Systems and methods for processing packets tapped from a network

1. A method performed by a network device that taps to a network having a routing device, comprising:

determining a first information regarding an input interface of the routing device for a packet using a processing unit by:

receiving a first packet tapped from the network; and

determining the first information based on a destination address of the first packet by comparing the destination address of the first packet with a source address of a discovery protocol packet;

determining a second information regarding an output interface of the routing device for the packet using the processing unit;

determining whether the packet belongs to a user-defined category based on one or more mapping formation defined at the network device; and

storing the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category in a non-transitory medium in association with each other.

2. The method of claim 1 , wherein the network device comprises a plurality of network ports configured to communicate with the network, and a plurality of instrument ports configured to communicate with respective network monitoring instruments.

3. The method of claim 2 , wherein the network device further comprises a processing unit configured to perform the acts of determining.

4. The method of claim 1 , wherein the user-defined category is defined for a subscriber of the network device.

5. The method of claim 1 , wherein the non-transitory medium comprises one or more data center.

6. The method of claim 1 , wherein the act of determining the second information regarding the output interface of the routing device comprises:

receiving a second packet tapped from the network; and

determining the second information based on a source address of the second packet.

7. The method of claim 6 , wherein the act of determining the second information based on the source address of the second packet comprises comparing the source address of the second packet with a destination address of a discovery protocol packet.

8. The method of claim 6 , further comprising:

determining a first CRC for the first packet;

determining a second CRC for the second packet; and

comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

9. The method of claim 1 , further comprising running a discovery protocol at the network device.

10. The method of claim 9 , wherein the discovery protocol comprises a CDP or a LLDP.

11. The method of claim 1 , wherein the network device comprises a single network appliance.

12. The method of claim 1 , wherein the network device comprises multiple network appliances.

13. A network device comprising:

one or more ports for tapping to a network, the network comprising a routing device; and

a processing unit configured for

determining a first information regarding an input interface of the routing device for a packet by:

receiving a first packet tapped from the network; and

determining the first information based on a destination address of the first packet by comparing the destination address of the first packet with a source address of a discovery protocol packet;

determining a second information regarding an output interface of the routing device for the packet;

determining whether the packet belongs to a user-defined category based on one or more mapping formation defined at the network device; and

associating the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category, with each other; and

a non-transitory medium for storing the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category in association with each other.

14. The network device of claim 13 , further comprising a plurality of network ports configured to communicate with the network, and a plurality of instrument ports configured to communicate with respective network monitoring instruments.

15. The network device of claim 13 , wherein the user-defined category is defined for a subscriber of the network device.

16. The network device of claim 13 , wherein the non-transitory medium comprises one or more data center.

17. The network device of claim 13 , wherein the processing unit is configured for determining the second information regarding the output interface of the routing device by:

receiving a second packet tapped from the network; and

determining the second information based on a source address of the second packet.

18. The network device of claim 17 , wherein the processing unit is configured for determining the second information based on the source address of the second packet by comparing the source address of the second packet with a destination address of a discovery protocol packet.

19. The network device of claim 17 , wherein the processing unit is further configured for:

determining a first CRC for the first packet;

determining a second CRC for the second packet; and

comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

20. The network device of claim 13 , wherein the processing unit is further configured for running a discovery protocol.

21. The network device of claim 20 , wherein the discovery protocol comprises a CDP or a LLDP.

22. The network device of claim 13 , wherein the network device comprises a single network appliance.

23. The network device of claim 13 , wherein the network device comprises multiple network appliances.