Automatic target selection

1. A method comprising:

obtaining, by a processing device, a user-defined filter map, the user-defined filter map including a plurality of filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic on a network that includes a plurality of targets;

determining, by the processing device, a subset of the plurality of targets on the network, wherein the subset is to be monitored by the network system based on the user-defined filter map, wherein said determining includes identifying, by the processing device, the targets of the plurality of targets whose ingress/egress traffic can potentially result in a match with the filter rules; and

selecting, for monitoring by the network system, the targets identified in said identifying, and excluding from monitoring by the network system each of the plurality of targets that was not identified in said identifying.

2. The method of claim 1 , wherein the filter rules include information regarding one or more of a switch port, a MAC address, a VLAN identifier, an ethertype, an IP address, or a wildcard.

3. The method of claim 1 , wherein the plurality of targets include a virtual machine (VM).

4. The method of claim 1 , comprising:

obtaining an exclusion set that contains targets to be excluded from monitoring by the network system.

5. The method of claim 4 , wherein determining the subset of the plurality of targets includes excluding the targets contained in the exclusion set.

6. The method of claim 4 , comprising:

obtaining an inclusion set that contains targets to be monitored by the network system;

determining that the exclusion set and the inclusion set are not compatible with the user-defined filter map; and

generating a warning flag.

7. The method of claim 1 , comprising:

obtaining an inclusion set that contains targets to be monitored by the network system.

8. The method of claim 7 , wherein determining the subset of the plurality of targets includes including the targets contained in the inclusion set.

9. The method of claim 1 , wherein determining the subset of the plurality of targets includes identifying an intersection of plurality of the filter rules.

10. The method of claim 1 , wherein the user-defined filter map includes user-defined rules having associated actions, the associated actions including one or more of packet manipulation, packet forwarding, or packet dropping; and the method further comprising identifying that the identified targets match the network traffic and performing the actions associated with the user-defined rules.

11. The method of claim 1 , wherein the plurality of targets include a virtual Network Interface Card (vNIC).

12. An apparatus comprising:

a non-transitory medium storing a user-defined filter map, the user-defined filter map including a plurality of filter rules for matching against network traffic when the user-defined filter map is used by a network system to process the network traffic on a network that includes a plurality of targets;

a processing device configured to determine a subset of the plurality of targets on the network, wherein the subset is to be monitored by the network system, based on the user-defined filter map, wherein determining the subset includes identifying the plurality of targets whose ingress/egress traffic can potentially result in a match with the filter rules; and

the processing device further configured to select, for monitoring by the network system, the targets identified in said identifying, and exclude from monitoring by the network system each of the plurality of targets that was not identified in said identifying.

13. The apparatus of claim 12 , wherein the filter rules include information regarding one or more of a switch port, a MAC address, a VLAN identifier, an ethertype, an IP address, or a wildcard.

14. The apparatus of claim 12 , wherein the plurality of targets include a virtual machine (VM).

15. The apparatus of claim 12 , wherein the processing device is configured to obtain an exclusion set that contains targets to be excluded from monitoring by the network system.

16. The apparatus of claim 15 , wherein determining the subset of the plurality of targets includes excluding the targets contained in the exclusion set.

17. The apparatus of claim 15 , wherein the processing device is configured to execute instructions to perform operations comprising:

obtaining an inclusion set that contains targets to be monitored by the network system;

determining that the exclusion set and the inclusion set are not compatible with the user-defined filter map; and

generating a warning flag.

18. The apparatus of claim 12 , wherein the processing device is configured to obtain an inclusion set that contains targets to be monitored by the network system.

19. The apparatus of claim 18 , wherein determining the subset of the plurality of targets includes including the targets contained in the inclusion set.

20. The apparatus of claim 12 , wherein determining the subset of the plurality of targets includes identifying an intersection of the plurality of filter rules.

21. The apparatus of claim 12 , wherein the user-defined filter map includes user-defined rules having associated actions, the associated actions including one or more of packet manipulation, packet forwarding, and packet dropping; and the processing device further configured to identify that the identified targets match the network traffic and performing the actions associated with the user-defined rules.

22. The apparatus of claim 12 , wherein the plurality of targets include a virtual Network Interface Card (vNIC).

23. A system comprising:

a network interface;

one or more processors; and

a memory storing instructions, execution of which by the one or more processors causes the system to:

receive a user-defined filter map via the network interface, the user-defined filter map including a plurality of filter rules for matching against network traffic when the user-defined filter map is used by a software defined network (SDN) to process the network traffic on a network that includes a plurality of targets;

determine a subset of the plurality of targets on the network, wherein the subset is to be monitored by the SDN, based on the user-defined filter map, wherein determining the subset includes identifying the plurality of targets whose ingress/egress traffic can potentially result in a match with the filter rules; and

select, for monitoring by the SDN, the targets identified in said identifying, and exclude from monitoring by the network system each of the plurality of targets that was not identified in said identifying.

24. The system of claim 23 , wherein execution of the instructions by the one or more processors further causes the system to:

obtain an exclusion set that contains targets to be excluded from monitoring by the SDN; and

determine the subset of the plurality of target, wherein the subset excludes the targets contained in the exclusion set.

25. The system of claim 23 , wherein execution of the instructions by the one or more processors further causes the system to:

obtain an inclusion set that contains targets to be monitored by the SDN; and

determine the subset of the plurality of targets, wherein the subset includes the targets contained in the inclusion set.

26. The system of claim 23 , wherein execution of the instructions by the one or more processors further causes the system to:

obtain an exclusion set that contains targets to be excluded from monitoring by the SDN;

obtain an inclusion set that contains targets to be monitored by the SDN;

determine that the exclusion set and the inclusion set are not compatible with the user-defined filter map; and

generate a warning flag.

27. The system of claim 23 , wherein the user-defined filter map includes user-defined rules having associated actions, the associated actions including one or more of packet manipulation, packet forwarding, and packet dropping; and the processing device further configured to identify that the identified targets match the network traffic and performing the actions associated with the user-defined rules.