Multi-stage selective mirroring

1. Communication apparatus, comprising:

multiple interfaces configured to be connected to a packet data network so as to serve as ingress and egress interfaces in receiving and forwarding of data packets from and to the network by the apparatus;

at least one memory coupled to the multiple interfaces and configured as a buffer to contain packets received through one or more of the multiple interfaces while awaiting transmission to the network via others of the multiple interfaces; and

processing circuitry, which is configured to identify data flows to which the data packets that are received through the one or more of the multiple interfaces belong, to assess respective bandwidth characteristics of the data flows, and to select one or more of the data flows as candidate flows for mirroring responsively to the respective bandwidth characteristics, and which is further configured to select, responsively to one or more predefined mirroring criteria, one or more of the data packets in the candidate flows for analysis by a network manager, and to send the selected data packets to the network manager over the network via one of the multiple interfaces,

wherein the one or more predefined mirroring criteria comprise a plurality of mirroring criteria, and wherein the processing circuitry is configured to label the data packets in the candidate flows so as to indicate which of the mirroring criteria are applicable to each of the labeled data packets, and to select a given data packet for mirroring in response to a given mirroring criterion only when the given data packet is labeled to indicate that the given mirroring criterion is applicable to the given data packet.

2. The apparatus according to claim 1 , wherein the processing circuitry is configured to mirror the data packets only from the candidate flows, while the data packets in the data flows that were not selected as candidate flows are not mirrored.

3. The apparatus according to claim 1 , wherein none of the data packets in the candidate flows are sent to the network manager when the mirroring criteria are not satisfied.

4. The apparatus according to claim 1 , wherein the processing circuitry is configured to select the data flows that consume respective bandwidths in excess of a specified threshold as the candidate flows, while the data flows that consume respective bandwidths less than the specified threshold are not selected.

5. The apparatus according to claim 1 , wherein the processing circuitry is configured to label the data packets in the candidate flows as candidates for mirroring upon receipt of the data packets through the one or more of the multiple interfaces, before queuing the data packets in the buffer, and to select the data packets for analysis from among the labeled data packets that are held in the buffer.

6. The apparatus according to claim 1 , wherein the processing circuitry is configured to select one or more further candidate flows responsively to values of one or more fields in a header of the data packets.

7. The apparatus according to claim 1 , wherein the processing circuitry is configured to apply the one or more predefined mirroring criteria by monitoring a respective buffering parameter of the data packets in the candidate flows that have been queued in the buffer while awaiting transmission via the others of the multiple interfaces, and to select the one or more of the data packets for mirroring based on the respective buffering parameter.

8. The apparatus according to claim 7 , wherein the buffering parameter specifies at least one transmission characteristic of the candidate flows, selected from a group of transmission characteristics consisting of a degradation in quality of service, a level of buffer usage, a queue length, a packet transmission latency, and a congestion state.

9. Communication apparatus, comprising:

multiple interfaces configured to be connected to a packet data network so as to serve as ingress and egress interfaces in receiving and forwarding of data packets from and to the network by the apparatus;

at least one memory coupled to the multiple interfaces and configured as a buffer to contain packets received through one or more of the multiple interfaces while awaiting transmission to the network via others of the multiple interfaces; and

processing circuitry, which is configured to identify data flows to which the data packets that are received through the one or more of the multiple interfaces belong, to select and label one or more of the data flows as candidate flows for mirroring upon receipt of the data packets through the ingress interfaces and before queuing the data packets in the buffer, and which is further configured to select for analysis by a network manager, responsively to one or more predefined mirroring criteria, one or more of the data packets in the candidate flows from among the data packets that are held in the buffer, and to send the selected data packets to the network manager over the network via one of the multiple interfaces,

wherein the one or more predefined mirroring criteria comprise a plurality of mirroring criteria, and wherein the processing circuitry is configured to label the data packets in the candidate flows so as to indicate which of the mirroring criteria are applicable to each of the labeled data packets, and to select a given data packet for mirroring in response to a given mirroring criterion only when the given data packet is labeled to indicate that the given mirroring criterion is applicable to the given data packet.

10. The apparatus according to claim 9 , wherein none of the data packets in a given candidate flow are sent to the network manager when the mirroring criterion applicable to the given candidate flow is not satisfied.

11. The apparatus according to claim 9 , wherein the processing circuitry is configured to mirror the data packets only from the candidate flows, while the data packets in the data flows that were not selected as candidate flows are not mirrored.

12. A method for communication, comprising:

receiving and forwarding of data packets from and to a packet data network via ingress and egress interfaces of a network element;

identifying data flows to which the data packets that are received through the ingress interfaces belong;

assessing respective bandwidth characteristics of the data flows;

selecting one or more of the data flows as candidate flows for mirroring responsively to the respective bandwidth characteristics;

selecting, responsively to one or more predefined mirroring criteria, one or more of the data packets in the candidate flows for analysis by a network manager; and

sending the selected data packets to the network manager over the network via one of the egress interfaces,

wherein the one or more predefined mirroring criteria comprise a plurality of mirroring criteria, and wherein selecting the one or more of the data flows comprises labeling the data packets in the candidate flows so as to indicate which of the mirroring criteria are applicable to each of the labeled data packets, and wherein selecting the one or more of the data packets comprises choosing a given data packet for mirroring in response to a given mirroring criterion only when the given data packet is labeled to indicate that the given mirroring criterion is applicable to the given data packet.

13. The method according to claim 12 , wherein selecting the one or more of the data packets comprises mirroring the data packets only from the candidate flows, while the data packets in the data flows that were not selected as candidate flows are not mirrored.

14. The method according to claim 12 , wherein none of the data packets in the candidate flows are sent to the network manager when the mirroring criteria are not satisfied.

15. The method according to claim 12 , wherein selecting the one or more of the data flows comprises selecting the data flows that consume respective bandwidths in excess of a specified threshold as the candidate flows, while the data flows that consume respective bandwidths less than the specified threshold are not selected.

16. The method according to claim 12 , wherein selecting the one or more of the data flows comprises labeling the data packets in the candidate flows as candidates for mirroring upon receipt of the data packets through the ingress interfaces, before queuing the data packets in the buffer, and wherein selecting the one or more of the data packets comprises choosing the data packets for analysis from among the labeled data packets that are held in the buffer.

17. The method according to claim 12 , wherein selecting the one or more of the data flows comprises selecting one or more further candidate flows responsively to values of one or more fields in a header of the data packets.

18. The method according to claim 12 , wherein selecting the one or more of the data packets comprises applying the one or more predefined mirroring criteria by monitoring a respective buffering parameter of the data packets in the candidate flows that have been queued in the buffer while awaiting transmission via the egress interfaces, choosing the one or more of the data packets for mirroring based on the respective buffering parameter.

19. The method according to claim 18 , wherein the buffering parameter specifies at least one transmission characteristic of the candidate flows, selected from a group of transmission characteristics consisting of a degradation in quality of service, a level of buffer usage, a queue length, a packet transmission latency, and a congestion state.