IP Library › Granted Patent US 12701068
Granted Patent B2
US 12701068 · App. 18/609,148 · Granted Aug 4, 2026

Active and passive measurement on data traffic of a virtual private network (VPN) service

Inventors: Clarence Filsfils (Brussels, BE); Rakesh Gandhi (Stittsville, CA); Pablo Camarillo Garvia (Madrid, ES); Ahmed Mohamed Ahmed Abdelsalam (L'Aquila, IT); Sonia Ben Ayed (Vanves, FR)
Assignee: Cisco Technology, Inc.
H04L43/106H04L43/0829H04L43/0852H04L2212/00
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12701068
App. No.
18/609,148
Granted
Aug 4, 2026
Kind
B2
Abstract

This disclosure describes techniques and mechanisms for performing passive measurement for combined one-way latency, packet loss metrics along with liveness detection using customer data packets ingested at a sink node in hardware for Level 2 and Level 3 VPN services. The customer data packets are sampled and copied for measurement either at source node or sink node. The duplicated measurement packet headers are punted based on the IPv6 destination option type to hardware analytics engine at sink node for analytics that populates histogram bins using the timestamps from the packets. Using the transmitted packets during a period, and received packets in all the bins, packet loss is measured. Based on the packets received status, liveness state is detected by the sink node and notified to the source node.

Claims (64)

1 . A method for performing passive measurement of customer data traffic within a virtual private network (VPN), the method comprising:

receiving, by a source node, data packets associated with a data flow of a customer;

sampling, by the source node, a portion of the data packets, wherein sampling comprises:

generating, by the source node, copies of a first portion of the data packets based at least in part on encapsulating each of the data packets within the first portion, wherein encapsulating includes adding one or more of a path tracing header, a deadline timestamp, or a destination option header; and

sending, from the source node to a sink node within the VPN, the data packets and the copies of the data packets;

receiving, by the sink node, the data packets and the copies of the data packets;

identifying, by the sink node and based at least in part on an Internet Protocol version 6 (IPv6) destination option included in headers of the copies of the data packets, the copies as a subset of the data packets for measurement;

duplicating, by the sink node, the headers of the subset of the data packets;

determining to ingest the headers of the subset of the data packets using hardware of the sink node;

generating, by the hardware and based at least in part on the headers, telemetry data indicative of a performance metric of the data packets; and

sending, to an application on a user device, the telemetry data.

2 . The method of claim 1 , further comprising:

receiving, by a transit node, the copies of the data packets;

determining, by the transit node and based at least in part on the deadline timestamp included in a data packet of the copies of the data packets, that the data packet has expired; and

dropping, by the transit node, the data packet from the data flow.

3 . The method of claim 1 , wherein the telemetry data comprises a plurality of histogram bins or counters generated and measured by the hardware of the sink node.

4 . The method of claim 1 , wherein the sink node samples the data flow based at least in part on processing capabilities of the hardware.

5 . The method of claim 4 , wherein sampling comprises:

generating, by the source node, copies of a first portion of the data packets, the copies comprising a second subset based at least in part on encapsulating each of the data packets within the second subset, wherein encapsulating includes adding one or more of a path tracing header, a deadline timestamp, or a destination option header.

6 . The method of claim 1 , wherein the hardware of the sink node comprises an NPU with processing capabilities of millions of data packets per second.

7 . The method of claim 1 , further comprising:

determining, by the sink node, that a time period to received second data packets associated with the data flow has expired;

generating, by the sink node, a liveliness state notification; and

sending, to the source node, the liveliness state notification.

8 . The method of claim 1 , wherein the telemetry data comprises latency data, liveliness data, and packet loss data associated with each ECMP pathway.

9 . A system comprising:

one or more processors; and

one or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, by a source node, data packets associated with a data flow of a customer;

sampling, by the source node, a portion of the data packets, wherein sampling comprises:

generating, by the source node, copies of a first portion of the data packets based at least in part on encapsulating each of the data packets within the first portion, wherein encapsulating includes adding one or more of a path tracing header, a deadline timestamp, or a destination option header; and

sending, from the source node to a sink node within a virtual private network (VPN), the data packets and the copies of the data packets;

receiving, by the sink node, the data packets and the copies of the data packets;

identifying, by the sink node and based at least in part on an Internet Protocol version 6 (IPv6) destination option included in headers of the copies of the data packets, the copies as a subset of the data packets for measurement;

duplicating, by the sink node, the headers of the subset of the data packets;

determining to ingest the headers of the subset of the data packets using hardware of the sink node;

generating, by the hardware and based at least in part on the headers, telemetry data indicative of a performance metric of the data packets; and

sending, to an application on a user device, the telemetry data.

10 . The system of claim 9 , the operations further comprising:

receiving, by a transit node, the copies of the data packets;

determining, by the transit node and based at least in part on the deadline timestamp included in a data packet of the copies of the data packets, that the data packet has expired; and

dropping, by the transit node, the data packet from the data flow.

11 . The system of claim 9 , wherein the telemetry data comprises a plurality of histogram bins or counters generated and measured by the hardware of the sink node.

12 . The system of claim 9 , wherein the telemetry data comprises latency data, liveliness data, and packet loss data associated with each ECMP pathway.

13 . The system of claim 9 , wherein the hardware of the sink node comprises an NPU with processing capabilities of millions of data packets per second.

14 . The system of claim 9 , wherein the sink node samples the data flow based at least in part on processing capabilities of the hardware.

15 . The system of claim 14 , wherein sampling comprises:

generating, by the source node, copies of a first portion of the data packets, the copies comprising a second subset based at least in part on encapsulating each of the data packets within the second subset, wherein encapsulating includes adding one or more of a path tracing header, a deadline timestamp, or a destination option header.

16 . The system of claim 9 , the operations further comprising:

determining, by the sink node, that a time period to received second data packets associated with the data flow has expired;

generating, by the sink node, a liveliness state notification; and

sending, to the source node, the liveliness state notification.

17 . One or more non-transitory computer-readable media maintaining instructions that, when executed by one or more processors, program the one or more processors to perform operations comprising:

receiving, by a source node, data packets associated with a data flow of a customer;

sampling, by the source node, a portion of the data packets, wherein sampling comprises:

generating, by the source node, copies of a first portion of the data packets based at least in part on encapsulating each of the data packets within the first portion, wherein encapsulating includes adding one or more of a path tracing header, a deadline timestamp, or a destination option header; and

sending, from the source node to a sink node within a virtual private network (VPN), the data packets and the copies of the data packets;

receiving, by the sink node, the data packets and the copies of the data packets;

identifying, by the sink node and based at least in part on an Internet Protocol version 6 (IPv6) destination option included in headers of the copies of the data packets, the copies as a subset of the data packets for measurement;

duplicating, by the sink node, the headers of the subset of the data packets;

determining to ingest the headers of the subset of the data packets using hardware of the sink node;

generating, by the hardware and based at least in part on the headers, telemetry data indicative of a performance metric of the data packets; and

sending, to an application on a user device, the telemetry data.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein the sink node samples the data flow based at least in part on processing capabilities of the hardware.