Dropped packet detection and classification for networked devices
In general, this disclosure describes a network device to determine a cause of packets being dropped within a network. An example method includes generating, by a traffic monitor operating on a network device, an exception packet that includes a unique exception code that identifies a cause for a component in the network device to discard a transit packet, and a nexthop index identifying a forwarding path being taken by the transit packet experiencing the exception. The method also includes forwarding the exception packet to a collector to be processed.
1. A method comprising:
generating, by processing circuitry of a network device, an exception packet comprising:
an exception code that identifies a cause for a forwarding component in the network device to discard a transit packet, and
a nexthop identifier identifying a forwarding path being taken by the transit packet experiencing an exception, the nexthop identifier identifying a path for the transit packet from the network device to a destination network device; and
forwarding the exception packet to a collector to be processed.
2. The method of claim 1 , wherein the exception packet comprises an Internet Protocol Flow Information Export (IPFIX) exception packet.
3. The method of claim 1 , wherein the exception code indicates that the transit packet was dropped due to a bad Internet Protocol (IP) header.
4. The method of claim 3 , further comprising determining that the transit packet was dropped due to a bad IP header based on a checksum value of the IP header of the transit packet.
5. The method of claim 1 , wherein the exception code indicates that the transit packet was dropped due to an expired time-to-live (TTL), a firewall discard, or a virtual local area network (VLAN) mismatch.
6. The method of claim 1 , further comprising inserting at least a portion of the transit packet into the exception packet.
7. The method of claim 1 , further comprising encoding the exception packet according to a predefined exception packet template.
8. The method of claim 1 , comprising, in response to receiving a threshold number of exception packets that include the exception code identifying a particular cause, triggering an alert.
9. A network device comprising:
a forwarding plane comprising a plurality of forwarding components to route transit packets from input interfaces to output interfaces of the network device;
a control plane comprising one or more processors;
a traffic monitor configured for execution by the control plane to, when one of the forwarding components drops one of the transit packets:
generate an exception packet for the dropped transit packet, the exception packet comprising:
an exception code that identifies a cause for the forwarding plane to discard the dropped transit packet, and
a nexthop identifier identifying a forwarding path being taken by the transit packet experiencing an exception, the nexthop identifier identifying a path for the transit packet from the network device to a destination network device; and
forward the exception packet to a collector to be processed to identify when the forwarding component that discarded the dropped transit packet is experiencing a failure.
10. The network device of claim 9 , wherein the exception packet comprises an Internet Protocol Flow Information Export (IPFIX) exception packet.
11. The network device of claim 9 , wherein the exception code indicates that the transit packet was dropped due to a bad Internet Protocol (IP) header.
12. The network device of claim 11 , wherein the traffic monitor is configured to determine that the transit packet was dropped due to a bad IP header based on a checksum value of the IP header of the transit packet.
13. The network device of claim 9 , wherein the exception code indicates that the transit packet was dropped due to an expired time-to-live (TTL), a firewall discard, or a virtual local area network (VLAN) mismatch.
14. The network device of claim 9 , wherein the traffic monitor is configured to insert at least a portion of the transit packet into the exception packet.
15. The network device of claim 9 , wherein the traffic monitor is configured to encode the exception packet according to a predefined exception packet template.
16. The network device of claim 9 , wherein the collector operates within the control plane of the network device.
17. The network device of claim 9 , wherein the collector operates on a controller external to the network device.
18. A computer readable medium comprising instructions that, when executed, cause one or more processors of a network device to:
generate, by a traffic monitor operating on the network device, an exception packet comprising:
an exception code that identifies a cause for a forwarding component of the network device to discard a transit packet, and
a nexthop identifier identifying a forwarding path being taken by the transit packet experiencing an exception, the nexthop identifier identifying a path for the transit packet from the network device to a destination network device; and
forward the exception packet to a collector to be processed.
19. The computer readable medium of claim 18 , wherein the exception packet comprises an Internet Protocol Flow Information Export (IPFIX) exception packet.
20. The computer readable medium of claim 18 , wherein the exception code indicates that the transit packet was dropped due to one or more of a bad Internet Protocol (IP) header, an expired time-to-live (TTL), a firewall discard, or a virtual local area network (VLAN) mismatch.