Validating network traffic policy
View Patent ↗At least one inline probe is employed to test compliance of a network element with a network traffic policy. The testing capability of the probe is handled by specialized software or hardware. The inline probes hardware can be implemented in network elements such as routers or transceivers. The inline probes can be discovered, registered, and controlled by a dedicated controller disposed at a remote location.
1. A method comprising:
generating, by at least one inline probe device, test traffic based on a traffic policy being tested;
transmitting, by the at least one inline probe device, the test traffic to a device,
the device transmitting post-device traffic based on receiving the test traffic;
receiving, by the at least one inline probe device, the post-device traffic from the device;
matching, by the at least one inline probe device, data included in the post-device traffic with a remotely programmable target bit pattern,
the remotely programmable target bit pattern being determined by a controller device located remotely from the at least one inline probe device; and
causing, by the at least one inline probe device, testing of the post-device traffic to determine whether the traffic policy is enforced on the device based on matching the data included in the post-device traffic with the remotely programmable target bit pattern.
2. The method of claim 1 , where the at least one inline probe device comprises an inline hardware probe.
3. The method of claim 1 , where the at least one inline probe device includes a first inline probe device and a second inline probe device,
where the generating the test traffic and the transmitting the test traffic are performed by the first inline probe device, and
where the receiving the post-device traffic and the matching the data are performed by the second inline probe device,
the first inline probe device being disposed upstream of the device, and
the second inline probe device being disposed downstream of the device and disposed upstream of an endpoint device.
4. The method of claim 3 , wherein the second inline probe device comprises an Application-Specific Integrated Circuit (ASIC) configured to perform real-time matching of the data included in the post-device traffic with the remotely programmable target bit pattern.
5. The method of claim 3 , where transmitting the test traffic comprises:
transmitting the test traffic to not exceed a configurable threshold of a link bandwidth between the first inline probe device and the second inline probe device.
6. The method of claim 5 , where the configurable threshold is 10%.
7. The method of claim 3 , where transmitting the test traffic comprises:
transmitting the test traffic only when utilization of a link bandwidth between the first inline probe device and the second inline probe device is below a configurable threshold.
8. The method of claim 7 , where the configurable threshold is 80%.
9. The method of claim 3 , where causing testing comprises:
analyzing the post-device traffic at the second inline probe device, and
communicating results of the analysis to the controller device.
10. The method of claim 1 , where the at least one inline probe device includes a plurality of first inline probe devices and a plurality of second inline probe devices,
where the generating the test traffic and the transmitting the test traffic are performed by the plurality of first inline probe devices, and
where the receiving the post-device traffic and the matching the data are performed by the plurality of second inline probe devices,
the plurality of first inline probe devices being disposed upstream of the device, and
the plurality of second inline probe devices being downstream of the device and upstream of an endpoint device.
11. The method of claim 1 , where the traffic policy comprises limiting a transmission rate of traffic to not exceed a predetermined rate;
where transmitting the test traffic comprises:
transmitting the test traffic at a rate above the predetermined rate; and
where causing testing comprises:
determining whether the post-device traffic is transmitted above the predetermined rate.
12. The method of claim 1 , where the traffic policy comprises limiting a transmission rate of a particular data type to not exceed a predetermined rate;
where generating the test traffic comprises:
generating the test traffic of the particular data type;
where transmitting the test traffic comprises:
transmitting the test traffic at a rate above the predetermined rate; and
where causing testing comprises:
determining whether the post-device traffic of the particular data type is transmitted above the predetermined rate.
13. The method of claim 12 , where the particular type of traffic includes video traffic.
14. The method of claim 1 , where the traffic policy comprises blocking traffic including packets with a selected destination IP address;
where generating the test traffic comprises:
generating the test traffic to include test packets with the selected destination IP address; and
where causing testing comprises:
determining whether the post-device traffic includes any of the test packets.
15. The method of claim 14 , where the traffic policy includes criteria associated with at least one of:
a time of day,
a network loading,
a subscriber service eligibility,
a subscriber usage,
a resource availability,
a source address, or
a network port number.
16. The method of claim 1 , where generating the test traffic comprises:
generating traffic not subject to the traffic policy, and
where causing testing comprises:
determining whether the traffic not subject to the traffic policy was modified by the device.
17. The method of claim 1 , where transmitting the test traffic comprises:
transmitting the test traffic during an idle time on regular network traffic.
18. The method of claim 1 , where causing testing comprises:
encapsulating and forwarding the post-device traffic to a remote device for subsequent measurement, analysis, and/or storage.
19. The method of claim 1 , where the device is included in a network that comprises a virtual network function.
20. The method of claim 1 , where generating the test traffic comprises:
generating the test traffic based on test packet information received from the controller device.
21. At least one inline probe device comprising:
at least one processor configured to:
generate test traffic based on a traffic policy to be tested;
transmit the test traffic to a network device,
the network device transmitting post-device traffic based on receiving the test traffic;
receive the post-device traffic from the network device;
match data included in the post-device traffic with a remotely programmable target bit pattern,
the remotely programmable target bit pattern being determined by a controller device located remotely from the at least one inline probe device; and
cause testing of the post-device traffic to determine whether the traffic policy is enforced on the network device based on matching the data included in the post-device traffic with the remotely programmable target bit pattern.
22. The at least one inline probe device of claim 21 , where the at least one processor, when causing testing of the post-device traffic, is configured to:
test the post-device traffic.
23. A controller device comprising:
at least one processor configured to:
determine test packet information to be used to test a traffic policy;
cause a first inline probe device to generate test traffic based on test packet information,
cause the first inline probe device to transmit the test traffic to a test device,
the test device transmitting post-device traffic to a second inline probe device based on receiving the test traffic;
send information identifying a target bit pattern to the second inline probe device;
cause the second inline probe device to match data included in the post-device traffic with the target bit pattern; and
cause the second inline probe to analyze the post-device traffic to determine whether the traffic policy is enforced on the test device,
the post-device traffic being analyzed based on matching the data included in the post-device traffic with the target bit pattern.
24. The controller device of claim 23 , where the target bit pattern is associated with network packet parameter values from a header of a data packet.
25. The controller device of claim 23 , where the at least one processor is further configured to:
automatically discover and register the first inline probe device and the second inline probe device.