Length control for packet header sampling

1. A method of monitoring network traffic, the method comprising a network node:

sampling data packets of network traffic;

for each sampled data packet, comparing a packet header of the sampled data packet to a set of one or more packet header patterns, wherein each packet header pattern is defined by a sequence of one or more protocol types;

determining, depending on the comparison, a length of a packet header portion to be extracted from the sampled data packet;

extracting the packet header portion of the determined length from the sampled data packet; and

generating a datagram comprising the extracted packet header portions of the sampled data packets, wherein the method further comprising:

based on the comparison, determining a packet header pattern from the set which best matches the packet header of the sampled data packet; and

determining the length in such a way that the packet header portion to be extracted includes protocol headers corresponding to the sequence of protocol types defining the best matching packet header pattern.

2. The method of claim 1 , further comprising the network node: in the sampled data packet, identifying:

a first byte of a first protocol header of the sequence of protocol types defining the best matching packet header pattern; and

a last byte of a last protocol header of the sequence of protocol types defining the best matching packet header pattern; and

determining the packet header portion to be extracted to extend from the first byte of the first protocol header of the sequence of protocol types defining the best matching packet header pattern to the last byte of the last protocol header of the sequence of protocol types defining the best matching packet header pattern.

3. The method of claim 1 , further comprising the network node, in response to identifying no packet header pattern from the set which matches the packet header of the sampled data packet, determining the length to correspond to a configured maximum length.

4. The method of claim 1 , wherein the length of the packet header portion extracted from the sampled data packet differs between at least some of the sampled data packets.

5. The method of claim 1 , further comprising the network node transmitting the datagram to a further network node for analysis.

6. The method of claim 1 , further comprising the network node receiving configuration information indicating the set of one or more packet header patterns from a management node.

7. The method of claim 1 , wherein the datagram corresponds to an sFlow datagram.

8. A method of controlling monitoring of network traffic by a management node, the method comprising:

determining a set of one or more packet header patterns; and

sending configuration information indicating the set of one or more packet header patterns to at least one network node configured to sample data packets of network traffic, wherein each packet header pattern is defined by a sequence of one or more protocol types;

wherein the set of one or more packet header patterns enables the at least one network node to:

compare, for each sampled data packet, a packet header of the sampled data packet to the set of one or more packet header patterns,

depending on the comparison, determine a length of a packet header portion to be extracted from the sampled data packet,

extract the packet header portion of the determined length from the sampled data packet; and

generate a datagram comprising the extracted packet header portions of the sampled data packets, wherein the network node is further caused to

based on the comparison, determine a packet header pattern from the set which best matches the packet header of the sampled data packet; and

determine the length in such a way that the packet header portion to be extracted includes protocol headers corresponding to the sequence of protocol types defining the best matching packet header pattern.

9. The method of claim 8 , wherein the length of the packet header portion extracted from the sampled data packet differs between at least some of the sampled data packets.

10. The method of claim 8 , wherein the datagram corresponds to an sFlow datagram.

11. A network node, comprising:

processing circuitry;

memory containing instructions executable by the processing circuitry whereby the network node is operative to:

sample data packets of network traffic;

for each sampled data packet, compare a packet header of the sampled data packet to a set of one or more packet header patterns, wherein each packet header pattern is defined by a sequence of one or more protocol types;

depending on the comparison, determine a length of a packet header portion to be extracted from the sampled data packet;

extract the packet header portion of the determined length from the sampled data packet; and

generate a datagram comprising the extracted packet header portions of the

sampled data packets, wherein the instructions are such that the network node is operative to:

based on the comparison, determine a packet header pattern from the set which best matches the packet header of the sampled data packet; and

determine the length in such a way that the packet header portion to be extracted includes protocol headers corresponding to the sequence of protocol types defining the best matching packet header pattern.

12. The network node of claim 11 , wherein the instructions are such that the network node is operative to:

in the sampled data packet, identify:

a first byte of a first protocol header of the sequence of protocol types

defining the best matching packet header pattern; and a last byte of a last protocol

header of the sequence of protocol types defining

the best matching packet header pattern; and

determine the packet header portion to be extracted to extend from the first byte of the first protocol header of the sequence of protocol types defining the best matching packet header pattern to the last byte of the last protocol header of the sequence of protocol types defining the best matching packet header pattern.

13. The network node of claim 12 , wherein the instructions are such that the network node is operative to in response to identifying no packet header pattern from the set which matches the packet header of the sampled data packet, determine the length to correspond to a configured maximum length.

14. The network node of claim 11 , wherein the length of the packet header portion extracted from the sampled data packet differs between at least some of the sampled data packets.

15. The network node of claim 11 , wherein the instructions are such that the network node is operative to transmit the datagram to a further network node for analysis.

16. The network node of claim 11 , wherein the instructions are such that the network node is operative to receive configuration information indicating the set of one or more packet header patterns from a management node.

17. The network node of claim 11 , wherein the datagram corresponds to an sFlow datagram.

18. A management node, the management node being configured to:

processing circuitry;

memory containing instructions executable by the processing circuitry whereby the management node is operative to:

determine a set of one or more packet header patterns, wherein each packet header pattern is defined by a sequence of one or more protocol types; and

send configuration information indicating the set of one or more packet header patterns to at least one network node configured to sample data packets of network traffic;

wherein the set of one or more packet header patterns enables the at least one network node to:

compare, for each sampled data packet, a packet header of the sampled data packet to the set of one or more packet header patterns,

depending on the comparison, determine a length of a packet header portion to be extracted from the sampled data packet,

extract the packet header portion of the determined length from the sampled data packet, and

generate a datagram comprising the extracted packet header portions of the sampled data packets,

wherein the network node is enabled further to

based on the comparison, determine a packet header pattern from the set which best matches the packet header of the sampled data packet; and

determine the length in such a way that the packet header portion to be extracted includes protocol headers corresponding to the sequence of protocol types defining the best matching packet header pattern.

19. The management node of claim 18 , wherein the length of the packet header portion extracted from the sampled data packet differs between at least some of the sampled data packets.

20. The management node of claim 18 , wherein the datagram corresponds to an sFlow datagram.

21. A system, comprising:

a plurality of network nodes, each network node configured to:

sample data packets of network traffic;

for each sampled data packet, compare a packet header of the sampled data packet to a set of one or more packet header patterns, wherein each packet header pattern is defined by a sequence of one or more protocol types;

depending on the comparison, determine a length of a packet header portion to be extracted from the sampled data packet;

extract the packet header portion of the determined length from the sampled data packet; and

generate a datagram comprising the extracted packet header portions of the sampled data packets; and

a further network node configured to:

receive the datagrams from the plurality of network nodes; and

wherein the network node is operative to:

based on the comparison, determine a packet header pattern from the set which best matches the packet header of the sampled data packet; and

determine the length in such a way that the packet header portion to be extracted includes protocol headers corresponding to the sequence of protocol types defining the best matching packet header pattern.

22. The system of claim 21 , further comprising a management node configured to send configuration information indicating the set of one or more packet header patterns to the plurality of network nodes.

23. The system of claim 22 , wherein the management node is further configured to determine the set of one or more packet header patterns.

24. A non-transitory computer readable recording medium storing a computer program product for a network node for monitoring network traffic, the computer program product comprising software instructions which, when run on processing circuitry of the network node, causes the network node to:

sample data packets of network traffic; for each sampled data packet, compare a packet header of the sampled data packet to a set of one or more packet header patterns;

determine, depending on the comparison, a length of a packet header portion to be extracted from the sampled data packet;

extract the packet header portion of the determined length from the sampled data packet; and

generate a datagram comprising the extracted packet header portions of the sampled data packets, wherein the instructions further causes the network node to:

based on the comparison, determine a packet header pattern from the set which best matches the packet header of the sampled data packet; and

determine the length in such a way that the packet header portion to be extracted includes protocol headers corresponding to the sequence of protocol types defining the best matching packet header pattern.

25. A non-transitory computer readable recording medium storing a computer program product for a management node, the computer program product comprising software instructions which, when run on processing circuitry of the management node, causes the management node to:

determine a set of one or more packet header patterns; and send configuration information indicating the set of one or more packet header patterns to at least one network node configured to sample data packets of network traffic;

wherein the set of one or more packet header patterns enables the at least one network node to:

compare, for each sampled data packet, a packet header of the sampled data packet to the set of one or more packet header patterns,

depending on the comparison, determine a length of a packet header portion to be extracted from the sampled data packet,

extract the packet header portion of the determined length from the sampled data packet; and

generate a datagram comprising the extracted packet header portions of the sampled data packets, wherein the instructions further causes the network node to

based on the comparison, determine a packet header pattern from the set which best matches the packet header of the sampled data packet; and

determine the length in such a way that the packet header portion to be extracted includes protocol headers corresponding to the sequence of protocol types defining the best matching packet header pattern.