Systems and methods for processing packets

1. A method to efficiently distribute data traffic to a plurality of network monitoring instruments, the method comprising:

receiving a packet on a network port;

in response to receiving the packet on the network port, copying the packet to produce a plurality of packets without analyzing the packet by creating a number of packets equal to a number of criteria in a plurality of criteria, wherein each criterion in the plurality of criteria corresponds to exactly one network monitoring instrument in the plurality of network monitoring instruments monitoring the network port;

in response to copying the packet, tagging each packet in the plurality of packets with a different unique identifier to produce a plurality of unique tagged packets, each of which is unique among the plurality of unique tagged packets, each said unique identifier representing a correspondence between a unique tagged packet and exactly one criterion in the plurality of criteria, each criterion including an action that includes mapping the packet to a port of a network monitoring instrument in the plurality of network monitoring instruments, wherein at least two of the plurality of unique tagged packets have the different unique identifier, and wherein each said unique identifier includes a Virtual Area Network (VLAN) tag;

for each unique tagged packet in the plurality of unique tagged packets, determining whether the unique tagged packet matches the criterion having the correspondence to the unique tagged packet, without determining whether the unique tagged packet matches a remainder of criteria in the plurality of criteria; and

in response to determining that the unique tagged packet matches the criterion having the correspondence to the unique tagged packet, performing the action associated with the criterion.

2. The method of claim 1 , further comprising:

sending the unique tagged packet to the network monitoring instrument.

3. The method of claim 1 , comprising:

removing a portion of the packet to produce a compact packet, wherein the removed portion comprises at least one of a header associated with the packet or a body associated with the packet; and

based on the criterion, copying the compact packet to produce the plurality of packets.

4. The method of claim 1 , comprising:

identifying the network port that received the packet;

identifying a particular criterion based on identification of the network port that received the packet and an express association between the particular criterion and the network port that received the packet;

determining a number of copies of the packet to make, based on the particular criterion; and

copying the packet according to the determined number of copies to provide the plurality of packets.

5. The method of claim 1 , wherein the unique identifier comprises a Virtual Local Area Network (VLAN) tag.

6. The method of claim 1 , further comprising: when a matched criterion is not found, dropping the packet.

7. The method of claim 1 , further comprising storing the criterion in Ternary Content-Addressable Memory (TCAM).

8. The method of claim 1 , said tagging each packet in the plurality of packets comprising:

tagging each packet in the plurality of packets with an ordinal number to obtain the plurality of unique tagged packets; and

matching each packet in the plurality of packets to the criterion to obtain a matched criterion such that the ordinal number associated with the packet corresponds to an ordinal number associated with the matched criterion.

9. A method to efficiently distribute data traffic to a plurality of network monitoring instruments, the method comprising:

receiving a packet on a network port;

in response to receiving the packet on the network port, copying the packet to produce a plurality of packets without analyzing the packet by creating a number of packets in the plurality of packets equal to a number of criteria in a plurality of criteria, wherein each criterion in the plurality of criteria corresponds to exactly one network monitoring instrument in the plurality of network monitoring instruments monitoring the network port;

in response to copying him the packet, tagging each packet in the plurality of packets with a different unique identifier to produce a plurality of unique tagged packets, each of which is unique among the plurality of unique tagged packets, each said unique identifier representing a correspondence between a unique tagged packet and exactly one criterion in the plurality of criteria, each criterion including an action that includes mapping the packet to a port of a network monitoring instrument in the plurality of network monitoring instruments, wherein at least two of the plurality of unique tagged packets have the different unique identifier, wherein the unique identifier includes a Virtual Area Network (VLAN) tag, and wherein the action comprises forwarding the packet to the network port, forwarding the packet to group of network ports, dropping the packet, assigning the packet to a multicast group, or modifying a field associated with the packet;

in response to tagging each packet, determining whether the unique tagged packet in the plurality of unique tagged packets matches the criterion having the correspondence to the unique tagged packet, without determining whether the unique tagged packet in the plurality of unique tagged packets matches a remainder of criteria in the plurality of criteria; and

in response to matching the unique tagged packet, performing the action associated with the criterion.

10. The method of claim 9 , said tagging each packet in the plurality of packets comprising:

tagging each packet in the plurality of packets with an ordinal number to obtain the plurality of unique tagged packets;

matching each packet in the plurality of packets to the to obtain a matched criterion such that the ordinal number associated with the packet corresponds to an ordinal number associated with the matched criterion; and

performing the action associated with the matched criterion.

11. A system to efficiently distribute data traffic to a plurality of network monitoring instruments, the system comprising:

a network port configured to receive a packet;

packet duplication circuitry to copy the packet to produce a plurality of packets without analyzing the packet by creating a number of packets in the plurality of packets equal to a number of criteria in a plurality of criteria, wherein each criterion in the plurality of criteria corresponds to exactly one network monitoring instrument in the plurality of network monitoring instruments monitoring the network port; and

tagging circuitry to tag each packet in the plurality of packets with a different unique identifier to produce a plurality of unique tagged packets, each of which is unique among the plurality of unique tagged packets, each said unique identifier representing a correspondence between a unique tagged packet and exactly one criterion in the plurality of criteria, each criterion including an action that includes mapping the packet to a port of a network monitoring instrument in the plurality of network monitoring instruments, wherein at least two of the plurality of unique tagged packets have the different unique identifier, wherein the unique identifier includes a Virtual Area Network (VLAN) tag;

a processing unit to determine whether the unique tagged packet in the plurality of unique tagged packets matches the criterion having the correspondence to the unique tagged packet, without determining whether the unique tagged packet in the plurality of unique tagged packet matches a remainder of criteria in the plurality of criteria, and to perform the action associated with the criterion in response to matching the unique tagged packet.

12. The system of claim 11 , further comprising the processing unit configured to:

send the unique tagged packet to the network monitoring instrument.

13. The system of claim 11 , wherein the unique identifier associates one packet in the plurality of unique tagged packets with one network monitoring instrument in the plurality of network monitoring instruments.

14. The system of claim 11 , the packet duplication circuitry to:

identify the network port that received the packet;

identify a particular criterion, based on identification of the network port that received the packet and an express association between the particular criterion and the network port that received the packet;

determine a number of copies of the packet to make, based on the particular criterion; and

copy the packet according to the determined number of copies to provide the plurality of packets.

15. The system of claim 11 , wherein the packet duplication circuitry comprises a multicast mechanism.

16. The system of claim 11 , further comprising an input mechanism comprising one or more loop back ports, the input mechanism configured to input the plurality of unique tagged packets sequentially into the processing unit.

17. The system of claim 11 , the tagging circuitry to:

tag each packet in the plurality of packets with an ordinal number to obtain the plurality of unique tagged packets; and

match each packet in the plurality of packets to the to obtain a matched criterion such that the ordinal number associated with the packet corresponds to an ordinal number associated with the matched criterion.

18. The system of claim 17 , further comprising the processing unit configured to remove the ordinal number from each packet in the plurality of unique tagged packets.