Transparent application-layer/os deeper packet inspector

1. A computer-implemented method of deep packet inspection (DPI) in a network, the method comprising:

using a number of processors to perform the steps of:

collecting all data packets on the network, the data packets comprising a number of traffic flows from a number of devices via a number of traffic taps, wherein collecting data packets comprises copying, via the number of traffic taps, collected data packets to generate mirrored data representing the number of traffic flows;

classifying mirrored data representing each traffic flow according to data about network protocol layers of the packets comprising the traffic flow, wherein classifying utilizes data about an application network protocol layer of the mirrored data to generate classification information for each traffic flow;

extracting application layer metadata from the mirrored data;

aggregating classification information for each traffic flow and extracted metadata for each traffic flow to generate a big-data cluster;

ingesting traffic flow classification data and the extracted metadata of the big-data cluster;

normalizing the big-data cluster to represent classification data and extracted metadata in a Common Information Model (CIM) form; and

correlating the normalized classification data and extracted metadata of the big-data cluster to other data sets using the CIM form of the normalized classification data and extracted metadata of the big-data cluster.

2. The method of claim 1 , further comprising:

extracting packet header data from the mirrored data;

identifying sessions within the traffic flows represented by the mirrored data according to the packet header data extracted from the mirrored data; and

balancing a processing load among a number of CPUs by distributing packets of identified sessions to respective CPUs within the number of CPUs according to CPU affinity.

3. The method of claim 2 , wherein the packet header data comprises network protocol data link layer, network layer, and transport layer.

4. The method of claim 2 , wherein respective DPI applications are pinned to the CPUs.

5. The method of claim 1 , wherein the traffic flows are classified according to network protocol layers including: network, transport, session, presentation, and application network protocol layers.

6. The method of claim 1 , wherein the devices comprise physical devices on a network.

7. The method of claim 1 , wherein the devices comprise virtual devices in a cloud.

8. The method of claim 7 , wherein the collected data is received by a physical server through a number of physical interfaces.

9. The method of claim 7 , wherein the collected data is received by a virtual machine through a virtual tunnel.

10. A system for deep packet inspection (DPI) in a network, the system comprising:

a storage device configured to store program instructions; and

one or more processors operably connected to the storage device and configured to execute the program instructions to cause the system to:

collect all data packets on the network, the data packets comprising a number of traffic flows from a number of devices via a number of traffic taps, wherein collecting data packets comprises copying, via the number of traffic taps, collected data packets to generate mirrored data representing the number of traffic flows;

classify mirrored data representing each traffic flow according to data about network protocol layers of the packets comprising the traffic flow, wherein classifying utilizes data about an application network protocol layer of the mirrored data to generate classification information for each traffic flow;

extract application layer metadata from the mirrored data;

aggregating classification information for each traffic flow and extracted metadata for each traffic flow to generate a big-data cluster;

ingest traffic flow classification data and the extracted metadata of the big-data cluster;

normalize the big-data cluster to represent classification data and extracted metadata in a Common Information Model (CIM) form; and

correlate the normalized classification data and extracted metadata of the big-data cluster to other data sets using the CIM form of the normalized classification data and extracted metadata of the big-data cluster.

11. The system of claim 10 , wherein the processors further execute instructions to:

extract packet header data from the mirrored data;

identify sessions within the traffic flows represented by the mirrored data according to the packet header data extracted from the mirrored data; and

balancing a processing load among a number of CPUs by distribute packets of identified sessions to respective CPUs within the number of CPUs according to CPU affinity.

12. The system of claim 11 , wherein the packet header data comprises network protocol data link layer, network layer, and transport layer.

13. The system of claim 11 , wherein respective DPI applications are pinned to the CPUs.

14. The system of claim 10 , wherein the traffic flows are classified according to network protocol layers including: network, transport, session, presentation, and application network protocol layers.

15. The system of claim 10 , wherein the devices comprise physical devices on a network.

16. The system of claim 10 , wherein the devices comprise virtual devices in a cloud.

17. The system of claim 16 , wherein the collected data is received by a physical server through a number of physical interfaces.

18. The system of claim 16 , wherein the collected data is received by a virtual machine through a virtual tunnel.

19. A computer program product for deep packet inspection (DPI) in a network, the computer program product comprising:

a computer-readable storage medium having program instructions embodied thereon to perform the steps of:

collecting all data packets on the network, the data packets comprising a number of traffic flows from a number of devices via a number of traffic taps, wherein collecting data packets comprises copying, via the number of traffic taps, collected data packets to generate mirrored data representing the number of traffic flows;

classifying mirrored data representing each traffic flow according to data about network protocol layers of the packets comprising the traffic flow, wherein classifying utilizes data about an application network protocol layer of the mirrored data to generate classification information for each traffic flow;

extracting application layer metadata from the mirrored data;

aggregating classification information for each traffic flow and extracted metadata for each traffic flow to generate a big-data cluster;

ingesting traffic flow classification data and the extracted metadata of the big-data cluster;

normalizing the big-data cluster to represent classification data and extracted metadata in a Common Information Model (CIM) form; and

correlating the normalized classification data and extracted metadata to other data sets using the CIM form of the normalized classification data and extracted metadata of the big-data cluster.

20. The computer program product of claim 19 , further comprising instructions for:

extracting packet header data from the mirrored data;

identifying sessions within the traffic flows represented by the mirrored data according to the packet header data extracted from the mirrored data; and

balancing a processing load among a number of CPUs by distributing packets of identified sessions to respective CPUs within the number of CPUs according to CPU affinity.

21. The computer program product of claim 20 , wherein the packet header data comprises network protocol data link layer, network layer, and transport layer.

22. The computer program product of claim 20 , wherein respective DPI applications are pinned to the CPUs.

23. The computer program product of claim 19 , wherein the traffic flows are classified according to network protocol layers including: network, transport, session, presentation, and application network protocol layers.

24. The computer program product of claim 19 , wherein the devices comprise physical devices on a network.

25. The computer program product of claim 19 , wherein the devices comprise virtual devices in a cloud.

26. The computer program product of claim 25 , wherein the collected data is received by a physical server through a number of physical interfaces.

27. The computer program product of claim 25 , wherein the collected data is received by a virtual machine through a virtual tunnel.