Intelligent export of network information
Methods and systems for exporting network information from an exporter to a collector are disclosed. Embodiments of the present technology may include updating a non-key field of a flow entry in a flow cache that corresponds to a flow, setting a field in a context-bitmap of the flow entry in response to updating the non-key field of the flow entry, identifying an export policy using the context-bitmap, and exporting information related to the flow to a collector according to the export policy.
1. A method for exporting network information from an exporter to a collector, the method comprising:
updating a non-key field of a flow entry in a flow cache that corresponds to a flow;
setting a field in a context-bitmap of the flow entry in response to updating the non-key field of the flow entry; and
identifying an export policy using the context-bitmap; and
exporting information related to the flow to a collector according to the export policy.
2. The method of claim 1 , wherein exporting information related to the flow to a collector according to the export policy involves exporting information according to the Internet Protocol Flow Information eXport (IPFIX) protocol.
3. The method of claim 1 , wherein the context-bitmap includes a set of context-specific bits.
4. The method of claim 1 , wherein the context-bitmap includes a set of context-specific bits, including a short-lived context bit and a long-lived context bit.
5. The method of claim 1 , wherein the context-bitmap includes a set of context-specific bits, including a dormant context bit and an active context bit.
6. The method of claim 1 , wherein the context-bitmap includes a set of context-specific bits, including a security bit, a performance bit, a latency bit, an error bit, and a raw statistics bit.
7. The method of claim 1 , wherein the context-bitmap includes a set of context-specific bits, including TCP context bits, UDP context bits, and ICMP context bits.
8. The method of claim 1 , wherein the context-bitmap includes a set of context-specific bits, including a short-lived context bit, a long-lived context bit, a dormant context bit, an active context bit, a security bit, a performance bit, a latency bit, an error bit, and a raw statistics bit.
9. The method of claim 1 , wherein the context-bitmap includes a set of context-specific bits, including a short-lived context bit, a long-lived context bit, a dormant context bit, an active context bit, TCP context bits, UDP context bits, and ICMP context bits.
10. The method of claim 1 , wherein identifying an export policy using the context-bitmap involves using the context-bitmap to search an export policy lookup table that maps context-bitmap values to export policies.
11. The method of claim 1 , wherein identifying an export policy using the context-bitmap involves using the context-bitmap to search an export policy lookup table that maps context-bitmap values to export policy actions and export policy parameters, wherein the export policy parameters include pointers to a collector template table.
12. The method of claim 11 , further comprising identifying a collector and an export template using a pointer from the export policy lookup table.
13. The method of claim 1 , wherein the non-key field in the flow cache holds information related to security of the flow and a bit in the context-bitmap includes a security context bit that is set in response to a value of the non-key field.
14. The method of claim 1 , wherein the non-key field in the flow cache holds information related to performance of the flow and a bit in the context-bitmap includes a performance context bit that is set in response to a value of the non-key field.
15. The method of claim 1 , wherein the non-key field in the flow cache holds information related to latency of the flow and a bit in the context-bitmap includes a latency context bit that is set in response to a value of the non-key field.
16. The method of claim 1 , wherein the non-key field in the flow cache holds information related to an error of the flow and a bit in the context-bitmap includes an error context bit that is set in response to a value of the non-key field.
17. The method of claim 1 , wherein updating a non-key field of a flow entry in a flow cache involves parsing a packet to identify a key field and using the key field to locate a flow entry in the flow cache.
18. A method for exporting network information from an exporter to a collector, the method comprising:
updating a non-key field of a flow entry in a flow cache that corresponds to a flow;
setting a field in a context-bitmap of the flow entry in response to updating the non-key field of the flow entry; and
identifying an export policy using the context-bitmap; and
exporting information related to the flow to a collector according to the export policy, wherein exporting information related to the flow to a collector according to the export policy involves exporting information according to the Internet Protocol Flow Information eXport (IPFIX) protocol;
wherein the non-key field in the flow cache holds information related to the flow and a bit in the context-bitmap includes a context bit that is set in response to a value of the non-key field.
19. A system for exporting network information from an exporter to a collector, the system comprising:
a processor; and
a computer readable medium that stored instructions, which when executed by the processor, implement:
updating a non-key field of a flow entry in a flow cache that corresponds to a flow;
setting a field in a context-bitmap of the flow entry in response to updating the non-key field of the flow entry;
identifying an export policy using the context-bitmap; and
exporting information related to the flow to a collector according to the export policy.