Monitoring server load balancing

1. A network monitoring device, comprising:

an ingress port, for receiving a plurality of mirrored network packets;

plurality of egress ports, associated with a plurality of monitoring servers of a plurality of distinct monitoring groups;

a packet classifier, coupled to said ingress port for load-balancing said plurality of mirrored network packets across said plurality of monitoring servers of said plurality of distinct monitoring groups, by forwarding respective mirrored network packets to respective egress ports corresponding to respective said monitoring servers of said plurality of distinct monitoring groups based on a plurality of parameters contained in a network packet header of said respective mirrored network packets, wherein said plurality of parameters include a destination port protocol parameter that expressly identifies a protocol; and

associating said plurality of distinct monitoring groups with a networking protocol, wherein said examining comprises determining a networking protocol for each of said packets, and wherein said selecting comprises selecting said destination server such that said plurality of packets are forwarded by protocol to said plurality of distinct monitoring groups.

2. The network monitoring device of claim 1 , wherein said packet classifier is configurable to forward a subset of said mirrored network packets associated with a single network flow to a single monitoring server of said plurality of monitoring servers.

3. The network monitoring device of claim 1 , wherein said packet classifier comprises an integrated circuit, and further comprising:

one or more programmable memories, coupled to said packet classifier, configured to store data usable by said packet classifier to forward said respective mirrored network packets between said ingress port and said plurality of egress ports.

4. The network monitoring device of claim 3 , wherein for each of said respective mirrored network packets, said packet classifier is configured to generate a hash value from a header.

5. The network monitoring device of claim 1 , further comprising:

a processor, for executing instructions to control said network monitoring device; and

a memory coupled to said processor for storing an operating system for controlling said network monitoring device, wherein said operating system is configurable to calculate forwarding information corresponding to said plurality of monitoring servers, said forwarding information being usable by said packet classifier for said forwarding.

6. The network monitoring device of claim 5 , wherein said operating system is further configurable to perform a plurality of status checks for said plurality of monitoring servers.

7. The network monitoring device of claim 6 , wherein said operating system is further configurable to recalculate routing information.

8. A method of load-balancing network traffic across multiple servers of a plurality of distinct monitoring groups, comprising:

configuring a memory with a hash function that maps at least a portion of an IP address of a packet to one of said multiple servers of said plurality of distinct monitoring groups;

for incoming packets, selecting a destination server from said multiple servers of said plurality of said distinct monitoring groups in accordance with an executed result of said hash function, such that said packets are load-balanced across said multiple servers of said plurality of distinct monitoring groups based on a plurality of parameters contained in a network packet header of said packets that include a destination port protocol parameter that expressly identifies a protocol; and

associating said plurality of distinct monitoring groups with a networking protocol, wherein said examining comprises determining a networking protocol for each of said packets, and wherein said selecting comprises selecting said destination server such that said plurality of packets are forwarded by protocol to said plurality of distinct monitoring groups.

9. The method of claim 8 , wherein said hash function comprises a range of hash values corresponding to network traffic, divided across a plurality of sub-ranges associated with said multiple monitoring servers.

10. The method of claim 8 further comprising examining headers corresponding to packets and generating a hash value from said header.

11. The method of claim 8 wherein said selecting comprises:

identifying one of a plurality of sub-ranges corresponding to said hash value; and selecting a server associated with said one of said plurality of sub-ranges.

12. The method of claim 8 , further comprising:

associating said plurality of servers with one of said plurality of distinct monitoring groups.

13. A method of configuring a network monitoring device, comprising:

generating forwarding data for mirrored network traffic, wherein said forwarding data subdivides said mirrored network traffic across a plurality of monitoring servers of a plurality of distinct monitoring groups;

mapping a flow from a particular client to a particular server and from said particular server to said particular client to a common monitoring server for load balancing;

storing said forwarding data within said network monitoring device wherein the forwarding data is based on a plurality of parameters contained in network packet headers of said mirrored network traffic that include a destination port protocol parameter that expressly identifies a protocol; and

associating said plurality of distinct monitoring groups with a networking protocol, wherein said examining comprises determining a networking protocol for each of said packets, and wherein said selecting comprises selecting said destination server such that said plurality of packets are forwarded by protocol to said plurality of distinct monitoring groups.

14. The method of claim 13 , further comprising:

determining a status of one of said plurality of monitoring servers; and

modifying said forwarding data with reference to said status.

15. The method of claim 13 , wherein said generating forwarding data comprises:

determining a plurality of hash values corresponding to said network traffic;

dividing said plurality of hash values into a plurality of sub-ranges; and

allocating said plurality of sub-ranges to one of said plurality of monitoring servers.

16. The method of claim 15 , wherein said generating forwarding data further comprises:

generating internal forwarding information for passing a packet from an ingress port of said network monitoring device to an egress port of said network monitoring device corresponding to one of said plurality of monitoring servers.