System and method for network traffic splitting
View Patent ↗A system is described where a routing server is configured to receive data packets from one or more servers on a computer network. Data packets may contain system event data that represent, for example, security events or system status. Each data packet is opened at the routing server and may be forwarded to one or more destination hosts depending on the contents of the data packet. Routing server compiles statistics on the source and destination of the data packets and periodically or in response to a command, writes the compiled statistics to a file.
1. A system, comprising:
a plurality of destination hosts, each destination host associated with at least one include or exclude pattern, wherein the at least one include or exclude pattern defines whether a plurality of data packets are forwarded to at least one destination host; and
a routing server configured to store a configuration file identifying the plurality of destination hosts, the configuration file including a destination host address, a destination host port and at least one include or exclude pattern associated with each destination host, the routing server being indirectly connected to each of the plurality of destination hosts via a computer network;
the routing server further configured to receive a plurality of data packets containing log data for one or more system events from a plurality of network devices on the computer network,
the routing server further configured to compare contents of the plurality of data packets to the at least one include or exclude pattern in the configuration file and to forward the plurality of data packets to at least one of the destination hosts by creating a copy of each of the data packets and sending the copy of each of the data packets to the at least one of the destination hosts if the contents of the data packet match an include pattern associated with the at least one of the destination hosts, and
the routing server further configured to prevent the data packet from being forwarded to at least one of the destination hosts if the contents of the data packet match an exclude pattern associated with the at least one of the destination hosts.
2. The system of claim 1 , wherein the routing server is further configured to receive and forward the plurality of data packets at an open systems interconnection (OSI) level 4 transport layer.
3. The system of claim 1 , wherein the computer network is an intranet.
4. The system of claim 1 , wherein for a destination host that is associated with both an include pattern and an exclude pattern, the routing server is further configured to, after determining that a data packet matches both the include pattern and the exclude pattern for the destination host, prevent the data packet from being forwarded to the destination host.
5. The system of claim 1 , wherein at least two destination hosts are associated with an include pattern, and the routing server is further configured to forward data packets matching the include pattern to each of the at least two destination hosts associated with the include pattern.
6. The system of claim 1 , wherein each of the plurality of network devices is capable of sending data to only one destination.
7. A method, comprising:
receiving a plurality of data packets containing log data for one or more system events from a plurality of network devices on a computer network;
storing a configuration file identifying a plurality of destination hosts, the configuration file being stored on a routing server, the routing server being indirectly connected to the plurality of destination hosts via the computer network, the configuration file including a destination host address, a destination host port and at least one include or exclude pattern associated with each destination host, wherein the at least one include or exclude pattern defines whether the plurality of data packets are forwarded to at least one destination host;
comparing contents of the plurality of data packets to the at least one include or exclude pattern in the configuration file;
forwarding the plurality of data packets to at least one of the destination hosts by creating a copy of each of the data packets and sending the copy of each of the data packets to the at least one of the destination hosts if the contents of the data packet match an include pattern associated with the at least one of the destination hosts; and
preventing the data packet from being forwarded to at least one of the destination hosts if the contents of the data packet match an exclude pattern associated with the at least one of the destination hosts.
8. The method of claim 7 , wherein the steps of receiving and forwarding the plurality of data packets are performed at an open systems interconnection (OSI) level 4 transport layer.
9. The method of claim 7 , wherein the computer network is an intranet.
10. The method of claim 7 , further comprising: for a destination host that is associated with both an include pattern and an exclude pattern, after determining that a data packet matches both the include pattern and the exclude pattern for the destination host, preventing the data packet from being forwarded to the destination host.
11. The method of claim 7 , wherein at least two destination hosts are associated with an include pattern, and forwarding the plurality of data packets comprises forwarding data packets matching the include pattern to each of the at least two destination hosts associated with the include pattern.
12. The method of claim 7 , wherein each of the plurality of network devices is capable of sending data to only one destination.
13. A computer implemented method, comprising:
receiving a plurality of data packets containing log data for one or more system events from a plurality of network devices on a computer network;
storing a configuration file identifying a plurality of destination hosts, the configuration file being stored on a routing server, the routing server being indirectly connected to the plurality of destination hosts via the computer network, the configuration file including a destination host address, a destination host port and at least one include or exclude pattern associated with each destination host, wherein the at least one include or exclude pattern defines whether the plurality of data packets are forwarded to at least one destination host;
comparing contents of the plurality of data packets to the at least one include or exclude pattern in the configuration file;
forwarding the plurality of data packets to at least one of the destination hosts by creating a copy of each of the data packets and sending the copy of each of the data packets to the at least one of the destination hosts if the contents of the data packet match an include pattern associated with the at least one of the destination hosts; and
preventing the data packet from being forwarded to at least one of the destination hosts if the contents of the data packet match an exclude pattern associated with the at least one of the destination hosts.
14. The computer implemented method of claim 13 , wherein the steps of receiving and forwarding the plurality of data packets are performed at an open systems interconnection (OSI) level 4 transport layer.
15. The computer implemented method of claim 13 , wherein the computer network is an intranet.
16. The computer implemented method of claim 13 , wherein the computer executable instructions, when executed on the computer, configure the computer to perform further steps comprising: for a destination host that is associated with both an include pattern and an exclude pattern, after determining that a data packet matches both the include pattern and the exclude pattern for the destination host, preventing the data packet from being forwarded to the destination host.
17. The computer implemented method of claim 13 , wherein at least two destination hosts are associated with an include pattern, and forwarding the plurality of data packets comprises forwarding data packets matching the include pattern to each of the at least two destination hosts associated with the include pattern.
18. The computer implemented method of claim 13 , wherein each of the plurality of network devices is capable of sending data to only one destination.