Tool port aware stateful protocol visibility for packet distribution

1. A network visibility node comprising:

a network port through which to receive a plurality of packets from at least one entity external to the network visibility node, wherein each of the plurality of packets includes a compressed header;

a plurality of tool ports through which to communicate data with a respective plurality of network tools, wherein at least a portion of each packet of the plurality of packets is to be forwarded to at least one network tool of the plurality of network tools;

a storage device storing a mapping structure indicative of which packet headers, if any, each of the plurality of network tools has received; and

processor circuitry configured to

maintain the mapping structure, and

for each packet of the plurality of packets, determine, prior to transmitting the packet to a particular network tool of the plurality of network tools, whether to decompress a compressed header of the packet based on the mapping structure indicative of which packet headers, if any, each of the plurality of network tools has received.

2. The network visibility node of claim 1 , wherein the processor circuitry is further configured to, for each packet:

determine, based on the mapping structure, that the compressed header of the packet has not been received by a given network tool of the plurality of network tools; and

upon determining that the compressed header of the packet has not been received by the given network tool of the plurality of network tools, replace the compressed header with a decompressed header prior to transmitting the packet to the given network tool of the plurality of network tools.

3. The network visibility node of claim 1 , wherein the processor circuitry is further configured to, for each packet:

determine, based on the mapping structure, that the compressed header of the packet has been received by a given network tool of the plurality of network tools; and

upon determining that the given packet header has been received by the given network tool of the plurality of network tools, transmit the packet to the given network tool of the plurality of network tools, wherein the packet includes the compressed header.

4. The network visibility node of claim 1 , wherein the processor circuitry is further configured to, for a first packet and a second packet of the plurality of packets:

determine, based on the mapping structure, that the compressed header of the first packet has not been received by a given network tool of the plurality of network tools and that a compressed header of the second packet has been received by the given network tool;

upon determining that the compressed header of the first packet has not been received by the given network tool, replace the compressed header of the first packet with a first decompressed header prior to transmitting the first packet to the given network tool; and

upon determining that the compressed header of the second packet has been received by the given network tool, transmit the second packet to the given network tool, wherein the second packet includes a second compressed header.

5. The network visibility node of claim 1 , wherein the plurality of packets is communicated in a transmission control protocol (TCP) session using hypertext transfer protocol (HTTP) version two (HTTP/2).

6. The network visibility node of claim 5 , wherein the plurality of packets is received during a single TCP session.

7. The network visibility node of claim 1 , wherein the plurality of packets is from a plurality of subscribers.

8. The network visibility node of claim 1 , wherein the mapping structure is further indicative of which packet headers, if any, each of the plurality of tool ports has received.

9. The network visibility node of claim 8 , wherein the processor circuitry is further configured to, for a first packet and a second packet of the plurality of packets:

determine, based on the mapping structure, that the compressed header of the first packet has not been received by a given tool port of the plurality of tool ports and that the compressed header of the second packet has been received by the given tool port;

upon determining that the compressed header of the first packet has not been received by the given tool port, replace the compressed header of the first packet with a first decompressed header prior to transmitting the first packet to the given tool port; and

upon determining that the compressed header of the second packet has been received by the given tool port, transmit the second packet to the given tool port, wherein the second packet includes a second compressed header.

10. A system comprising:

a plurality of network ports through which to receive a plurality of packets, wherein each of the plurality of packets includes a compressed header;

a plurality of tool ports through which to communicate data with a respective plurality of network tools, wherein at least a portion of each packet of the plurality of packets is to be forwarded to at least one network tool of the plurality of network tools;

a storage device storing a mapping structure indicative of which packet headers, if any, each of the plurality of network tools has received; and

processor circuitry configured to maintain the mapping structure and for each packet of the plurality of packets,

the processor circuitry further configured to:

determine, based on the mapping structure, whether the compressed header of the packet has been received by a given network tool of the plurality of network tools; and

upon determining that the compressed of the packet has been received by the given network tool of the plurality of network tools, transmitting the packet to the given network tool of the plurality of network tools, wherein the packet includes the compressed header; or

upon determining that the compressed header of the packet has not been received by the given network tool of the plurality of network tools, replace the compressed header with a decompressed header prior to transmitting the packet to the given network tool of the plurality of network tools.

11. The system of claim 10 , wherein the plurality of packets is from a plurality of subscribers.

12. The system of claim 10 , wherein the processor circuitry is further configured to apply a Huffman decoding scheme.

13. A method comprising:

receiving a plurality of packets at a visibility node, via a network port of a plurality of network ports of the visibility node, the visibility node having a plurality of tool ports through which to communicate data with a respective plurality of network tools, wherein each of the plurality of packets includes a compressed header, and wherein at least a portion of each packet of the plurality of packets is to be forwarded to at least one network tool of the plurality of network tools;

maintaining, by the visibility node, a mapping structure indicative of which packet headers, if any, each of the plurality of network tools has received; and

for each packet of the plurality of packets,

determining, by the visibility node prior to transmitting the packet to a particular network tool of the plurality of network tools, whether to decompress a compressed header of the packet based on the mapping structure indicative of which packet headers, if any, each of the plurality of network tools has received.

14. The method of claim 13 , further comprising:

determining, based on the mapping structure, that the compressed header of the packet has been received by a given network tool of the plurality of network tools; and

upon determining that the given packet header has been received by the given network tool of the plurality of network tools, transmitting the packet to the given network tool of the plurality of network tools, wherein the packet includes the compressed header.

15. The method of claim 13 , further comprising:

determining, based on the mapping structure, that the compressed header of the packet has not been received by a given network tool of the plurality of network tools; and

upon determining that the compressed header of the packet has not been received by the given network tool of the plurality of network tools, replacing the compressed header with a decompressed header prior to transmitting the packet to the given network tool of the plurality of network tools.

16. The method of claim 13 , wherein the plurality of packets includes a first packet and a second packet, the method further comprising:

determining, based on the mapping structure, that the compressed header of the first packet has not been received by a given network tool of the plurality of network tools and that a compressed header of the second packet has been received by the given network;

upon determining that the compressed header of the first packet has not been received by the given network tool, replacing the compressed header of the first packet with a first decompressed header prior to transmitting the first packet to the given network tool; and

upon determining that the compressed header of the second packet has been received by the given network tool, transmitting the second packet to the given network tool, wherein the second packet includes a second compressed header.

17. The method of claim 13 , wherein the plurality of data packets is communicated in a first transmission control protocol (TCP) session using hypertext transfer protocol (HTTP) two, and wherein the plurality of data packets is a first plurality of data packets and the mapping structure is a first mapping structure, the method further comprising:

receiving a second plurality of data packets at the visibility node via a second TCP session;

determining that the second TCP session is different from the first TCP session; and

establishing a second mapping structure corresponding to the second plurality of data packets.

18. The method of claim 13 , wherein the plurality of packets includes data representative of video, IMS voice, and Internet.

19. The method of claim 13 , further comprising:

encoding at least a portion of the compressed header by applying Huffman encoding schemes.

20. The method of claim 13 , wherein the mapping structure is further indicative of which packet headers, if any, each of the plurality of tool ports has received.