Egress flow mirroring in a network device
A packet is received at a network device. The packet is processed by the network device to determine at least one egress port via which to transmit the packet, and to perform egress classification of the packet based at least in part on information determined for the packet during processing of the packet. Egress classification includes determining whether the packet should not be transmitted by the network device. When it is not determined that the packet should not be transmitted by the network device, a copy of the packet is generated for mirroring of the packet to a destination other than the determined at least one egress port, and the packet is enqueued in an egress queue corresponding to the determined at least one egress port. The packet is subsequently transferred to the determined at least one egress port for transmission of the packet.
1. A method for processing packets in a network device, the method comprising:
receiving, at a packet processor of the network device, a packet from a network link;
processing, with the packet processor, the packet at least to (i) determine at least one egress port via which the packet is to be transmitted by the network device and (ii) perform egress processing of the packet, including at least a) modifying, based at least in part on information determined for the packet during processing of the packet by the packet processor, a header of the packet to generate a modified header and b) performing, based at least in part on the modified header, egress classification of the packet, including determining whether the packet is to be discarded by the network device;
in response to determining that the packet is not to be discarded by the network device:
triggering mirroring of the packet, to avoid mirroring of packets that are discarded based on egress classification by the network device, the mirroring including generating, with the packet processor, a copy of the packet to generate a mirrored packet for mirroring of the packet to a destination other than the determined at least one egress port, the mirrored packet subsequently being used for at least one of (i) network monitoring and (ii) network analytics, and
enqueueing the packet in an egress queue corresponding to the determined at least one egress port; and
transferring the packet from the egress queue to the determined at least one egress port for transmission of the packet, to another network device disposed in a network, via the determined at least one egress port.
2. The method of claim 1 , wherein
the method further comprises determining, with the packet processor based on a result of the egress classification of the packet, whether the packet is to be mirrored, and
generating, with the packet processor, the copy of the packet comprises generating the copy only when it is determined that the packet is to be mirrored.
3. The method of claim 1 , wherein
the method further comprises determining, with the packet processor, whether the packet is to be dropped due to congestion in the egress queue; and
generating the copy of the packet comprises generating the copy only when it is determined that the packet is not to be dropped due to congestion in the egress queue.
4. The method of claim 3 , wherein determining whether the packet is to be dropped comprises determining that the packet is to be dropped when a fill level of the egress queue exceeds a predetermined threshold.
5. The method of claim 1 , further comprising providing the copy of the packet to one or both of (i) a central processing unit (CPU) of the network device and (ii) a port of the network device, the port being coupled directly or indirectly to an analyzer, for transmission of the copy of the packet to the analyzer.
6. The method of claim 1 , further comprising prior to processing the packet, storing, with a receive processor, at least a portion of the packet in a packet memory, wherein:
processing the packet comprises processing the packet using a packet descriptor associated with the packet, and
generating the copy of the packet comprises generating a copy of the packet descriptor associated with the packet prior to retrieving the at least the portion of the packet from the packet memory.
7. The method of claim 6 , further comprising enqueueing the copy of the packet descriptor in an additional egress queue, the additional egress queue corresponding to a port, of the network device, directly or indirectly coupled to an analyzer.
8. The method of claim 7 , further comprising, when the packet is dequeued from the egress queue, retrieving, with a transmit processor of the network device, at least the portion of the packet from the packet memory for transmission of the packet via the determined at least one egress port.
9. The method of claim 8 , further comprising, when the copy of the packet descriptor is dequeued from the additional egress queue, retrieving the at least the portion of the packet from the packet memory for transmission of the packet to the analyzer.
10. The method of claim 9 , wherein retrieving the at least the portion of the packet from the packet memory for transmission of the packet to the analyzer comprises retrieving the at least the portion of the packet from the packet memory after the at least the portion of the packet is retrieved from the packet memory for transmission of the packet via the determined at least one port.
11. A network device, comprising:
a receive processor configured to receive a packet from a network;
a packet processor configured to
determine at least one egress port via which the packet is to be transmitted by the network device,
perform egress processing of the packet, including at least a) modifying, based at least in part on information determined for the packet during processing of the packet by the packet processor, a header of the packet to generate a modified header and b) performing, based at least in part on the modified header, egress classification of the packet, including determining whether the packet is to be discarded by the network device, and
in response to determining that the packet is not to be discarded by the network device:
trigger mirroring of the packet, to avoid mirroring of packets that are discarded based on egress classification by the network device, the mirroring including generating, with the packet processor, a copy of the packet to generate a mirrored packet for mirroring of the packet to a destination other than the determined at least one egress port, the mirrored packet subsequently being used for at least one of (i) network monitoring and (ii) network analytics, and
enqueue the packet in an egress queue corresponding to the determined at least one egress port, and
a transmit processor configured to transfer the packet from the egress queue to the determined at least one egress port for transmission of the packet via the determined at least one egress port.
12. The network device of claim 11 , wherein the packet processor is further configured to
determine, based on a result of the egress classification of the packet performed prior to enqueueing the packet in the egress queue, whether the packet is to be mirrored, and
generate the copy of the packet only when it is determined that the packet is to be mirrored.
13. The network device of claim 11 , wherein the packet processor is further configured to
determine, prior to generating the copy of the packet, whether the packet is to be dropped due to congestion in the egress queue; and
generate the copy of the packet only when it is determined that the packet is not to be dropped due to congestion in the egress queue.
14. The network device of claim 13 , wherein the packet processor is configured to determine that the packet is to be dropped when a fill level of the egress queue exceeds a predetermined threshold.
15. The network device of claim 11 , wherein the packet processor is further configured to perform one or both of (i) provide the copy of the packet to a central processing unit (CPU) of the network device and (ii) enqueue the packet in an additional egress queue, the additional egress queue corresponding to a port, of the network device, coupled directly or indirectly to an analyzer, for subsequent transmission of the copy of the packet to the analyzer.
16. The network device of claim 11 , wherein
the receive processor is configured to store at least a portion of the packet in a packet memory, and
the packet processor is configured to
process the packet using a packet descriptor associated with the packet, and
generate the copy of the packet at least by generating a copy of the packet descriptor associated with the packet prior to the at least the portion of the packet being retrieved from the packet memory.
17. The network device of claim 16 , wherein the packet processor is further configured to enqueue the copy of the packet descriptor in an additional egress queue corresponding to a port, of the network device, directly or indirectly coupled to an analyzer.
18. The network device of claim 17 , wherein the transmit processor is configured to, when the packet is dequeued from the egress queue, retrieve the at least the portion of the packet from the packet memory for transmission of the packet via the determined at least one egress port.
19. The network device of claim 18 , wherein the transmit processor is further configured to, when the copy of the packet descriptor is dequeued from the additional egress queue, retrieve the at least the portion of the packet from the packet memory for transmission of the packet to the analyzer.
20. The network device of claim 19 , wherein the transmit processor is configured to retrieve the packet from the packet memory for transmission of the packet to the analyzer after the packet is retrieved from the packet memory for transmission of the packet via the determined at least one egress port.