Context driven policy based packet capture
A computer system provides a method for context-based packet scanning in a computing environment. The method includes the steps of receiving a packet from a virtual machine, determining if a network flow associated with the packet exists in a context data structure, and upon determining that a context entry associated with the network flow exists in the context data structure, tagging the packet with context information included in the context entry, comparing the context information and network flow information to context and network flow criteria in one or more packet capture policies, and recording contents of the packet when the context information and network flow information match one of the one or more packet capture policies.
1. A method comprising:
receiving a packet from a virtual machine;
determining if a network flow associated with the packet exists in a context data structure; and
upon determining that a context entry associated with the network flow exists in the context data structure:
tagging the packet with context information included in the context entry;
comparing the context information and network flow information to context and network flow criteria in one or more packet capture policies; and
recording contents of the packet when the context information and network flow information match one of the one or more packet capture policies.
2. The method of claim 1 , further comprising:
upon determining that the packet comprises a request to establish a connection with a network destination, writing the context entry associated with the network flow in the context data structure.
3. The method of claim 1 , further comprising:
upon determining that the packet comprises a request to disconnect from the network destination, removing the context entry associated with the network flow from the context data structure, wherein the context data structure is a context table.
4. The method of claim 1 , wherein the context entry comprises a hashed key representing the network flow and an identity of a user associated with the packet.
5. The method of claim 4 , wherein tagging the packet with context information included in the context entry comprises tagging the packet with the identity of the user associated with the packet.
6. The method of claim 4 , wherein the hashed key is generated by applying a hash function to a data set including at least a packet protocol, packet source information, and packet destination information.
7. The method of claim 6 , wherein the packet source information comprises a source internet protocol (IP) address and a source port.
8. The method of claim 6 , wherein the packet destination information comprises a destination internet protocol (IP) address and a destination port.
9. The method of claim 1 , wherein the one or more packet capture policies comprises an identification of a type of traffic and a user for which packet contents should be recorded.
10. The method of claim 1 , wherein the one or more packet capture policies comprise at least an indication of an application associated with a packet for which packet contents should be recorded.
11. A non-transitory computer readable medium comprising instructions to be executed in a computer system to cause the computer system to carry out a method for context-based packet scanning in a computing environment, said method comprising:
receiving a packet from a virtual machine;
determining if a network flow associated with the packet exists in a context data structure; and
upon determining that a context entry associated with the network flow exists in the context data structure:
tagging the packet with context information included in the context entry;
comparing the context information and network flow information to context and network flow criteria in one or more packet capture policies; and
recording contents of the packet when the context information and network flow information match one of the one or more packet capture policies.
12. The non-transitory computer-readable medium of claim 11 , wherein the method further comprises:
upon determining that the packet comprises a request to establish a connection with a network destination, writing the context entry associated with the network flow in the context data structure.
13. The non-transitory computer-readable medium of claim 11 , wherein the method further comprises:
upon determining that the packet comprises a request to disconnect from the network destination, removing the context entry associated with the network flow from the context data structure, wherein the context data structure is a context table.
14. The non-transitory computer-readable medium of claim 11 , wherein the context entry comprises a hashed key representing the network flow and an identity of a user associated with the packet.
15. The non-transitory computer-readable medium of claim 11 , wherein the one or more packet capture policies comprises at least one of:
an identification of a type of traffic and a user for which packet contents should be recorded, or
an indication of an application associated with a packet for which packet contents should be recorded.
16. A computer system comprising:
a plurality of hosts, each having one or more virtual computing instances deployed thereon; and
a network hypervisor configured to carry out a method for performing context-based packet scanning in a computing environment by:
receiving a packet from a virtual machine;
determining if a network flow associated with the packet exists in a context data structure; and
upon determining that a context entry associated with the network flow exists in the context data structure:
tagging the packet with context information included in the context entry;
comparing the context information and network flow information to context and network flow criteria in one or more packet capture policies; and
recording contents of the packet when the context information and network flow information match one of the one or more packet capture policies.
17. The system of claim 16 , wherein the method further comprises:
upon determining that the packet comprises a request to establish a connection with a network destination, writing the context entry associated with the network flow in the context data structure.
18. The system of claim 16 , wherein the method further comprises:
upon determining that the packet comprises a request to disconnect from the network destination, removing the context entry associated with the network flow from the context data structure, wherein the context data structure is a context table.
19. The system of claim 16 , wherein the context entry comprises a hashed key representing the network flow and an identity of a user associated with the packet.
20. The system of claim 16 , wherein the one or more packet capture policies comprises at least one of:
an identification of a type of traffic and a user for which packet contents should be recorded, or
an indication of an application associated with a packet for which packet contents should be recorded.