Method for time aware inline remote mirroring
A method of monitoring packet traffic is provided. The method includes: at a first access point, capturing portions of traffic packets passing therethrough separated by time intervals; encapsulating the portions of traffic packets thereby forming encapsulated packets and adding timestamps to the encapsulated packets so as to preserve the portions of traffic packets and information related to the time intervals; transmitting the encapsulated packets over a network; decapsulating the encapsulated packets so as to obtain replay packets and the capture timestamp, wherein the replay packets include the portions of the traffic packets; and, transmitting the replay packets separated by the time intervals, wherein the timestamps are used to reproduce the time intervals so as to imitate the traffic packets passing through the first access point.
1. A device comprising:
a memory configured to store instructions; and
a processor configured to execute the instructions to:
receive encapsulated packets including sequence information;
extract timestamps from the encapsulated packets;
decapsulate the encapsulated packets so as to obtain portions of traffic packets captured at an access point;
form, based on decapsulating the encapsulated packets, replay packets,
the replay packets being separated by time intervals that are reproduced using the timestamps,
the replay packets being ordered based on the sequence information included in the encapsulated packets, and
the sequence information including particular information that is used to identify lost packets; and
transmit the replay packets.
2. The device of claim 1 , where the processor, when transmitting the replay packets, is configured to:
transmit the replay packets to a remote device.
3. The device of claim 1 , where the replay packets include at least some of the portions of the traffic packets captured at the access point.
4. The device of claim 1 , where the processor is further configured to:
register the device with one or more packet routing engines.
5. The device of claim 1 , where
the processor is further configured to:
receive a request to provide information associated with the portions of the traffic packets captured at the access point to a remote device, and
the processor, when receiving the encapsulated packets, is configured to:
receive the encapsulated packets based on receiving the request.
6. The device of claim 1 , where the sequence information includes sequence numbers.
7. The device of claim 6 , where the sequence numbers are used to order the encapsulated packets and reduce jitter in the encapsulated packets.
8. A method comprising:
receiving, by a device, encapsulated packets including sequence information;
extracting, by the device, timestamps from the encapsulated packets;
decapsulating, by the device, the encapsulated packets so as to obtain portions of traffic packets captured at an access point,
forming, by the device and based on decapsulating the encapsulated packets, replay packets,
the replay packets being separated by time intervals that are reproduced using the timestamps,
the replay packets being ordered based on the sequence information included in the encapsulated packets, and
the sequence information including particular information that is used to identify lost packets; and
transmitting, by the device, the replay packets.
9. The method of claim 8 , where, when transmitting the replay packets, the method includes:
transmitting the replay packets to a remote device.
10. The method of claim 8 , where the replay packets include at least some of the portions of the traffic packets captured at the access point.
11. The method of claim 8 , where the method further includes:
registering the device with one or more packet routing engines.
12. The method of claim 8 , where
the method further includes:
receiving a request to provide information associated with the portions of the traffic packets captured at the access point to a remote device, and
when receiving the encapsulated packets, the method includes:
receiving the encapsulated packets based on receiving the request.
13. The method of claim 8 , where the sequence information includes sequence numbers.
14. The method of claim 13 , where the sequence numbers are used to reduce jitter in the encapsulated packets.
15. A device comprising:
a memory configured to store instructions; and
a processor configured to execute the instructions to:
capture portions of traffic packets;
encapsulate the portions of the traffic packets to form encapsulated packets;
add timestamps to the encapsulated packets to preserve the portions of the traffic packets; and
transmit the encapsulated packets,
information associated with the transmitted encapsulated packets being used to form replay packets,
the replay packets being separated by time intervals that are reproduced using the timestamps, and
the replay packets being ordered based on sequence information included in the encapsulated packets.
16. The device of claim 15 , where the processor, when transmitting the encapsulated packets, is configured to:
transmit the encapsulated packets on a low-bandwidth channel.
17. The device of claim 16 , where the processor is further configured to:
form the low-bandwidth channel.
18. The device of claim 15 , where the replay packets include at least some of the portions of the traffic packets.
19. The device of claim 15 , where the timestamps are different from other timestamps that are present in the traffic packets prior to capturing of the portions of the traffic packets.
20. The device of claim 15 , where the transmitted encapsulated packets are compared with other packets to determine a delay between different locations in a network.