Granted Patent B2

US 9,680,728 · App. 13/765,628 · Granted Jun 13, 2017

Abstract

Claims (38)

1. A method for monitoring data associated with a virtual computing environment, comprising:

receiving, at a client-side tunnel component in a server device executing a virtual computing environment, virtually-originated data intended for a first destination, the virtually-originated data originating from at least one virtual server executing in the virtual computing environment on the server device, wherein the first destination is different from a tap device, said virtually-originated data originated from a virtual server in said virtual computing environment and transmitted in the form of data packets;

encapsulating, at the client-side tunnel component, said virtually-originated data using a tunneling protocol, forming encapsulated traffic;

transmitting, at the client-side tunnel component, said encapsulated traffic to the tap device, wherein said tap device decapsulates said encapsulated traffic to recover a version of said virtually-originated data and forwards said version of said virtually-originated data to a monitoring device, wherein said tap device forwards at least some of said virtually-originated data to the first destination in response to a monitoring determination;

using a policy engine to analyze said virtually-originated data, said virtually-originated data is encapsulated only when said virtually-originated data fits criteria to be forwarded to one of said tap device and said monitoring device; receiving other data;

determining, using said policy engine, whether said other data fits said criteria to be forwarded to said one of said tap device and said monitoring device; and

transmitting said other data onward without encapsulating said other data using said tunneling protocol when said other data does not fit said criteria to be forwarded to said one of said tap device and said monitoring device.

2. The method of claim 1 wherein said monitoring device represents a network analyzer.

3. The method of claim 1 wherein said monitoring device represents an intrusion detection system.

4. The method of claim 1 wherein said monitoring device represents an intrusion prevention system.

5. The method of claim 1 wherein said monitoring device represents a remote monitor.

6. The method of claim 1 wherein said monitoring device represents a network probe.

7. The method of claim 1 wherein said tap device decapsulates said encapsulated traffic using a tunnel component implemented on a NIC (network interlace card).

8. The method of claim 1 wherein said tap device decapsulates said encapsulated traffic using a tunnel component implemented external of said tap device.

9. A method for monitoring data originating from a virtual computing environment, comprising;

receiving, at a client-side tunnel component in a server device executing a virtual computing environment, virtually-originated data intended for a first destination, the virtually originated data originating from at least one virtual server executing in the virtual computing environment on the server device, wherein the first destination is different from a tap device, said virtually-originated data originated from is virtual server in said virtual computing environment;

forming, at the client-side tunnel component, tunneled traffic from said virtually-originated data using a tunneling protocol;

transmitting, at the client-side tunnel component, said tunneled traffic through an IP network to a tap device, wherein said tap device de-tunnels said tunneled traffic to recover a version of said virtually-originated data;

routing said version of said virtually-originated data to a monitoring device, said monitoring device represents one of a network analyzer, an intrusion detection system, an intrusion prevention system, a remote monitor, and a network probe, wherein said tap device forwards at least some of said virtually-originated data to the first destination in response to a monitoring determination;

using a policy engine to analyze said virtually-originated data, said virtually-originated data is formed into said tunneled traffic only when said virtually-originated data fits predetermined criteria; receiving other data;

determining, using said policy engine, whether said other data fits said predefined criteria; and

transmitting said other data onward without processing said other data for tunneling using said tunneling protocol when said other data does not fit said predefined criteria.

10. The method of claim 9 wherein said monitoring device represents said network analyzer.

11. The method of claim 9 wherein said monitoring device represents said intrusion detection system.

12. The method of claim 9 wherein said monitoring device represents said intrusion prevention system.

13. The method of claim 9 wherein said monitoring device represents said remote monitor.

14. The method of claim 9 wherein said monitoring device represents said network probe.

15. The method of claim 9 wherein said virtually-originated data is also independently transmitted to a destination device specified by a header of said virtually-originated data independent of said transmitting to said tap device.

16. The method of claim 9 wherein said tap device de-tunnels said tunneled traffic using a tunnel component implemented on a NIC (network interface card).

17. The method of claim 9 wherein said tap device de-tunnels said tunneled traffic using a tunnel component implemented external of said tap device.

18. A system for monitoring data associated with a virtual computing environment, comprising:

a client side tunnel component executing in a virtual computing environment on a server device;

a tap device;

the client-side tunnel component for receiving virtually-originated data intended for a first destination, the virtually-originated data originating from at least one virtual server executing in the virtual computing environment on the server device, wherein the first destination is different from the tap device, said virtually-originated data originated from a virtual server in said virtual computing environment and transmitted in the form of data packets;

the client side tunnel component encapsulating said virtually-originated data using a tunneling protocol, forming encapsulated traffic;

the client-side tunnel component transmitting, at the client-side tunnel component, said encapsulated traffic to the tap device, wherein said tap device decapsulates said encapsulated traffic to recover a version of said virtually-originated data and forwards said version of said virtually-originated data to a monitoring device, wherein said tap device forwards at least some of said virtually-originated data to the first destination in response to a monitoring determination;

a policy engine configured to analyze said virtually-originated data, said virtually-originated data is encapsulated only when said virtually-originated data fits criteria to be forwarded to one of said tap device and said monitoring device; and

the client side tunnel component receiving other data, determining, using said policy engine, whether said other data fits said criteria to be forwarded to said one of said tap device and said monitoring device, and transmitting said other data onward without encapsulating said other data using said tunneling protocol when said other data does not fit said criteria to be forwarded to said one of said tap device and said monitoring device.

Assignments (7)