Packet capture in software-defined networking (SDN) environments

1. A method for a network device to perform packet capture in a software-defined networking (SDN) environment that includes the network device, a first node, and a second node, the method comprising:

detecting an egress packet that includes an inner header addressed from the first node to the second node, wherein the first node communicates with the second node via the network device in the SDN environment;

identifying a security policy applicable to the egress packet by comparing one or more fields in the inner header with one or more match fields specified by the security policy;

after identifying the security policy, based on the one or more match fields specified by the security policy, capturing the egress packet, by the network device, in an unencrypted form;

performing encryption on the egress packet to generate an encrypted packet that includes the egress packet in an encrypted form; and

sending the encrypted packet to the second node.

2. The method of claim 1 , wherein capturing the egress packet comprises:

identifying, from multiple logical interfaces configured on the network device, a particular logical interface associated with the security policy; and

forwarding the egress packet via the particular logical interface to capture the egress packet.

3. The method of claim 2 , wherein capturing the egress packet comprises:

capturing the egress packet in response to determination that packet capture is enabled on the logical interface.

4. The method of claim 2 , further comprising:

prior to detecting the egress packet, configuring multiple security policies that include the security policy, and the multiple logical interfaces which are associated with the respective multiple security policies.

5. The method of claim 1 , wherein capturing the egress packet comprises:

storing, in a packet capture database, content of the egress packet in association with an identifier of the security policy.

6. The method of claim 5 , wherein capturing the egress packet comprises:

collecting statistics associated with the egress packet or the security policy; and

storing, in the packet capture database, the statistics in association with the identifier of the security policy.

7. The method of claim 1 , wherein the inner header includes a first inner header, and wherein the method further comprises:

detecting an ingress encrypted packet;

performing decryption on the ingress encrypted packet to generate a decrypted packet that includes a second inner header addressed from the second node to the first node;

based on the security policy, capturing the decrypted packet in an unencrypted form; and

sending the decrypted packet to the first node.

8. A network device configured to perform packet capture in a software-defined networking (SDN) environment that includes the network device, an intermediate device, a first node, and a second node, the network device comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, in response to execution by the processor, cause the processor to:

detect an egress packet that includes an inner header addressed from the first node to the second node, wherein the first node communicates with the second node via the network device in the SDN environment;

identify a security policy applicable to the egress packet by comparing one or more fields in the inner header with one or more match fields specified by the security policy;

after identifying the security policy, based on the one or more match fields specified by the security policy, capture the egress packet, by the network device, in an unencrypted form;

perform encryption on the egress packet to generate an encrypted packet that includes the egress packet in an encrypted form; and

send the encrypted packet to the second node.

9. The network device of claim 8 , wherein the instructions that cause the processor to capture the egress packet cause the processor to:

identify, from multiple logical interfaces configured on the network device, a particular logical interface associated with the security policy; and

forward the egress packet via the particular logical interface to capture the egress packet.

10. The network device of claim 9 , wherein the instructions that cause the processor to capture the egress packet cause the processor to:

capture the egress packet in response to determination that packet capture is enabled on the logical interface.

11. The network device of claim 9 , wherein the instructions further cause the processor to:

prior to detection of the egress packet, configure multiple security policies that include the security policy, and the multiple logical interfaces which are associated with the respective multiple security policies.

12. The network device of claim 8 , wherein the instructions that cause the processor to capture the egress packet cause the processor to:

store, in a packet capture database, content of the egress packet in association with an identifier of the security policy.

13. The network device of claim 12 , wherein the instructions that cause the processor to capture the egress packet cause the processor to:

collect statistics associated with the egress packet or the security policy; and

store, in the packet capture database, the statistics in association with the identifier of the security policy.

14. The network device of claim 8 , wherein the inner header comprises a first inner header, and wherein the instructions further cause the processor to:

detect an ingress encrypted packet;

perform decryption on the ingress encrypted packet to generate a decrypted packet that includes a second inner header addressed from the second node to the first node;

based on the security policy, capture the decrypted packet in an unencrypted form; and

send the decrypted packet to the first node.

15. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a network device, cause the processor to perform a method of packet capture in a software-defined networking (SDN) environment that includes the network device, a first node, and a second node, wherein the method comprises:

detecting an ingress encrypted packet;

performing decryption on the ingress encrypted packet to generate a decrypted packet that includes an inner header addressed from the first node to the second node, wherein the first node communicates with the second node via the network device in the SDN environment;

identifying a security policy applicable to the decrypted packet;

after identifying the security policy, based on one or more match fields specified by the security policy, capturing the decrypted packet, by the network device, in an unencrypted form; and

sending the decrypted packet to the second node.

16. The non-transitory computer-readable storage medium of claim 15 , wherein capturing the decrypted packet comprises:

identifying, from multiple logical interfaces configured on the network device, a particular logical interface associated with the security policy; and

forwarding the decrypted packet via the particular logical interface to capture the decrypted packet.

17. The non-transitory computer-readable storage medium of claim 16 , wherein capturing the decrypted packet comprises:

capturing the decrypted packet in response to determination that packet capture is enabled on the particular logical interface.

18. The non-transitory computer-readable storage medium of claim 16 , wherein the method further comprises:

prior to detecting the ingress encrypted packet, configuring multiple security policies that include the security policy, and the multiple logical interfaces which are associated with the respective multiple security policies.

19. The non-transitory computer-readable storage medium of claim 15 , wherein capturing the decrypted packet comprises:

storing, in a packet capture database, content of the decrypted packet in association with an identifier of the security policy.

20. The non-transitory computer-readable storage medium of claim 19 , wherein capturing the decrypted packet comprises:

collecting statistics associated with the decrypted packet or the security policy; and

storing, in the packet capture database, the statistics in association with the identifier of the security policy.

21. The non-transitory computer-readable storage medium of claim 15 , wherein the inner header includes a first inner header, and wherein the method further comprises:

detecting an egress packet that includes a second inner header that is addressed from the second node to the first node;

based on the security policy, capturing the egress packet in an unencrypted form;

performing encryption on the egress packet to generate an egress encrypted packet that includes the egress packet in an encrypted form; and

sending the egress encrypted packet to the first node.