Arista Networks, Inc.

Kevin Martin Amiraux

James Chun Pang

François Labonté

Muhammad Khalid Yousuf

Sambath Kumar Balasubramanian

Travis Ryan Hammond

Stefan J Rebaud

Sonny N Tran

Min H Teng

A method and apparatus of a network element that enables truncation of tap aggregation data via snoop actions. In one embodiment, a network element configured for tap aggregation includes a first tap port to couple with a tap switch, a set of tool ports to transmit network data received from the first tap port to a data analyzer, and data plane logic to manage a mapping between the first tap port and the set of tool ports. A first tool port in the set of tool ports is configured for egress truncation and the data plane logic performs a snoop action to truncate a first unit of network data to be forwarded to the first tool port and a forward action to forward a second unit of network data to a second tool port in the set of tool ports without truncation.

Method and apparatus for tap aggregation and network data truncation

A method and system of accelerating monitoring of network traffic. The method may include receiving, at a network chip of a network device, a network traffic data unit; capturing, by the network chip, the network traffic data unit based on a traffic sampling rate; adding, by the network chip, a sampling header to the network traffic data unit to obtain a sampled network traffic data unit; sending the sampled network traffic data unit from the network chip to a sampling engine; receiving, from the sampling engine, a flow datagram that includes a network traffic data unit portion and a flow datagram header; generating a flow network data traffic unit that includes the flow datagram; and transmitting the flow network data traffic unit towards a collector.

Accelerated network traffic sampling using an accelerated line card

Accelerating monitoring of network traffic by: configuring a first network chip of a non-accelerated line card with a VOQ associated with an internal interface that is connected to a second network chip of a first accelerated line card; receiving, at the first network chip, a data unit; selecting, by the first network chip, the data unit based on a traffic sampling rate; adding information identifying the data unit as having been selected for sampling to obtain a selected data unit; and sending the selected data unit from the first network chip to the second network chip using the VOQ and the internal interface. The second network chip identifies the selected data unit and, based on the identification, appends a sampling header to the data unit to obtain a sampled data unit, and transmits the sampled data unit to the sampling engine of the first accelerated line card.

Accelerated network traffic sampling for a non-accelerated line card

Growing community of inventors

Burnaby, Canada

Kevin Martin Amiraux