Cisco Technology, Inc.

Paul J Aitken

Andrew G Johnson

Benoit Claise

Paul Atkins

Aamer Saeed Akhter

Mark Hannah

George Macrae Taylor

Katriona Lightbody

Arivu Mani Ramasamy

Randall R Stewart

Peter Lei

Ganesh Sadasivan

Sunil Khaunte

Paul Harry Gleichauf

Stanford Louis Yates

Xiaoxue Ma

Zhipu Jin

Mark Gillott

Gowri Dhandapani

Nagaraj Varadharajan

Dimitri Bouianovski

A method is provided in one example embodiment and includes receiving a plurality of packets and generating a data record that is based on information associated with the packets. The data record includes a synchronized time window field that defines a time boundary at which data aggregation associated with the data record is stopped, where the synchronized time window field remains constant as the data aggregation associated with the data record occurs. In other embodiments, the method includes creating a new cache entry for new packets arriving at a network element, where the new cache entry is created in response to a value of the synchronized time window field changing. The synchronized time window field can include a window size attribute that defines how long the synchronized time window remains unchanged.

System and method for synchronized reporting in a network environment

In an example embodiment, there is disclosed an apparatus comprising a first interface configured to receive a packet from a client, a second interface configured to transmit the packet to a server, a third interface configured to communicate with at least one processing device, redirection module in communication with the first interface, the second interface and the third interface, and flow monitoring and state information module in communication with the first interface, the second interface, the third interface and the redirection module. Responsive to receipt of the packet on the first interface, the redirection module is operable to communicate with the flow monitoring and state information module whether state information exists for the packet, the state information comprising an address for a processing device. The redirection module is operable to route the packet to the processing device responsive to determining state information exists for the packet.

Flow redirection employing state information

In one embodiment, a method includes determining a first template defining a data format for one or more first data records and a second template defining a data format for one or more second data records. The template may be needed to decode the information included in an associated data record. The first template is sent on a first stream of a multi-stream protocol in an ordered fashion, such as SCTP. The one or more first data records are also sent on the first stream in an ordered fashion and include first flow information for data sent through a network device. A second template is sent on a second stream using the multi-stream protocol in an ordered fashion. One or more second data records are sent on the second stream including second flow information for data sent through the network device.

Streaming of templates and data records in individual streams using a multistream protocol

A method of aggregating network traffic flows for network traffic elements is described. The traffic elements are characterized by a plurality of characteristics having respective values, where a flow profile is formed by classifying each element into one of a plurality of flows dependent on its characteristic value. The method comprises the steps of obtaining an instantaneous flow profile and aggregating flows from the flow profile having a common value for a characteristic.

Method and apparatus for aggregating network traffic flows

An apparatus is provided in one example embodiment and includes a network element configured to receive a plurality of packets. The network element is configured to couple to a module, the module being configured to generate a data record that is based on information associated with the packets and capable of being interpreted according to a template in which multiple information elements can be positioned to create a hierarchical relationship within structured data. The structured data further includes references to the information elements. The network element further including an export module configured to export the data record to a next destination.

System and method for exporting structured data in a network environment

An approach for managing the consumption of resources uses adaptive random sampling to decrease the collection of flow statistical data as the consumption of resources increases. When a packet is received from a network, a determination is made whether the packet belongs to an existing flow, for which flow statistical data is being collected, or to a new flow. If the packet belongs to an existing flow, then the flow statistical data for the existing flow is updated to reflect the packet. If the packet belongs to the new flow, then a sampling probability is used to determine whether the new flow is to be sampled. The sampling probability is determined, at least in part, upon a current usage of resources.

Approach for managing the consumption of resources using adaptive random sampling

An apparatus and method for collecting network traffic information is arranged to receive network traffic elements including one or more key fields having respective key field values. The apparatus and method further classify received network traffic elements into one of a plurality of flows dependent on the key field value of one or more key fields defined by a flow profile. The method and apparatus are further configurable to vary the flow profile, create a flow record and export the flow record to a collecting node.

Collecting network traffic information

In one embodiment, a networking device includes logic encoded in one or more tangible media for execution and when executed operable to cause performing receiving a command to collect a unique object identifier that represents a unique management information base (MIB) object; retrieving, in response to receiving the command, a Simple Network Management Protocol (SNMP) MIB variable or table that corresponds to the MIB object; creating an Internet Protocol Flow Information Export (IPFIX) template data structure that includes the object identifier; in which the object identifier is encoded in the IPFIX template data structure as a string that has a variable length; and exporting the encoded object identifier with the variable length string.

Exporting management information base data using IPFIX

A method of monitoring network traffic flows of network traffic elements between locations in a data communications network is disclosed. The method comprises the step of classifying, as a first flow, traffic elements from a first to a second network location sharing a flow characteristic. The method further comprises the steps of classifying, as a second flow, traffic elements from said second to said first network location sharing said flow characteristic correlating said first and second flows.

Method and apparatus for monitoring network traffic

A method and system for network time protocol forwarding is disclosed. The disclosed method includes in one embodiment receiving time data from a server utilizing a first protocol and transmitting the time data to a client utilizing a second protocol. In another embodiment, the described method further includes receiving the time data from a network time protocol time server and transmitting the time data to a network time protocol time client. In yet another embodiment, the described method further includes receiving the time data from the network time protocol time server utilizing a first network-layer protocol and transmitting the time data to the network time protocol time client utilizing a second network-layer protocol.

Method and system for network time protocol forwarding

A method and system for resolving domain name system (DNS) queries in a multiprotocol communications network is disclosed. The disclosed method includes in one embodiment receiving a destination address from a DNS server utilizing a first protocol; and communicating with a network element associated with the destination address utilizing a second protocol. In another embodiment, the disclosed method includes maintaining a profile for the DNS server and selecting the DNS server from a plurality of DNS servers utilizing the profile. In yet another embodiment, the disclosed method includes requesting a first address from the DNS server, where the first address is formatted according to a primary protocol, detecting a request failure in response to the request, and requesting a second address from the DNS server, where the second address is formatted according to a secondary protocol, in response to detecting the request failure.

Growing community of inventors

West Linton, United Kingdom

Paul J Aitken