Policy-based sampling of network flows at a network visibility node

1. A method comprising:

receiving a plurality of packets at a network visibility node communicatively coupled to a network, the plurality of packets including control packets and data packets, the control packets including control signaling messages;

processing, by the network visibility node, the control packets to determine, based on the control signaling messages, a parameter of a network flow related to codec selection and associated with the plurality of packets; and

forwarding, by the network visibility node, the plurality of packets to an egress port of the network visibility node when the determined parameter of the network flow related to codec selection satisfies a sampling criterion, the egress port communicatively coupled to an external tool that is not an intended destination of the packets associated with the network flow.

2. The method of claim 1 , wherein processing the control packets to determine the parameter of the network flow includes:

analyzing a dialog exchange between subscribers included in the control signaling messages;

wherein the dialog exchange is to set the parameter for a session associated with the network flow.

3. The method of claim 1 , wherein the control signaling messages include Session Initiation Protocol (SIP) messages with Session Description Protocol (SDP) information indicative of the parameter of the network flow.

4. The method of claim 1 , wherein the control signaling messages are part of a dialog between subscriber devices communicating over the network to set the parameter of the network flow.

5. The method of claim 1 , wherein the control packets are associated with a control session, the control session controlling transfer of the data packets between the subscriber devices as part of a data session, the network flow including the control session and the data session.

6. The method of claim 5 , wherein the control session is based on SIP and the data session is based on a Real-time Transport Protocol (RTP).

7. The method of claim 5 , further comprising:

determining that the control session and data session are part of the same network flow by correlating information in the control packets to information in the data packets.

8. The method of claim 1 , wherein processing the control packets to determine, based on the control signaling messages, the parameter of the network flow includes:

parsing the control signaling messages from the control packets; and

extracting session dialog information from the parsed control signaling messages;

wherein the determined parameter of the network flow is based on the extracted session dialog information.

9. The method of claim 8 , wherein processing the control packets to determine, based on the control signaling messages, the parameter of the network flow further includes:

tracking different values for the parameter in an exchange of offer and answer messages between subscriber devices based on the extracted session dialog information; and

confirming the value for the parameter based on the tracking.

10. The method of claim 8 , wherein the session dialog information is based on SDP.

11. The method of claim 1 , further comprising:

processing, by the network visibility node, the control packets to determine, based on the control signaling messages, a second parameter of the network flow related to a quality of service (QoS) requirement for the network flow; and

forwarding, by the network visibility node, the plurality of packets to the egress port of the network visibility node when the second parameter of the network flow satisfies the sampling criterion.

12. The method of claim 1 , further comprising:

processing a particular packet of the plurality of packets to determine that the particular packet is associated with the network flow based on a hash value computed using attributes of the particular packet, wherein the network flow is one of a plurality of identified network flows.

13. The method of claim 12 , wherein processing the particular packet to determine that the particular packet is associated with the network flow includes:

determining that the particular packet is a data packet associated with a data session; and

correlating the data session to a control session associated with the network flow, wherein the control session controls the transfer of the data packets between subscriber devices as part of the data session.

14. The method of claim 1 , further comprising:

generating and applying a custom header to packets associated with the network flow before forwarding to the particular tool port, the custom header indicative of the association between the packets and the network flow.

15. The method of claim 1 , further comprising:

determining, by the network visibility node, that the network flow is associated with a whitelisted subscriber; and

forwarding, by the network visibility node, packets associated with the network flow to the egress port even if the determined parameter of the network flow does not satisfy the sampling criterion.

16. The method of claim 1 , wherein the network includes an IP Multimedia Subsystem (IMS) network.

17. An apparatus comprising:

a plurality of network ports through which to communicate on a network;

a plurality of tool ports through which to communicate with external tools; and

a processing unit communicatively coupled to the plurality of network ports and the plurality of tool ports, the processing unit configured to:

receive a plurality of packets via one or more of the plurality of network ports, the plurality of packets including control packets and data packets, the control packets including control signaling messages between subscriber devices communicating over the network;

process the control packets to determine, based on the control signaling messages, a parameter of a network flow related to codec selection and associated with the plurality of packets; and

forward the plurality of packets to one or more of the plurality of tool ports when the determined parameter of the network flow related to codec selection satisfies a sampling criterion, the one or more tool ports communicatively coupled to external tools that are not an intended destination of the plurality of packets.

18. The apparatus of claim 17 , wherein the control signaling messages include Session Initiation Protocol (SIP) messages with Session Description Protocol (SDP) information indicative of the parameter of the network flow.

19. The apparatus of claim 17 , wherein the control signaling messages are part of a dialog between subscriber devices communicating over the network to set the parameter of the network flow.

20. The apparatus of claim 17 , wherein the control packets are associated with a control session, the control session controlling transfer of the data packets between subscriber devices as part of a data session, the network flow including the control session and the data session.

21. The apparatus of claim 20 , wherein the control session is based on SIP and the data session is based on a Real-time Transport Protocol (RTP).

22. The apparatus of claim 17 , wherein processing unit is configured to process the control packets to determine the parameter of the network flow by:

parsing the control signaling messages from the control packets; and

extracting session dialog information from the parsed control signaling messages;

wherein the determined parameter of the network flow is based on the extracted session dialog information.

23. The apparatus of claim 22 , wherein processing unit is configured to process the control plane packets to determine the parameter of the network flow by further:

tracking values for the parameter in an exchange of offer and answer messages between subscriber devices based on the extracted session dialog information; and

identifying a confirmed value for the parameter based on the tracking.

24. The apparatus of claim 22 , wherein the session dialog information is based on SDP.

25. The apparatus of claim 17 , wherein the processing unit further is configured to:

process the control packets to determine, based on the control signaling messages, a second parameter of the network flow related to a quality of service (QoS) requirement for the network flow; and

forward the plurality of packets to said one or more of the plurality of tool ports when the second parameter of the network flow satisfies the sampling criterion.

26. The apparatus of claim 17 , wherein the network includes an IP Multimedia Subsystem (IMS) network.

27. An apparatus comprising:

a network port through which to communicate on a network;

a tool port through which to communicate with an external tool; and

a processing unit communicatively coupled to the network port and the tool port, the processing unit configured to:

track session dialog information including a parameter related to codec selection included in an exchange of control signaling messages between subscriber devices over the network;

select a network flow associated with the exchange of control signaling messages for sampling based on the tracked session dialog information;

including the parameter related to codec selection;

receive a packet via the network port;

determine whether the packet is associated with the network flow selected for sampling; and

forward the packet to the tool port if the packet is associated with the network flow, wherein the external tool is not an intended destination of the packet.

28. The apparatus of claim 27 , wherein the processing unit further is configured to:

track session dialog information including a second parameter related to a quality of service (QoS) requirement; and

select the network flow associated with the exchange of control signaling messages for sampling further based on the second parameter related to the QoS requirement.

29. The apparatus of claim 27 , wherein the control signaling messages are based on SIP and the session dialog information included in the control signaling messages is based on SDP.

30. The apparatus of claim 27 , wherein the network includes an IP Multimedia Subsystem (IMS) network.