Gigamon Inc.

Networks Associates Technology, Inc.

Dominick A Cafarelli

Shehzad Merchant

Tanmay Kishore

Ashutosh Alawani

Sreekanth Settipalli

Murali Bommana

Tushar Rajnikant Jagtap

Kazim Orhan Yildiz

James Peter Anderson

Patrick Pak Tak Leong

Jesse C Shu

Peter O Schmitz

Sandeep Dahiya

Rakesh Muthusamy

Anoop V Kartha

Arunraj Mani

Elazar Rosenthal

At least one technique for distributing traffic from a visibility node to a network tool is disclosed. In certain embodiments, the visibility node has a tool port through which to receive a plurality of packets which each include a compressed header. The visibility node determines, for each packet, whether a given network tool has received the compressed header in decompressed format based on a header-to-tool mapping structure. The structure includes information indicative of which packet headers each of the plurality of network tools have received in decompressed format. If the visibility node determines that the tool previously received the decompressed header, the visibility node transmits the packet to the network tool in compressed format. If the visibility node determines that the tool has not previously received the decompressed header, the visibility node decompresses the compressed header prior to transmitting the packet to the given network tool.

Tool port aware stateful protocol visibility for packet distribution

A method of operating a network visibility node is disclosed. In certain embodiments, the network visibility node has a plurality of network ports through which to communicate data with a plurality of network hosts and has a plurality of tool ports through which to communicate data with a plurality of network tools. The network visibility node accesses a port group map associated with a plurality of tool port groups of the network visibility node, where each of the tool port groups includes one or more tool ports of the network visibility node, and where the port group map contains a separate tool alias for each tool port group of the plurality of tool port groups. Each tool alias can correspond to a different type of network traffic. The network visibility node uses the port group map to ascertain a tool port group through which to communicate the plurality of packets with a particular network tool.

Tool port aliasing in a network visibility fabric

A method performed by a network device that taps to a network having a routing device, includes: receiving a first packet tapped from the network; determining a first information regarding an input interface of the routing device based on a destination address of the first packet; receiving a second packet tapped from the network; determining a second information regarding an output interface of the routing device based on a source address of the second packet; determining a first CRC for the first packet; determining a second CRC for the second packet; and comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

Systems and methods for determining input and output interfaces of a network device and copies of a same packet going through the network device

A method for sampling packets for a network flow, includes: receiving a packet at a network port of a network switch appliance, the network switch appliance comprising an instrument port for communication with a network monitoring instrument; determining whether the packet belongs to a network flow that is desired to be monitored, wherein the act of determining is performed based at least in part on one or more information in a control plane using a processing unit; and passing the packet to the instrument port if the packet belongs to the network flow.

Systems and methods for sampling packets in a network flow

A network device includes: one or more ports for tapping to a network; and a processing unit configured for receiving a first packet tapped from the network, wherein the first packet is received at a first network port of the network device; determining a first identity of a first network equipment associated with the first packet based on a discovery protocol; and associating the first identity of the first network equipment with a first identity of the first network port of the network device at which the first packet is received; and a non-transitory medium for storing the first identity of the first network equipment and the first identity of the first network port in association with each other.

Systems and methods for processing packets tapped from a network using discovery protocol

Systems and methods for determining input and out interfaces of a network device and copies of a same packet going through the network device

A method performed by a network device that taps to a network having a routing device, includes: determining a first information regarding an input interface of the routing device for a packet; determining a second information regarding an output interface of the routing device for the packet; determining whether the packet belongs to a user-defined category based on one or more mapping formation defined at the network device; and storing the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category in a non-transitory medium in association with each other.

Systems and methods for processing packets tapped from a network

A packet switch system includes a packet switch appliance having a first network port configured to receive packets, and a first instrument port configured to communicate with a network monitoring tool, a storage system for storing the packets, and an integrated circuit configured to retrieve the packets from the storage system, and retroactively transmit the packets to the first instrument port in a play-back configuration in response to a user's command.

Network switch with traffic generation capability

An analyzer for a wireless network is configured for surfing a plurality of channels, each for an individually selectable period of time, for monitoring each channel to obtain packet information for analysis, to detect any defects in communication over each respective channel.

Method and apparatus for monitoring different channels in an IEEE 802.11 wireless LAN

A system, method and computer program product are provided for analyzing a network. Initially, network traffic information relating to network traffic is collected. Next, the network traffic information is encrypted. In use, the network traffic information is capable of being analyzed by a network analyzer adapted for decrypting the network traffic information.

Capture file format system and method for a network analyzer

A wireless analyzer device for an IEEE 802.11 Wireless LAN is programmed to perform both a per packet processing routine to obtain packet statistics, and a one second timer routine, followed by arranging the packet statistics in a logical manner for display on a computer monitor.

Method and apparatus for capture, analysis and display of packet information sent in an IEEE 802.11 wireless network

A method and apparatus provides for wirelessly monitoring data packets or frames transmitted in a wireless LAN, that permits a user to selectively filter out unwanted ones of the data packets or frames with respect to the source and destination hardware addresses, and to the frame type and subtypes.

Growing community of inventors

Ossinging, NY, United States of America

Dominick A Cafarelli