Monitoring server load balancing

1. A network monitoring device, comprising:

an ingress port configured to receive network packets, wherein the received network packets are copies of network traffic;

a plurality of egress ports, each associated with one of a plurality of monitoring servers; and

a packet classifier coupled to the ingress port;

wherein a plurality of monitoring groups are configured for the network monitoring device, each monitoring group from the plurality of monitoring groups including one or more monitoring servers from the plurality of monitoring servers, wherein each monitoring group from the plurality of monitoring groups is associated with a networking protocol; and

wherein the packet classifier is configured to:

determine that a plurality of network packets from among the received network packets is associated with a particular network protocol;

determine, based upon the particular network protocol, a particular monitoring group from the plurality of monitoring groups; and

distribute the plurality of network packets between multiple monitoring servers associated with the particular monitoring group, wherein the distributing includes, for each particular network packet from the plurality of network packets:

selecting a monitoring server from the multiple monitoring servers based on information included in a header of the particular network packet; and

forwarding the particular network packet from the network monitoring device using an egress port from the plurality of egress ports that is associated with the selected monitoring server.

2. The network monitoring device of claim 1 , wherein the packet classifier is further configured to identify a set of network packets from the received network packets that belong to a same flow, and wherein selecting a monitoring server includes selecting the same monitoring server for the identified set of network packets.

3. The network monitoring device of claim 1 , further comprising one or more programmable memories coupled to the packet classifier, the one or more programmable memories storing information used by the packet classifier to forward the particular network packet from the network monitoring device.

4. The network monitoring device of claim 1 , wherein the packet classifier is further configured to select the monitoring server from the multiple monitoring servers by generating a hash value from the information provided by the header associated with the particular network packet.

5. The network monitoring device of claim 4 , wherein the packet classifier is further configured to select the monitoring server from the multiple monitoring servers by comparing the generated hash value against a range of hash values corresponding to the multiple monitoring servers associated with the particular monitoring group.

6. The network monitoring device of claim 4 , wherein a range of hash values is divided into a plurality of sub-ranges, wherein each sub-range is assigned to a monitoring server from the multiple monitoring servers, and wherein the selected monitoring server is associated with a sub-range that includes the generated hash value.

7. The network monitoring device of claim 4 , wherein the packet classifier is further configured to select the monitoring server from the multiple monitoring servers by determining that the generated hash values matches a hash value assigned to the selected monitoring server.

8. The network monitoring device of claim 1 , wherein the packet classifier is further configured to perform status checks for each of the multiple monitoring servers associated with the particular monitoring group.

9. The network monitoring device of claim 8 , wherein the packet classifier is further configured to select the monitoring server from the multiple monitoring server based on results of the status checks.

10. The network monitoring device of claim 1 , further comprising a plurality of additional ingress ports configured to receive additional network packets from sources that are different than a source associated with the ingress port, wherein the additional network packets are copies of network traffic.

11. A method comprising:

determining that each network packet in a plurality of network packets received at an ingress port of a network monitoring device is associated with a particular network protocol, wherein the plurality of network packets are copies of network traffic;

determining, based upon the particular network protocol, a particular monitoring group from a plurality of monitoring groups configured for the network monitoring device, the plurality of monitoring groups including one or more monitoring servers from a plurality of monitoring servers, the plurality of monitoring servers each being associated with one of a plurality of egress ports included in the network monitoring device, wherein each monitoring group from the plurality of monitoring groups is associated with a network protocol; and

distributing the plurality of network packets between multiple monitoring servers associated with the particular monitoring group, wherein the distributing includes, for each particular network packet from the plurality of network packets:

selecting a monitoring server from the multiple monitoring servers based on information included in a header of the particular network packet; and

forwarding the particular network packet from the network monitoring device using an egress port from the plurality of egress ports that is associated with the selected monitoring server.

12. The method of claim 11 , further comprising identifying a set of network packets from the received network packets that belong to a same flow, and wherein selecting a monitoring server includes selecting the same monitoring server for the identified set of network packets.

13. The method of claim 11 , wherein forwarding the particular network packet further includes using data stored in one or more programmable memories.

14. The method of claim 11 , further comprising:

receiving additional network packets at a plurality of additional ingress ports included by the network monitoring device, wherein the additional ingress ports are configured to receive the additional network packets from sources that are different than a source associated with the ingress port, and wherein the additional network packets are copies of network traffic.

15. The method of claim 11 , wherein selecting a monitoring server from the multiple monitoring servers further includes:

generating a hash value using the information included in the header of the particular network packet; and

selecting the monitoring server from the multiple monitoring servers based on comparing the hash value against a range of hash values corresponding to the multiple monitoring servers associated with the particular monitoring group.

16. The method of claim 11 , further comprising:

performing status checks for each of the multiple monitoring servers associated with the particular monitoring group.

17. The method of claim 11 , further comprising:

configuring a new monitoring group for the network monitoring device, wherein configuring the new monitoring group includes:

associating one or more new monitoring servers from the plurality of monitoring servers with the new monitoring group, wherein the one or more new monitoring servers are each newly associated with an egress port from the plurality of egress ports; and

associating a network protocol with the new monitoring group.

18. The method of claim 11 , further comprising:

configuring a new monitoring group for the network monitoring device, wherein configuring includes:

associating one or more monitoring servers from the plurality of monitoring servers with the new monitoring group; and

associating a network protocol with the new monitoring group.

19. The method of claim 18 , wherein configuring the new monitoring group further comprises assigning a range of hash values to the one or more monitoring servers associated with the new monitoring group.

20. The method of claim 11 , wherein the network monitoring device is further configured with a default monitoring group, the default monitoring group including one or more monitoring servers from the plurality of monitoring servers.

21. The method of claim 20 , further comprising:

determining that a second plurality of network packets received at the ingress port of the network monitoring device is associated with a second network protocol, wherein the second plurality of network packets are copies of network traffic;

based upon determining that the second network protocol is not associated with a monitoring group from the plurality of monitoring groups, selecting the default monitoring group; and

distributing the second plurality of network packets between multiple monitoring servers associated with the default monitoring group.

22. The method of claim 15 , wherein the range of hash values are divided into a plurality of sub-ranges, wherein each sub-range is assigned to a monitoring server from the multiple monitoring servers, and wherein the selected monitoring server is associated with a sub-range that includes the generated hash value.

23. The method of claim 15 , wherein each value from the range of hash values is assigned to a corresponding monitoring server from the multiple monitoring servers, and wherein the generated hash value matches a hash value from the range of hash values that is assigned to the selected monitoring server.

24. The method of claim 16 , wherein selecting a monitoring server from the multiple monitoring servers is further based on results of the status checks.

25. A non-transitory computer-readable storage medium storing a plurality of computer-executable instructions executable by one or more processors, the plurality of instructions comprising:

instructions causing at least one processor from the one or more processors to determine that a plurality of network packets received at an ingress port of a network monitoring device is associated with a particular network protocol, wherein the received network packets are copies of network traffic;

instructions causing at least one processor from the one or more processors to determine, based upon the particular network protocol, a particular monitoring group from a plurality of monitoring groups configured for the network monitoring device, the plurality of monitoring groups including one or more monitoring servers from a plurality of monitoring servers, the plurality of monitoring servers each being associated with one of a plurality of egress ports included in the network monitoring device, wherein each monitoring group form the plurality of monitoring groups is associated with a network protocol; and

instructions causing at least one processor from the one or more processors to distribute the plurality of network packets between multiple monitoring servers associated with the particular monitoring group, wherein the distributing includes, for each particular network packet from the plurality of network packets:

selecting a monitoring server from the multiple monitoring servers based on information included in a header of the particular network packet; and

forwarding the particular network packet from the network monitoring device using an egress port from the plurality of egress ports that is associated with the determined selected monitoring server.