司 | Data transmission method on switch device and apparatus thereof |
US8782162B1 (en) * | 2011-07-20 | 2014-07-15 | Google Inc. | System for merging and comparing real-time analytics data with conventional analytics data |
US8782166B1 (en) * | 2011-07-20 | 2014-07-15 | Google Inc. | System for generating a site pathing report based on real-time analytics data |
US8638692B2 (en) * | 2011-10-19 | 2014-01-28 | Broadcom Corporation | System and method for end-to-end automatic configuration of network elements using a link-level protocol |
US9092594B2 (en) | 2011-10-31 | 2015-07-28 | Iii Holdings 2, Llc | Node card management in a modular and large scalable server system |
EP2626552B1 (en) * | 2012-02-10 | 2020-07-15 | Siemens Gamesa Renewable Energy A/S | Wind turbine control system |
US9729408B2 (en) * | 2012-02-15 | 2017-08-08 | Vss Monitoring, Inc. | Encapsulating data packets |
US20130215748A1 (en) * | 2012-02-21 | 2013-08-22 | Tektronix, Inc. | Intelligent and Scalable Network Monitoring Utilizing a Hierarchy of Devices |
US9031065B2 (en) | 2012-04-23 | 2015-05-12 | Hewlett-Packard Development Company, L.P. | Switch having dedicated stacking link |
US9225550B2 (en) * | 2012-06-21 | 2015-12-29 | International Business Machines Corporation | Switch monitoring statistics gathering at servers and gateways for overlay networks |
US8879558B1 (en) * | 2012-06-27 | 2014-11-04 | Juniper Networks, Inc. | Dynamic remote packet capture |
EP2896158A4 (en) | 2012-09-14 | 2016-04-13 | Hewlett Packard Development Co | Determining a load distribution for data units at a packet inspection device |
CN102946330B (en) * | 2012-09-29 | 2017-03-15 | 华为技术有限公司 | network packet loss measuring method, device and system |
US20140115166A1 (en) * | 2012-10-24 | 2014-04-24 | Vss Monitoring, Inc. | System, method, and apparatus for determining allocation of filtering resources for the filtering of captured data packets |
US9391843B1 (en) * | 2012-12-31 | 2016-07-12 | Juniper Networks, Inc. | Pre-computing effects of modifying components in a data center switch |
US9331915B1 (en) * | 2013-01-25 | 2016-05-03 | Amazon Technologies, Inc. | Dynamic network traffic mirroring |
US9787567B1 (en) * | 2013-01-30 | 2017-10-10 | Big Switch Networks, Inc. | Systems and methods for network traffic monitoring |
US9130818B2 (en) * | 2013-03-11 | 2015-09-08 | Anue Systems, Inc. | Unified systems of network tool optimizers and related methods |
CN103269375A (en) * | 2013-05-30 | 2013-08-28 | 厦门亿联网络技术股份有限公司 | Method for updating client-side configuration information automatically |
CN104519027A (en) * | 2013-09-30 | 2015-04-15 | 宁夏先锋软件有限公司 | Safety equipment of computer network |
US9306816B2 (en) * | 2013-12-24 | 2016-04-05 | Ixia | System and method for replaying network captures |
JP2015186233A (en) * | 2014-03-26 | 2015-10-22 | 富士通株式会社 | Packet processing device and packet processing method |
JP6248763B2 (en) * | 2014-03-31 | 2017-12-20 | 富士通株式会社 | Capture point determination method, capture point determination system, and capture point determination program |
US10270645B2 (en) | 2014-07-21 | 2019-04-23 | Big Switch Networks, Inc. | Systems and methods for handling link aggregation failover with a controller |
US10313372B2 (en) * | 2015-03-02 | 2019-06-04 | David Paul Heilig | Identifying malware-infected network devices through traffic monitoring |
US10355964B2 (en) | 2014-10-31 | 2019-07-16 | At&T Intellectual Property I, L.P. | Method and system to capture selected network data |
US20160142269A1 (en) * | 2014-11-18 | 2016-05-19 | Cisco Technology, Inc. | Inline Packet Tracing in Data Center Fabric Networks |
US10855551B2 (en) * | 2014-12-31 | 2020-12-01 | Dell Products L.P. | Multi-port selection and configuration |
US9813323B2 (en) | 2015-02-10 | 2017-11-07 | Big Switch Networks, Inc. | Systems and methods for controlling switches to capture and monitor network traffic |
US10374904B2 (en) | 2015-05-15 | 2019-08-06 | Cisco Technology, Inc. | Diagnostic network visualization |
US10536357B2 (en) | 2015-06-05 | 2020-01-14 | Cisco Technology, Inc. | Late data detection in data center |
US9967158B2 (en) | 2015-06-05 | 2018-05-08 | Cisco Technology, Inc. | Interactive hierarchical network chord diagram for application dependency mapping |
US10142353B2 (en) | 2015-06-05 | 2018-11-27 | Cisco Technology, Inc. | System for monitoring and managing datacenters |
US10289438B2 (en) | 2016-06-16 | 2019-05-14 | Cisco Technology, Inc. | Techniques for coordination of application components deployed on distributed virtual machines |
US10708183B2 (en) | 2016-07-21 | 2020-07-07 | Cisco Technology, Inc. | System and method of providing segment routing as a service |
US20180115469A1 (en) * | 2016-10-21 | 2018-04-26 | Forward Networks, Inc. | Systems and methods for an interactive network analysis platform |
US10972388B2 (en) | 2016-11-22 | 2021-04-06 | Cisco Technology, Inc. | Federated microburst detection |
US10708152B2 (en) | 2017-03-23 | 2020-07-07 | Cisco Technology, Inc. | Predicting application and network performance |
US10523512B2 (en) | 2017-03-24 | 2019-12-31 | Cisco Technology, Inc. | Network agent for generating platform specific network policies |
US10764141B2 (en) | 2017-03-27 | 2020-09-01 | Cisco Technology, Inc. | Network agent for reporting to a network policy system |
US10594560B2 (en) | 2017-03-27 | 2020-03-17 | Cisco Technology, Inc. | Intent driven network policy platform |
US10873794B2 (en) | 2017-03-28 | 2020-12-22 | Cisco Technology, Inc. | Flowlet resolution for application performance monitoring and management |
CN107196793B (en) * | 2017-05-18 | 2019-12-17 | 普联技术有限公司 | IPTV networking system, first forwarding equipment and access point equipment |
CN107040447B (en) * | 2017-05-18 | 2019-11-29 | 普联技术有限公司 | IPTV group network system, forwarding device and access point apparatus |
US10680887B2 (en) | 2017-07-21 | 2020-06-09 | Cisco Technology, Inc. | Remote device status audit and recovery |
US10419327B2 (en) * | 2017-10-12 | 2019-09-17 | Big Switch Networks, Inc. | Systems and methods for controlling switches to record network packets using a traffic monitoring network |
US10554501B2 (en) | 2017-10-23 | 2020-02-04 | Cisco Technology, Inc. | Network migration assistant |
US10523541B2 (en) | 2017-10-25 | 2019-12-31 | Cisco Technology, Inc. | Federated network and application data analytics platform |
US10594542B2 (en) | 2017-10-27 | 2020-03-17 | Cisco Technology, Inc. | System and method for network root cause analysis |
US11233821B2 (en) | 2018-01-04 | 2022-01-25 | Cisco Technology, Inc. | Network intrusion counter-intelligence |
US10999149B2 (en) | 2018-01-25 | 2021-05-04 | Cisco Technology, Inc. | Automatic configuration discovery based on traffic flow data |
US10574575B2 (en) | 2018-01-25 | 2020-02-25 | Cisco Technology, Inc. | Network flow stitching using middle box flow stitching |
US10826803B2 (en) | 2018-01-25 | 2020-11-03 | Cisco Technology, Inc. | Mechanism for facilitating efficient policy updates |
US10798015B2 (en) | 2018-01-25 | 2020-10-06 | Cisco Technology, Inc. | Discovery of middleboxes using traffic flow stitching |
US11128700B2 (en) | 2018-01-26 | 2021-09-21 | Cisco Technology, Inc. | Load balancing configuration based on traffic flow telemetry |
US10785189B2 (en) * | 2018-03-01 | 2020-09-22 | Schweitzer Engineering Laboratories, Inc. | Selective port mirroring and in-band transport of network communications for inspection |
CN108683632A (en) * | 2018-04-04 | 2018-10-19 | 山石网科通信技术有限公司 | Firewall security policy method of adjustment and device |
US10715615B1 (en) * | 2018-08-01 | 2020-07-14 | The Government Of The United States Of America As Represented By The Secretary Of The Air Force | Dynamic content distribution system and associated methods |
US11018960B2 (en) * | 2019-03-06 | 2021-05-25 | Cisco Technology, Inc. | Accelerated time series analysis in a network |
US11606258B2 (en) | 2019-04-23 | 2023-03-14 | Red Hat, Inc. | Determining network topology based on packet traffic |
JP7335529B2 (en) * | 2020-01-21 | 2023-08-30 | 日本電信電話株式会社 | Time stamp correction device, time stamp correction method, and program |
US11683228B2 (en) * | 2020-11-10 | 2023-06-20 | Mastercard International Incorporated | Automatically managing a role of a node device in a mesh network |
US11784933B2 (en) | 2020-12-08 | 2023-10-10 | Google Llc | Traffic shaping offload on a network interface controller |
Citations (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5781318A (en) * | 1995-08-07 | 1998-07-14 | Fitel Photomatrix | Circuit and method of testing for silent faults in a bi-directional optical communication system |
US6041037A (en) * | 1996-08-19 | 2000-03-21 | Nec Corporation | ATM virtual path switching node |
US6424627B1 (en) * | 1997-02-24 | 2002-07-23 | Metrobility Optical Systems | Full-duplex medium tap apparatus and system |
US20030112760A1 (en) * | 2001-12-17 | 2003-06-19 | Puppa Gary J. | System and method for transmission of operations, administration and maintenance packets between ATM and switching networks upon failures |
US20040120259A1 (en) * | 2002-12-20 | 2004-06-24 | Stewart Jones | Passive network tap device |
US20050005031A1 (en) * | 2003-03-31 | 2005-01-06 | Gordy Stephen C. | Network security tap for use with intrusion detection system |
US20050129033A1 (en) * | 2003-12-13 | 2005-06-16 | Gordy Stephen C. | Network tap for use with multiple attached devices |
US20050257262A1 (en) * | 2004-04-28 | 2005-11-17 | Eldad Matityahu | Zero-interrupt network tap |
US20060002370A1 (en) * | 2004-07-02 | 2006-01-05 | Nortel Networks Limited | VLAN support of differentiated services |
US20060083511A1 (en) * | 2002-12-17 | 2006-04-20 | Xyratex Technology Limited | Network tap module |
US20060259542A1 (en) * | 2002-01-25 | 2006-11-16 | Architecture Technology Corporation | Integrated testing approach for publish/subscribe network systems |
US20070180152A1 (en) * | 2006-01-27 | 2007-08-02 | Cisco Technology, Inc. | Method and apparatus to extend error-disable-and-ignore and port-bounce capability to a PC-facing port of an IP phone |
US7277957B2 (en) * | 2001-07-17 | 2007-10-02 | Mcafee, Inc. | Method of reconstructing network communications |
US20080049627A1 (en) * | 2005-06-14 | 2008-02-28 | Panduit Corp. | Method and Apparatus for Monitoring Physical Network Topology Information |
US20080112474A1 (en) * | 2006-11-13 | 2008-05-15 | Rami Refaeli | Systems and methods for implementing advanced power line services |
US7508764B2 (en) * | 2005-09-12 | 2009-03-24 | Zeugma Systems Inc. | Packet flow bifurcation and analysis |
US7606147B2 (en) * | 2005-04-13 | 2009-10-20 | Zeugma Systems Inc. | Application aware traffic shaping service node positioned between the access and core networks |
US7719966B2 (en) * | 2005-04-13 | 2010-05-18 | Zeugma Systems Inc. | Network element architecture for deep packet inspection |
US7936688B2 (en) * | 2002-09-16 | 2011-05-03 | Jds Uniphase Corporation | Protocol cross-port analysis |
Family Cites Families (76)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CA2124974C (en) * | 1993-06-28 | 1998-08-25 | Kajamalai Gopalaswamy Ramakrishnan | Method and apparatus for link metric assignment in shortest path networks |
US5600632A (en) * | 1995-03-22 | 1997-02-04 | Bell Atlantic Network Services, Inc. | Methods and apparatus for performance monitoring using synchronized network analyzers |
US6175868B1 (en) * | 1998-05-15 | 2001-01-16 | Nortel Networks Limited | Method and apparatus for automatically configuring a network switch |
US6745243B2 (en) * | 1998-06-30 | 2004-06-01 | Nortel Networks Limited | Method and apparatus for network caching and load balancing |
DK1145541T3 (en) * | 1998-11-24 | 2013-03-11 | Niksun Inc | Apparatus and method for collecting and analyzing communication data |
US6658016B1 (en) * | 1999-03-05 | 2003-12-02 | Broadcom Corporation | Packet switching fabric having a segmented ring with token based resource control protocol and output queuing control |
US6456845B1 (en) * | 1999-12-15 | 2002-09-24 | Tekelec | Methods and systems for observing, analyzing and correlating multi-protocol signaling message traffic in a mobile telecommunications network |
US7039724B1 (en) * | 2000-03-09 | 2006-05-02 | Nortel Networks Limited | Programmable command-line interface API for managing operation of a network device |
US7079537B1 (en) * | 2000-04-25 | 2006-07-18 | Advanced Micro Devices, Inc. | Layer 3 switching logic architecture in an integrated network switch |
EP1162795A3 (en) * | 2000-06-09 | 2007-12-26 | Broadcom Corporation | Gigabit switch supporting improved layer 3 switching |
US6708292B1 (en) * | 2000-08-18 | 2004-03-16 | Network Associates, Inc. | System, method and software for protocol analyzer remote buffer management |
JP3729051B2 (en) * | 2000-10-18 | 2005-12-21 | 日本電気株式会社 | Inter-domain routing apparatus, system and method |
US6781961B1 (en) * | 2000-11-17 | 2004-08-24 | Emware, Inc. | Systems and methods for routing messages sent between computer systems |
US7231430B2 (en) * | 2001-04-20 | 2007-06-12 | Egenera, Inc. | Reconfigurable, virtual processing system, cluster, network and method |
US7363353B2 (en) * | 2001-07-06 | 2008-04-22 | Juniper Networks, Inc. | Content service aggregation device for a data center |
US7133365B2 (en) * | 2001-11-02 | 2006-11-07 | Internap Network Services Corporation | System and method to provide routing control of information over networks |
US7139824B2 (en) * | 2001-11-28 | 2006-11-21 | International Business Machines Corporation | Method and system for isolating and simulating dropped packets in a computer network |
US7113512B1 (en) * | 2001-12-12 | 2006-09-26 | At&T Corp. | Ethernet-to-ATM interworking technique |
US7170892B2 (en) * | 2001-12-28 | 2007-01-30 | Nokia Corporation | Network element, and associated method, for facilitating communication of data between elemental devices |
JP3937855B2 (en) * | 2002-02-06 | 2007-06-27 | 日本電気株式会社 | Multi-ring control method, node using the same, and control program |
US8370936B2 (en) * | 2002-02-08 | 2013-02-05 | Juniper Networks, Inc. | Multi-method gateway-based network security systems and methods |
US7257640B1 (en) * | 2002-04-16 | 2007-08-14 | At&T Corp. | System and method for bandwidth monitoring and allocation in networks |
US8788650B1 (en) * | 2002-07-19 | 2014-07-22 | Fortinet, Inc. | Hardware based detection devices for detecting network traffic content and methods of using the same |
US7206831B1 (en) * | 2002-08-26 | 2007-04-17 | Finisar Corporation | On card programmable filtering and searching for captured network data |
US8204051B2 (en) * | 2003-03-19 | 2012-06-19 | Samsung Electronics Co., Ltd. | Apparatus and method for queuing delay-sensitive packets for transmission on heterogenous links |
US7627669B2 (en) * | 2003-05-21 | 2009-12-01 | Ixia | Automated capturing and characterization of network traffic using feedback |
US7599283B1 (en) * | 2003-06-30 | 2009-10-06 | Packeteer, Inc. | Network traffic synchronization and data compression in redundant network topologies |
US7480258B1 (en) * | 2003-07-03 | 2009-01-20 | Cisco Technology, Inc. | Cross stack rapid transition protocol |
US20050044261A1 (en) * | 2003-07-18 | 2005-02-24 | Rahul Saxena | Method of operating a network switch |
US8588069B2 (en) * | 2003-08-29 | 2013-11-19 | Ineoquest Technologies, Inc. | System and method for analyzing the performance of multiple transportation streams of streaming media in packet-based networks |
US7324553B1 (en) * | 2003-09-30 | 2008-01-29 | Packeteer, Inc. | Dynamic bandwidth management responsive to access link state in redundant network topologies |
US20050138171A1 (en) * | 2003-12-19 | 2005-06-23 | Slaight Thomas M. | Logical network traffic filtering |
US8171553B2 (en) * | 2004-04-01 | 2012-05-01 | Fireeye, Inc. | Heuristic based capture with replay to virtual machine |
JP5038887B2 (en) * | 2004-04-15 | 2012-10-03 | クリアパス・ネットワークス・インコーポレーテッド | System and method for managing a network |
EP1782293A2 (en) * | 2004-08-20 | 2007-05-09 | Enterasys Networks, Inc. | System, method and apparatus for traffic mirror setup, service and security in communication networks |
US7948889B2 (en) * | 2004-09-29 | 2011-05-24 | Ebay Inc. | Method and system for analyzing network traffic |
US20060242694A1 (en) * | 2004-11-08 | 2006-10-26 | Jeffrey Gold | Mitigation and mitigation management of attacks in networked systems |
US7660892B2 (en) * | 2005-01-24 | 2010-02-09 | Daintree Networks, Pty. Ltd. | Network analysis system and method |
ATE525829T1 (en) * | 2005-02-28 | 2011-10-15 | Ibm | BLADE SERVER SYSTEM HAVING AT LEAST ONE STACKED SWITCH WITH MULTIPLE SWITCHES CONNECTED TO EACH OTHER AND CONFIGURED FOR MANAGEMENT AND OPERATION AS A SINGLE VIRTUAL SWITCH |
US7570601B2 (en) * | 2005-04-06 | 2009-08-04 | Broadcom Corporation | High speed autotrunking |
US7619982B2 (en) * | 2005-04-25 | 2009-11-17 | Cisco Technology, Inc. | Active probe path management |
US8040899B2 (en) * | 2005-05-26 | 2011-10-18 | Genband Us Llc | Methods, systems, and computer program products for implementing automatic protection switching for media packets transmitted over an ethernet switching fabric |
US20060280207A1 (en) * | 2005-06-08 | 2006-12-14 | Stephen Guarini | Distributed network monitoring system |
US9418040B2 (en) * | 2005-07-07 | 2016-08-16 | Sciencelogic, Inc. | Dynamically deployable self configuring distributed network management system |
US7672227B2 (en) * | 2005-07-12 | 2010-03-02 | Alcatel Lucent | Loop prevention system and method in a stackable ethernet switch system |
US8077718B2 (en) * | 2005-08-12 | 2011-12-13 | Microsoft Corporation | Distributed network management |
US20070081463A1 (en) * | 2005-10-11 | 2007-04-12 | Subash Bohra | System and Method for Negotiating Stack Link Speed in a Stackable Ethernet Switch System |
US7627549B1 (en) * | 2005-12-16 | 2009-12-01 | At&T Corp. | Methods and systems for transferring data over electronics networks |
US7849185B1 (en) * | 2006-01-10 | 2010-12-07 | Raytheon Company | System and method for attacker attribution in a network security system |
JP4739141B2 (en) * | 2006-02-24 | 2011-08-03 | アラクサラネットワークス株式会社 | Ring network and master node |
US7733781B2 (en) * | 2006-04-24 | 2010-06-08 | Broadcom Corporation | Distributed congestion avoidance in a network switching system |
US7809827B1 (en) * | 2006-05-12 | 2010-10-05 | Juniper Networks, Inc. | Network device having service card for lawful intercept and monitoring of packet flows |
US7500158B1 (en) * | 2006-07-06 | 2009-03-03 | Referentia Systems, Inc. | System and method for network device configuration |
US7849256B2 (en) * | 2006-07-11 | 2010-12-07 | Advanced Micro Devices, Inc. | Memory controller with ring bus for interconnecting memory clients to memory devices |
US8160056B2 (en) * | 2006-09-08 | 2012-04-17 | At&T Intellectual Property Ii, Lp | Systems, devices, and methods for network routing |
US7751713B2 (en) * | 2007-01-19 | 2010-07-06 | Infinera Corporation | Communication network with skew path monitoring and adjustment |
US7688725B2 (en) * | 2007-02-07 | 2010-03-30 | King Fahd University Of Petroleum & Minerals | Content-aware congestion control system |
US8320245B2 (en) * | 2007-03-13 | 2012-11-27 | Alcatel Lucent | Policy enforcement points |
US8358591B2 (en) * | 2007-06-06 | 2013-01-22 | Hewlett-Packard Development Company, L.P. | Network traffic monitoring in a server network environment |
US8615008B2 (en) * | 2007-07-11 | 2013-12-24 | Foundry Networks Llc | Duplicating network traffic through transparent VLAN flooding |
US7773529B2 (en) * | 2007-12-27 | 2010-08-10 | Net Optic, Inc. | Director device and methods thereof |
EP2241072B1 (en) * | 2007-12-31 | 2011-05-25 | Telecom Italia S.p.A. | Method of detecting anomalies in a communication system using numerical packet features |
US8559306B2 (en) * | 2008-02-13 | 2013-10-15 | Cisco Technology, Inc. | End-to-end packet aggregation in mesh networks |
US8068491B2 (en) * | 2008-02-13 | 2011-11-29 | Telcordia Technologies, Inc. | Methods for reliable multicasting in local peer group (LPG) based vehicle ad hoc networks |
US8743740B2 (en) * | 2008-04-08 | 2014-06-03 | At&T Intellectual Property I, L.P. | Methods and apparatus to implement a partial mesh virtual private local area network service |
US7725603B1 (en) * | 2008-04-30 | 2010-05-25 | Network Appliance, Inc. | Automatic network cluster path management |
US8082353B2 (en) * | 2008-05-13 | 2011-12-20 | At&T Mobility Ii Llc | Reciprocal addition of attribute fields in access control lists and profiles for femto cell coverage management |
US7792046B2 (en) * | 2008-06-05 | 2010-09-07 | Vss Monitoring, Inc. | Ethernet switch-based network monitoring system and methods |
US8831566B2 (en) * | 2008-11-21 | 2014-09-09 | At&T Intellectual Property I, L.P. | Femtocell local breakout management services |
US8208494B2 (en) * | 2008-12-03 | 2012-06-26 | Gigamon Llc | Intelligent packet slicing |
US8289977B2 (en) * | 2009-06-10 | 2012-10-16 | International Business Machines Corporation | Two-layer switch apparatus avoiding first layer inter-switch traffic in steering packets through the apparatus |
US8370959B2 (en) * | 2009-07-23 | 2013-02-05 | Cisco Technology, Inc. | Connection device authentication |
US8432801B2 (en) * | 2009-07-31 | 2013-04-30 | Google Inc. | System and method for identifying multiple paths between network nodes |
US20110087771A1 (en) * | 2009-10-05 | 2011-04-14 | Vss Monitoring, Inc. | Method, apparatus and system for a layer of stacked network captured traffic distribution devices |
US8599692B2 (en) * | 2009-10-14 | 2013-12-03 | Vss Monitoring, Inc. | System, apparatus and method for removing unwanted information from captured data packets |
US8488466B2 (en) * | 2009-12-16 | 2013-07-16 | Vss Monitoring, Inc. | Systems, methods, and apparatus for detecting a pattern within a data packet and detecting data packets related to a data packet including a detected pattern |
-
2010
- 2010-10-05 US US12/898,529 patent/US20110087771A1/en not_active Abandoned
- 2010-10-05 US US12/898,536 patent/US8832222B2/en active Active
- 2010-10-05 US US12/898,578 patent/US8903964B2/en active Active
- 2010-10-05 US US12/898,572 patent/US9148358B2/en active Active
- 2010-10-05 US US12/898,540 patent/US8717901B2/en active Active
- 2010-10-05 US US12/898,515 patent/US20110082936A1/en not_active Abandoned
- 2010-10-05 US US12/898,549 patent/US9014198B2/en active Active
- 2010-10-05 US US12/898,501 patent/US20110087979A1/en not_active Abandoned
- 2010-10-05 US US12/898,583 patent/US20110080829A1/en not_active Abandoned
Patent Citations (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5781318A (en) * | 1995-08-07 | 1998-07-14 | Fitel Photomatrix | Circuit and method of testing for silent faults in a bi-directional optical communication system |
US6041037A (en) * | 1996-08-19 | 2000-03-21 | Nec Corporation | ATM virtual path switching node |
US6424627B1 (en) * | 1997-02-24 | 2002-07-23 | Metrobility Optical Systems | Full-duplex medium tap apparatus and system |
US7277957B2 (en) * | 2001-07-17 | 2007-10-02 | Mcafee, Inc. | Method of reconstructing network communications |
US20030112760A1 (en) * | 2001-12-17 | 2003-06-19 | Puppa Gary J. | System and method for transmission of operations, administration and maintenance packets between ATM and switching networks upon failures |
US20060259542A1 (en) * | 2002-01-25 | 2006-11-16 | Architecture Technology Corporation | Integrated testing approach for publish/subscribe network systems |
US7936688B2 (en) * | 2002-09-16 | 2011-05-03 | Jds Uniphase Corporation | Protocol cross-port analysis |
US20060083511A1 (en) * | 2002-12-17 | 2006-04-20 | Xyratex Technology Limited | Network tap module |
US20040120259A1 (en) * | 2002-12-20 | 2004-06-24 | Stewart Jones | Passive network tap device |
US20050005031A1 (en) * | 2003-03-31 | 2005-01-06 | Gordy Stephen C. | Network security tap for use with intrusion detection system |
US20050129033A1 (en) * | 2003-12-13 | 2005-06-16 | Gordy Stephen C. | Network tap for use with multiple attached devices |
US20050257262A1 (en) * | 2004-04-28 | 2005-11-17 | Eldad Matityahu | Zero-interrupt network tap |
US20060002370A1 (en) * | 2004-07-02 | 2006-01-05 | Nortel Networks Limited | VLAN support of differentiated services |
US7606147B2 (en) * | 2005-04-13 | 2009-10-20 | Zeugma Systems Inc. | Application aware traffic shaping service node positioned between the access and core networks |
US7719966B2 (en) * | 2005-04-13 | 2010-05-18 | Zeugma Systems Inc. | Network element architecture for deep packet inspection |
US20080049627A1 (en) * | 2005-06-14 | 2008-02-28 | Panduit Corp. | Method and Apparatus for Monitoring Physical Network Topology Information |
US7508764B2 (en) * | 2005-09-12 | 2009-03-24 | Zeugma Systems Inc. | Packet flow bifurcation and analysis |
US20070180152A1 (en) * | 2006-01-27 | 2007-08-02 | Cisco Technology, Inc. | Method and apparatus to extend error-disable-and-ignore and port-bounce capability to a PC-facing port of an IP phone |
US20080112474A1 (en) * | 2006-11-13 | 2008-05-15 | Rami Refaeli | Systems and methods for implementing advanced power line services |
US7738612B2 (en) * | 2006-11-13 | 2010-06-15 | Main.Net Communications Ltd. | Systems and methods for implementing advanced power line services |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10819535B2 (en) * | 2017-12-13 | 2020-10-27 | Siemens Aktiengesellschaft | Method for data packet transmission and/or reception |
CN110597226A (en) * | 2019-09-17 | 2019-12-20 | 中车青岛四方机车车辆股份有限公司 | Abnormity early warning method and device for vehicle-mounted Ethernet |
Also Published As
Publication number | Publication date |
---|---|
US8832222B2 (en) | 2014-09-09 |
US20110085556A1 (en) | 2011-04-14 |
US9148358B2 (en) | 2015-09-29 |
US9014198B2 (en) | 2015-04-21 |
US20110085543A1 (en) | 2011-04-14 |
US20110082921A1 (en) | 2011-04-07 |
US20110082936A1 (en) | 2011-04-07 |
US8903964B2 (en) | 2014-12-02 |
US20110087979A1 (en) | 2011-04-14 |
US20110087772A1 (en) | 2011-04-14 |
US20110080829A1 (en) | 2011-04-07 |
US20110082910A1 (en) | 2011-04-07 |
US8717901B2 (en) | 2014-05-06 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9014198B2 (en) | Apparatus and system for aggregating captured network traffic | |
CN107852365B (en) | Method and apparatus for dynamic VPN policy model | |
US10063432B2 (en) | Method and system of supporting service chaining in a data network | |
US10911355B2 (en) | Multi-site telemetry tracking for fabric traffic using in-band telemetry | |
US7593352B2 (en) | Discovering MPLS VPN services in a network | |
RU2589340C2 (en) | Network system and method of acquiring vlan tag data | |
KR101445468B1 (en) | Method, system and apparatus providing secure infrastructure | |
US9819586B2 (en) | Network-based ethernet switching packet switch, network, and method | |
JP2018518862A (en) | System and method for providing virtual interfaces and advanced smart routing in a global virtual network (GVN) | |
WO2015150743A1 (en) | Network monitor | |
CN105706393A (en) | Method and system of supporting operator commands in link aggregation group | |
US11546303B2 (en) | Automatic establishment of network tunnels by an SDWAN controller based on group and role assignments of network devices | |
US20080263615A1 (en) | Integrated operation management system of video transmission network and operation management method | |
US20120170581A1 (en) | Policy homomorphic network extension | |
CN107508730B (en) | SDN network-based data center interconnection method and device | |
US9521066B2 (en) | vStack enhancements for path calculations | |
Soeurt et al. | Shortest path forwarding using OpenFlow | |
CN114598698A (en) | Data transmission method and device, electronic equipment and computer storage medium | |
Chen et al. | A dynamic security traversal mechanism for providing deterministic delay guarantee in SDN | |
Feamster | Implications of the software defined networking revolution for technology policy | |
Bennett et al. | Transforming a Modern Telecom Network—From All-IP to Network Cloud | |
Szegedi et al. | Importance of Transport Infrastructure Design to the Performance of Carrier Ethernet Services |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: VSS MONITORING, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BRESLIN, TERENCE M.;KUCHARCZYK, DAVID;HINSHAW, JAN ALLAN;SIGNING DATES FROM 20101214 TO 20101216;REEL/FRAME:025524/0581 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: NETSCOUT SYSTEMS, INC., MASSACHUSETTS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:VSS MONITORING, INC.;REEL/FRAME:049489/0052 Effective date: 20190617 |