Gigamon Inc.

Tushar Rajnikant Jagtap

Ujjvala Nangineni

Rakesh Muthusamy

Dominick A Cafarelli

Jan Johansson

Vikram Reddy

Kristian Pereira

Murali Bommana

Fernando Garcia-Rosell Foronda

Arunraj Mani

Bharath Harikrishnan

Systems and methods are disclosed for analyzing traffic received at a network visibility node to determine traffic levels relative to capacity at tools communicatively coupled to the network visibility node and throttling traffic when the traffic levels exceed tool capacity. In an illustrative embodiment, streams received at a network visibility node are analyzed to predict a traffic level) for a given traffic flow. The predicted level of traffic for a given traffic flow is used to decide whether to forward traffic associated with the given traffic flow to a tool port of the network visibility node that is communicatively coupled to an external tool.

Tool port throttling at a network visibility node

Introduced here are visibility platforms able to process the traffic handled by the gateways of an Evolved Packet Core (EPC) with Control and User Plane Separation (CUPS). A visibility platform can include a control processing node (CPN) and one or more user processing nodes (UPNs). The visibility platform may populate a data structure in which the CPN and UPNs are associated with locations along an interface on which Sx/N4 traffic is exchanged between the control and user planes. Each location may be representative of the point on the Sx/N4 interface at which Sx/N4 traffic processed by the corresponding node is acquired. The CPN can use the data structure to program session flows that impact how user traffic is handled by the UPNs.

Dynamic mapping of nodes responsible for monitoring traffic of an evolved packet core

At least one technique for distributing traffic from a visibility node to a network tool is disclosed. In certain embodiments, the visibility node has a tool port through which to receive a plurality of packets which each include a compressed header. The visibility node determines, for each packet, whether a given network tool has received the compressed header in decompressed format based on a header-to-tool mapping structure. The structure includes information indicative of which packet headers each of the plurality of network tools have received in decompressed format. If the visibility node determines that the tool previously received the decompressed header, the visibility node transmits the packet to the network tool in compressed format. If the visibility node determines that the tool has not previously received the decompressed header, the visibility node decompresses the compressed header prior to transmitting the packet to the given network tool.

Tool port aware stateful protocol visibility for packet distribution

Systems and methods are disclosed for analyzing traffic received at a network visibility node to determine traffic levels relative to capacity at tools communicatively coupled to the network visibility node and throttling traffic when the traffic levels exceed tool capacity. In an illustrative embodiment, streams received at a network visibility node are analyzed to predict a traffic level for a given traffic flow. The predicted level of traffic for a given traffic flow is used to decide whether to forward traffic associated with the given traffic flow to a tool port of the network visibility node that is communicatively coupled to an external tool.

A network visibility appliance automatically and dynamically determines a data traffic sampling policy that it should apply, i.e., a policy for determining which flows the network appliance should forward to one or more tools. The technique can be used to adjust for changes in network traffic to avoid exceeding performance constraints (e.g., maximum throughput) of network analytic tools, while maintaining high efficiency of usage of the tools. In the technique, a policy engine monitors network traffic characteristics in a subscriber throughput table and dynamically determines a sampling policy to apply, so as to decrease and/or increase traffic throughput to a given tool, so that the tool is efficiently used.

Automatic dynamic determination of data traffic sampling policy in a network visibility appliance

A method of operating a network visibility node is disclosed. In certain embodiments, the network visibility node has a plurality of network ports through which to communicate data with a plurality of network hosts and has a plurality of tool ports through which to communicate data with a plurality of network tools. The network visibility node accesses a port group map associated with a plurality of tool port groups of the network visibility node, where each of the tool port groups includes one or more tool ports of the network visibility node, and where the port group map contains a separate tool alias for each tool port group of the plurality of tool port groups. Each tool alias can correspond to a different type of network traffic. The network visibility node uses the port group map to ascertain a tool port group through which to communicate the plurality of packets with a particular network tool.

Growing community of inventors

Fremont, CA, United States of America

Tushar Rajnikant Jagtap