Apparatus and method for selective mirroring
An apparatus is described that facilitates selective mirroring through processing of network traffic in accordance with provisioned rules and policies. The apparatus includes a port included in a set of at least one port, wherein each port in the set receives input traffic, a data processor that processes input data from the set of at least one port to generate mirrored data, based on rules with bitwise granularity across a header and a payload of the input data, and a mirror port selectable from the set of at least one port that transmits output traffic corresponding to the mirrored data. Advantageously, the apparatus provides an architectural framework well suited to a low cost, high speed, robust implementation of selective mirroring that enables flexible, advanced network security and monitoring features and network traffic analysis.
1. An apparatus to facilitate selective mirroring, comprising:
a port included in a set of at least one port, wherein each of said set of at least one port receives input traffic;
a data processor that processes input data from said set of at least one port to generate mirrored data, based on rules with bitwise granularity across a header and a payload of said input data; and
a mirror port selectable from said set of at least one port that transmits output traffic corresponding to said mirrored data;
wherein said rules include signature-based rules that match incoming bits with a selected pattern of bits; and
wherein said data processor comprises:
a plurality of microcode controlled state machines, each of said plurality of microcode controlled state machines including a computation kernel operating in accordance with microcode stored in an associated control store;
a distribution circuit that routes individual network traffic segments corresponding to said input data to said plurality of microcode controlled state machines, such that at least one individual microcode controlled state machine applies a rule encoded in said microcode to said individual network traffic segments to produce modification instructions; and
a circuit that performs a modification of said input data based on said modification instructions from said at least one microcode controlled state machine to produce said output data.
2. An apparatus to facilitate selective mirroring, comprising:
a port included in a set of at least one port, wherein each of said set of at least one port receives input traffic;
a data processor that processes input data from said set of at least one port to generate mirrored data, based on rules with bitwise granularity across a header and a payload of said input data; and
a mirror port selectable from said set of at least one port that transmits output traffic corresponding to said mirrored data;
wherein said rules include signature-based rules that match incoming bits with a selected pattern of bits; and
wherein said data processor comprises:
a plurality of microcode controlled state machines, each of said plurality of microcode controlled state machines including a computation kernel operating in accordance with microcode stored in an associated control store;
a distribution circuit to route individual network traffic segments corresponding to said input data to said plurality of microcode controlled state machines, such that each individual microcode controlled state machine processes a network traffic segment in accordance with microcode stored in an associated control store to produce a processed individual traffic segment; and
an aggregation circuit to route processed individual network traffic segments from said plurality of microcode controlled state machines in accordance with an output routing strategy and thereby produce said output data.
3. The apparatus of claim 1 , wherein said modification includes at least one of duplication and re-direction of said input data.
4. The apparatus of claim 1 , wherein said circuit is an output circuit.
5. The apparatus of claim 4 , wherein said modification of said input data applied by said output circuit is based on a modification command from an aggregation circuit positioned between said plurality of microcode controlled state machines and said output circuit, wherein said modification command is aggregated from said modification instructions.
6. The apparatus of claim 1 , wherein each of said plurality of microcode controlled state machines includes an output circuit to process said network traffic segment, output from a condition analysis circuit, and output from a condition check circuit.
7. The apparatus of claim 2 , wherein said modification includes at least one of duplication and re-direction of said input data.
8. The apparatus of claim 2 , wherein each of said plurality of microcode controlled state machines includes an output circuit to process said network traffic segment, output from a condition analysis circuit, and output from a condition check circuit.