Method for time aware inline remote mirroring
A method of monitoring packet traffic is provided. The method includes: at a first access point, capturing portions of traffic packets passing therethrough separated by time intervals; encapsulating the portions of traffic packets thereby forming encapsulated packets and adding timestamps to the encapsulated packets so as to preserve the portions of traffic packets and information related to the time intervals; transmitting the encapsulated packets over a network; decapsulating the encapsulated packets so as to obtain replay packets and the capture timestamps, wherein the replay packets include the portions of the traffic packets; and, transmitting the replay packets separated by the time intervals, wherein the timestamps are used to reproduce the time intervals so as to imitate the traffic packets passing through the first access point.
1. A method of monitoring traffic packets passing through a first access point, comprising:
at a mediator, receiving a request for providing to a remote device portions of the traffic packets passing through the first access point captured at the first access point;
registering the mediator so as to receive the portions of the traffic packets captured at the first access point;
at the mediator,
receive a request for providing to a remote device the portions of the traffic packets passing through the first access point captured at the first access point;
register so as to receive the portions of the traffic packets captured at the first access point;
receiving encapsulated packets from a network,
extracting timestamps from the encapsulated packets,
decapsulating the encapsulated packets so as to obtain the portions of the traffic packets captured at the first access point, and
forming replay packets, wherein the replay packets include the portions of the traffic packets; and
transmitting the replay packets from the mediator to the remote device, wherein the replay packets are separated by time intervals so as to imitate the traffic packets passing through the first access point, and wherein the time intervals are reproduced using the timestamps, wherein the reproduction of the time intervals comprises sequencing the replay packets based on sequence numbers of the encapsulated packets.
2. The method as defined in claim 1 , wherein the decapsulating of the encapsulated packets includes decryption.
3. The method as defined in claim 2 , wherein the request for providing the portions of the traffic packets includes a filter to select the packets to be captured.
4. The method as defined in claim 2 , wherein reproduction of the time intervals includes de-jittering of the packets using a de-jitter buffer.
5. The method as defined in claim 1 , wherein forming the replay packets includes reassembling fragments of the portions of the traffic packets.
6. A computer readable non-transitory tangible media comprising a set of instructions stored therein, wherein the set of instructions implements the method defined in claim 1 when executed by one or more processors.
7. A system configured to perform the method defined in claim 1 .
8. A packet traffic monitoring system comprising:
a first probe for coupling with a first access point and programmed to capture portions of traffic packets passing therethrough separated by time intervals, and for encapsulating the portions of traffic packets thereby forming encapsulated packets and adding timestamps to the encapsulated packets so as to preserve the portions of traffic packets and information related to the time intervals, and for transmitting the encapsulated packets over a network; and,
a mediator suitably programmed to:
receive a request for providing to a remote device the portions of the traffic packets passing through the first access point captured at the first access point;
register so as to receive the portions of the traffic packets captured at the first access point;
receive the encapsulated packets from the network,
decapsulate the encapsulated packets so as to obtain replay packets and the capture timestamps, wherein the replay packets include the portions of the traffic packets; and
transmit the replay packets separated by the time intervals, wherein the timestamps are used to reproduce the time intervals so as to imitate the traffic packets passing through the first access point; and
a second probe for connecting at a second access point different from the first access point, connected to a routing engine and wherein the mediator interleaves the replay packets associated with the first probe with replay packets associated with the second probe.
9. The system as defined in claim 8 , wherein the routing engine is configured to receive the encapsulated packets from the first probe and provide said packets to the mediator, wherein the mediator is a device separate from the routing engine.
10. The system as defined in claim 8 , wherein the first probe is programmed to encrypt the portions of traffic packets.