Distributed network troubleshooting using simultaneous multi-point packet capture

1. A method for performing a multi-point capture of packets in a network, the method comprising:

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a staggered start time by exchanging a number of packets with each node and computing a round-trip time for each node based on the exchanged packets for each node, wherein each node waits for the staggered start time before beginning a capture;

receiving a plurality of captured packet sets from the plurality of nodes; and

analyzing the plurality of captured packet sets.

2. The method of claim 1 further comprising receiving a configuration for the capture from an administrator of the network.

3. The method of claim 2 , wherein the configuration comprises a packet filter, wherein configuring each node comprises configuring the node to only capture packets that match the packet filter.

4. The method of claim 3 , wherein the packet filter identifies a source node and a destination node, wherein identifying the plurality of nodes comprises identifying a set of paths between the source node and the destination node.

5. The method of claim 2 , wherein the configuration comprises a packet constraint, wherein each node is configured to only capture a portion of each packet, wherein the captured portion is defined by the packet constraint.

6. The method of claim 2 further comprising monitoring for events occurring in the network, wherein identifying the configuration is performed upon detecting a particular event.

7. The method of claim 1 , wherein identifying the plurality of nodes is based on a network topology defined for the network.

8. The method of claim 7 , wherein the network is a logical network, wherein the network topology is defined as a mapping of nodes of the logical network to nodes of the physical network.

9. The method of claim 8 , wherein the identified plurality of nodes is from the logical network, wherein configuring each node of the plurality of nodes comprises:

based on the mapping of the network topology, identifying a corresponding node from the physical network; and

configuring the corresponding node from the physical network.

10. The method of claim 1 , wherein the plurality of nodes comprises a first node on a first physical machine and a second node on a different second physical machine.

11. The method of claim 1 , wherein the plurality of nodes comprises a first node and a second node on a same physical machine.

12. The method of claim 11 , wherein the first and second nodes operate at different layers of a network stack operating on the physical machine.

13. The method of claim 1 , wherein configuring each node comprises identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture.

14. A method for performing a multi-point capture of packets in a network, the method comprising:

receiving a configuration for the capture from an administrator of the network, wherein the configuration for the capture comprises a session length;

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a batch duration based on the session length and a set of properties of the particular node;

receiving a plurality of captured packet sets from the plurality of nodes by receiving a plurality of subsets of the set of captured packets, wherein each subset comprises packets captured during the batch duration; and

analyzing the plurality of captured packet sets.

15. The method of claim 14 , wherein the set of properties of the particular node comprises an amount of memory.

16. A method for performing a multi-point capture of packets in a network, the method comprising:

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture, wherein identifying the staggered start time for a particular node comprises identifying the staggered start time based on previous communications with the particular node;

receiving a plurality of captured packet sets from the plurality of nodes; and

analyzing the plurality of captured packet sets.

17. A non-transitory machine readable medium storing a program which when executed by at least one processing unit performs a multi-point capture of packets in a network, the program comprising sets of instructions for:

receiving a configuration for the multi-point capture from an administrator of the network, wherein the configuration for the capture comprises a session length;

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a batch duration based on the session length and a set of properties of the particular node;

receiving, from the plurality of nodes, a plurality of captured packet sets comprising subsets of the set of captured packets, wherein each subset comprises packets captured during the batch duration; and

analyzing the plurality of captured packet sets.

18. The non-transitory machine readable medium of claim 17 , wherein:

the configuration further comprises a packet filter that identifies a source node and a destination node;

the set of instructions for identifying the plurality of nodes comprises a set of instructions for identifying a set of paths between the source node and the destination node; and

the set of instructions for configuring each node comprises a set of instructions for configuring the node to only capture packets that match the packet filter.

19. The non-transitory machine readable medium of claim 17 , wherein:

the configuration further comprises a packet constraint;

each node is configured to only capture a portion of each packet; and

the captured portion is defined by the packet constraint.

20. The non-transitory machine readable medium of claim 17 , wherein the set of instructions for configuring each node comprises a set of instructions for identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture.

21. A non-transitory machine readable medium storing a program which when executed by at least one processing unit performs a multi-point capture of packets in a network, the program comprising sets of instructions for:

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture, the identified staggered start time for at least one particular node identified by exchanging a number of packets with each node and computing a round-trip time for each node based on the exchanged packets;

receiving a plurality of captured packet sets from the plurality of nodes; and

analyzing the plurality of captured packet sets.

22. A non-transitory machine readable medium storing a program which when executed by at least one processing unit performs a multi-point capture of packets in a network, the program comprising sets of instructions for:

identifying a plurality of nodes for the multi-point capture in the network;

configuring each node of the plurality of nodes to capture a set of packets by identifying a staggered start time for each node, wherein each node waits for the staggered start time before beginning a capture, the identified staggered start time for at least one particular node identified based on previous communications with the particular node;

receiving a plurality of captured packet sets from the plurality of nodes; and

analyzing the plurality of captured packet sets.