Network packet de-duplication

1. A method for monitoring network traffic over a network, wherein one or more processors in one or more network monitoring computers (NMCs) execute instructions to perform actions, comprising:

employ a monitoring engine to perform further actions, including:

monitoring one or more flows of network packets based on one or more network packets;

determining an observation port that is providing the network packets based on one or more characteristics of the network packets and one or more characteristics of the observation port;

determining one or more primary network packets that are provided by an authoritative observation port based on the observation port that provided the network packets, wherein the one or more primary network packets are provided to an analysis engine;

discarding a remainder of the network packets that are associated with non-authoritative observation ports; and

employing the analysis engine to analyze the one or more primary network packets.

2. The method of claim 1 , wherein the monitoring engine performs further actions comprising, assigning the authoritative observation port for the one or more network flows based on one or more characteristics of the network packets associated with the one or more network flows, wherein the authoritative observation port is selected from one or more observation ports.

3. The method of claim 1 , wherein the monitoring engine performs further actions comprising:

identifying one or more network devices in the network based on one or more characteristics of one or more flows of network packets; and

identifying the one or more of the network devices as being observation ports based on one or more metrics that indicate that the one or more identified network devices perform one or more routing actions.

4. The method of claim 1 , wherein the monitoring engine performs further actions comprising:

monitoring Open System Interconnection (OSI) Layer 2 characteristics of the one or more network packets;

inserting tag information into the OSI Layer 2 header of the one or more network packets based on the determined observation port; and

determining the observation port based on the tag information.

5. The method of claim 1 , wherein the monitoring engine performs further actions comprising, assigning the authoritative observation port to a different observation port based on one or more observed changes in the one or more characteristics of the one or more flows of network packets.

6. The method of claim 1 , wherein the monitoring engine performs further actions comprising:

comparing one or more duplicate network packets associated with a same flow based on one or more metrics, hop counts, time to live (TTL) values, or latency values; and

determining one or more metrics on a per flow basis based on the comparison of the one or more duplicate network packets.

7. The method of claim 1 , wherein determining the observation port, further comprises, associating the observation port with a flow based on a path used by the one or more network packets on the network.

8. The method of claim 1 , wherein the monitoring engine performs further actions, comprising:

actively interrogating one or more network devices in the network to obtain information associated with one or more characteristics of the one or more network devices; and

determining that one or more of the one or more network devices are interfaces associated with a router based on the one or more characteristics.

9. A system for monitoring network traffic over a network between one or more computers comprising:

one or more network monitoring computers (NMCs), comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

employ a monitoring engine to perform further actions, including:

monitoring one or more flows of network packets based on one or more network packets;

determining an observation port that is providing the network packets based on one or more characteristics of the network packets and one or more characteristics of the observation port;

determining one or more primary network packets that are provided by an authoritative observation port based on the observation port that provided the network packets, wherein the one or more primary network packets are provided to an analysis engine;

discarding a remainder of the network packets that are associated with non-authoritative observation ports; and

employing the analysis engine to analyze the one or more primary network packets;

the one or more computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing the one or more flows of network packets.

10. The system of claim 9 , wherein the monitoring engine performs further actions comprising, assigning the authoritative observation port for the one or more network flows based on one or more characteristics of the network packets associated with the one or more network flows, wherein the authoritative observation port is selected from one or more observation ports.

11. The system of claim 9 , wherein the monitoring engine performs further actions comprising:

identifying one or more network devices in the network based on one or more characteristics of one or more flows of network packets; and

identifying the one or more of the network devices as being observation ports based on one or more metrics that indicate that the one or more identified network devices perform one or more routing actions.

12. The system of claim 9 , wherein the monitoring engine performs further actions comprising:

monitoring Open System Interconnection (OSI) Layer 2 characteristics of the one or more network packets;

inserting tag information into the OSI Layer 2 header of the one or more network packets based on the determined observation port; and

determining the observation port based on the tag information.

13. The system of claim 9 , wherein the monitoring engine performs further actions comprising, assigning the authoritative observation port to a different observation port based on one or more observed changes in the one or more characteristics of the one or more flows of network packets.

14. The system of claim 9 , wherein the monitoring engine performs further actions comprising:

comparing one or more duplicate network packets associated with a same flow based on one or more metrics, hop counts, time to live (TTL) values, or latency values; and

determining one or more metrics on a per flow basis based on the comparison of the one or more duplicate network packets.

15. The system of claim 9 , wherein determining the observation port, further comprises, associating the observation port with a flow based on a path used by the one or more network packets on the network.

16. The system of claim 9 , wherein the monitoring engine performs further actions, comprising:

actively interrogating one or more network devices in the network to obtain information associated with one or more characteristics of the one or more network devices; and

determining that one or more of the one or more network devices are interfaces associated with a router based on the one or more characteristics.

17. A processor readable non-transitory storage media that includes instructions for monitoring network traffic over a network between one or more computers, wherein execution of the instructions by one or more processors on one or more network monitoring computers (NMCs) performs actions, comprising:

employ a monitoring engine to perform further actions, including:

monitoring one or more flows of network packets based on one or more network packets;

determining an observation port that is providing the network packets based on one or more characteristics of the network packets and one or more characteristics of the observation port;

determining one or more primary network packets that are provided by an authoritative observation port based on the observation port that provided the network packets, wherein the one or more primary network packets are provided to an analysis engine;

discarding a remainder of the network packets that are associated with non-authoritative observation ports; and

employing the analysis engine to analyze the one or more primary network packets.

18. The processor readable non-transitory storage media of claim 17 , wherein the monitoring engine performs further actions comprising, assigning the authoritative observation port for the one or more network flows based on one or more characteristics of the network packets associated with the one or more network flows, wherein the authoritative observation port is selected from one or more observation ports.

19. The processor readable non-transitory storage media of claim 17 , wherein the monitoring engine performs further actions comprising:

identifying one or more network devices in the network based on one or more characteristics of one or more flows of network packets; and

identifying the one or more of the network devices as being observation ports based on one or more metrics that indicate that the one or more identified network devices perform one or more routing actions.

20. The processor readable non-transitory storage media of claim 17 , wherein the monitoring engine performs further actions comprising:

monitoring Open System Interconnection (OSI) Layer 2 characteristics of the one or more network packets;

inserting tag information into the OSI Layer 2 header of the one or more network packets based on the determined observation port; and

determining the observation port based on the tag information.

21. The processor readable non-transitory storage media of claim 17 , wherein the monitoring engine performs further actions comprising, assigning the authoritative observation port to a different observation port based on one or more observed changes in the one or more characteristics of the one or more flows of network packets.

22. The processor readable non-transitory storage media of claim 17 , wherein the monitoring engine performs further actions comprising:

comparing one or more duplicate network packets associated with a same flow based on one or more metrics, hop counts, time to live (TTL) values, or latency values; and

determining one or more metrics on a per flow basis based on the comparison of the one or more duplicate network packets.

23. The processor readable non-transitory storage media of claim 17 , wherein determining the observation port, further comprises, associating the observation port with a flow based on a path used by the one or more network packets on the network.

24. A network monitoring computer (NMC) for monitoring network traffic over a network, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

employ a monitoring engine to perform further actions, including:

monitoring one or more flows of network packets based on one or more network packets;

determining an observation port that is providing the network packets based on one or more characteristics of the network packets and one or more characteristics of the observation port;

determining one or more primary network packets that are provided by an authoritative observation port based on the observation port that provided the network packets, wherein the one or more primary network packets are provided to an analysis engine;

discarding a remainder of the network packets that are associated with non-authoritative observation ports; and

employing the analysis engine to analyze the one or more primary network packets.

25. The NMC of claim 24 , wherein the monitoring engine performs further actions comprising, assigning the authoritative observation port for the one or more network flows based on one or more characteristics of the network packets associated with the one or more network flows, wherein the authoritative observation port is selected from one or more observation ports.

26. The NMC of claim 24 , wherein the monitoring engine performs further actions comprising:

identifying one or more network devices in the network based on one or more characteristics of one or more flows of network packets; and

identifying the one or more of the network devices as being observation ports based on one or more metrics that indicate that the one or more identified network devices perform one or more routing actions.

27. The NMC of claim 24 , wherein the monitoring engine performs further actions comprising:

monitoring Open System Interconnection (OSI) Layer 2 characteristics of the one or more network packets;

inserting tag information into the OSI Layer 2 header of the one or more network packets based on the determined observation port; and determining the observation port based on the tag information.

28. The NMC of claim 24 , wherein the monitoring engine performs further actions comprising, assigning the authoritative observation port to a different observation port based on one or more observed changes in the one or more characteristics of the one or more flows of network packets.

29. The NMC of claim 24 , wherein the monitoring engine performs further actions comprising:

comparing one or more duplicate network packets associated with a same flow based on one or more metrics, hop counts, time to live (TTL) values, or latency values; and

determining one or more metrics on a per flow basis based on the comparison of the one or more duplicate network packets.

30. The NMC of claim 24 , wherein determining the observation port, further comprises, associating the observation port with a flow based on a path used by the one or more network packets on the network.