Granted Patent B1

US 12,537,776 · App. 18/084,504 · Granted Jan 27, 2026

Inventors: Bruce Hui Kwan (Sunnyvale, CA); William Brad Matthews (Los Gatos, CA); Puneet Agarwal (Santa Clara, CA)

Assignee: Innovium, Inc.

H04L47/31H04L45/38H04L47/2441H04L47/33

Abstract

Claims (117)

1 . An apparatus comprising:

network interfaces configured to receive packets over one or more networks;

a flow tracker configured to track a plurality of flows of the received packets, the flow tracker comprising:

a packet traffic sampler configured to send an event notification to a visibility processor responsive to an event occurring within the apparatus that affects packet traffic in a flow among the plurality of flows;

the visibility processor is configured to analyze the flow based on the event to determine whether to send diagnostic information to a collector; and

in response to a determination that diagnostic information is to be sent to the collector, the visibility processor is further configured to send diagnostic information associated with the flow to the collector.

2 . The apparatus of claim 1 , wherein the visibility processor is further configured to:

determine whether the event is a dropped packet from the flow;

in response to a determination that the event is a dropped packet from the flow, determine whether the dropped packet is the first packet sampled in the flow during a current time period;

in response to a determination that the dropped packet is the first packet sampled in the flow during the current time period:

designate the packet as a diagnostic packet; and

extract packet data from the packet to include in the diagnostic information;

in response to a determination that the dropped packet is not the first packet sampled in the flow during the current time period, discard the dropped packet.

3 . The apparatus of claim 1 , wherein the visibility processor is further configured to:

determine whether the event is an amount of packet traffic delay in the flow is higher than a threshold value;

in response to a determination that the amount of packet traffic delay in the flow is higher than the threshold value, determine whether the packets in the flow are the first packets sampled in the flow during a current time period;

in response to a determination that the packets in the flow are the first packets sampled in the flow during a current time period:

create a snapshot of an egress queue for the flow;

mark the packets in the snapshot as forensic packets; and

include a subset of the forensic packets in the diagnostic information.

4 . The apparatus of claim 1 , wherein the visibility processor monitor is further configured to:

determine whether the event is a dropped packet from the flow;

in response to a determination that the event is a dropped packet from the flow, determine whether the dropped packet is the first packet sampled in the flow during a current time period;

in response to a determination that the dropped packet is the first packet sampled in the flow during the current time period:

create a snapshot of an egress queue for the flow;

mark the packets in the snapshot as forensic packets; and

include a subset of the forensic packets in the diagnostic information,

in response to a determination that the dropped packet is not the first packet sampled in the flow during the current time period, discard the dropped packet.

5 . The apparatus of claim 1 , wherein the visibility processor monitor is further configured to:

determine whether the event is a dropped packet from the flow;

in response to a determination that the event is a dropped packet from the flow, determine whether any tokens are in a recurrent event rate token bucket;

in response to a determination that there is least one token in the recurrent event rate token bucket:

determine whether the dropped packet is the first packet sampled in the flow during a current time period;

in response to a determination that the dropped packet is the first packet sampled in the flow during the current time period:

designate the packet as a diagnostic packet; and

extract packet data from the packet to include in the diagnostic information;

in response to a determination that the dropped packet is not the first packet sampled in the flow during the current time period, discard the dropped packet.

6 . The apparatus of claim 5 , wherein tokens in the recurrent event rate token bucket are dynamically replenished with a number of tokens based on a recurrence rate of the event.

7 . The apparatus of claim 1 , wherein the visibility processor monitor is further configured to:

determine whether the event is an amount of packet traffic delay in the flow is higher than a threshold value;

in response to a determination that the amount of packet traffic delay in the flow is higher than the threshold value, determine whether any tokens are in a recurrent event rate token bucket;

in response to a determination that there is least one token in the recurrent event rate token bucket:

determine whether the packets in the flow are the first packets sampled in the flow during a current time period;

in response to a determination that the packets in the flow are the first packets sampled in the flow during a current time period:

create a snapshot of an egress queue for the flow;

mark the packets in the snapshot as forensic packets; and

include a subset of the forensic packets in the diagnostic information.

8 . The apparatus of claim 7 , wherein tokens in the recurrent event rate token bucket are dynamically replenished with a number of tokens based on a recurrence rate of the event.

9 . The apparatus of claim 1 , wherein the visibility processor monitor is further configured to:

determine whether the event is a dropped packet from the flow;

in response to a determination that the event is a dropped packet from the flow, determine whether any tokens are in a recurrent event rate token bucket;

in response to a determination that there is least one token in the recurrent event rate token bucket:

determine whether the dropped packet is the first packet sampled in the flow during a current time period;

in response to a determination that the dropped packet is the first packet sampled in the flow during the current time period:

create a snapshot of an egress queue for the flow;

mark the packets in the snapshot as forensic packets; and

include a subset of the forensic packets in the diagnostic information,

in response to a determination that the dropped packet is not the first packet sampled in the flow during the current time period, discard the dropped packet.

10 . The apparatus of claim 9 , wherein tokens in the recurrent event rate token bucket are dynamically replenished with a number of tokens based on a recurrence rate of the event.

11 . A method comprising:

receiving packets at network interfaces of a network apparatus over one or more networks;

responsive to an event occurring within the network apparatus that affects received packet traffic in a flow among the plurality of flows:

analyzing the flow based on the event to determine whether to send diagnostic information to a collector; and

in response to a determination that diagnostic information is to be sent to the collector, sending diagnostic information associated with the flow to the collector.

12 . The method of claim 11 , further comprising:

determining whether the event is a dropped packet from the flow;

in response to a determination that the event is a dropped packet from the flow, determining whether the dropped packet is the first packet sampled in the flow during a current time period;

in response to a determination that the dropped packet is the first packet sampled in the flow during the current time period:

designating the packet as a diagnostic packet; and

extracting packet data from the packet to include in the diagnostic information;

in response to a determination that the dropped packet is not the first packet sampled in the flow during the current time period, discarding the dropped packet.

13 . The method of claim 11 , further comprising:

determining whether the event is an amount of packet traffic delay in the flow is higher than a threshold value;

in response to a determination that the amount of packet traffic delay in the flow is higher than the threshold value, determining whether the packets in the flow are the first packets sampled in the flow during a current time period;

in response to a determination that the packets in the flow are the first packets sampled in the flow during a current time period:

creating a snapshot of an egress queue for the flow;

marking the packets in the snapshot as forensic packets; and

including a subset of the forensic packets in the diagnostic information.

14 . The method of claim 11 , further comprising:

determining whether the event is a dropped packet from the flow;

in response to a determination that the event is a dropped packet from the flow, determining whether the dropped packet is the first packet sampled in the flow during a current time period;

in response to a determination that the dropped packet is the first packet sampled in the flow during the current time period:

creating a snapshot of an egress queue for the flow;

marking the packets in the snapshot as forensic packets; and

including a subset of the forensic packets in the diagnostic information,

in response to a determination that the dropped packet is not the first packet sampled in the flow during the current time period, discarding the dropped packet.

15 . The method of claim 11 , further comprising:

determining whether the event is a dropped packet from the flow;

in response to a determination that the event is a dropped packet from the flow, determining whether any tokens are in a recurrent event rate token bucket;

in response to a determination that there is least one token in the recurrent event rate token bucket:

determining whether the dropped packet is the first packet sampled in the flow during a current time period;

in response to a determination that the dropped packet is the first packet sampled in the flow during the current time period:

designating the packet as a diagnostic packet; and

extracting packet data from the packet to include in the diagnostic information;

in response to a determination that the dropped packet is not the first packet sampled in the flow during the current time period, discarding the dropped packet.

16 . The method of claim 15 , wherein tokens in the recurrent event rate token bucket are dynamically replenished with a number of tokens based on a recurrence rate of the event.

17 . The method of claim 11 , further comprising:

determining whether the event is an amount of packet traffic delay in the flow is higher than a threshold value;

in response to a determination that the amount of packet traffic delay in the flow is higher than the threshold value, determining whether any tokens are in a recurrent event rate token bucket;

in response to a determination that there is least one token in the recurrent event rate token bucket:

determining whether the packets in the flow are the first packets sampled in the flow during a current time period;

in response to a determination that the packets in the flow are the first packets sampled in the flow during a current time period:

creating a snapshot of an egress queue for the flow;

marking the packets in the snapshot as forensic packets; and

including a subset of the forensic packets in the diagnostic information.

18 . The method of claim 17 , wherein tokens in the recurrent event rate token bucket are dynamically replenished with a number of tokens based on a recurrence rate of the event.

19 . The method of claim 11 , further comprising:

determining whether the event is a dropped packet from the flow;

in response to a determination that the event is a dropped packet from the flow, determining whether any tokens are in a recurrent event rate token bucket;

in response to a determination that there is least one token in the recurrent event rate token bucket:

determining whether the dropped packet is the first packet sampled in the flow during a current time period;

in response to a determination that the dropped packet is the first packet sampled in the flow during the current time period:

creating a snapshot of an egress queue for the flow;

marking the packets in the snapshot as forensic packets; and

including a subset of the forensic packets in the diagnostic information,

in response to a determination that the dropped packet is not the first packet sampled in the flow during the current time period, discarding the dropped packet.

20 . The method of claim 19 , wherein tokens in the recurrent event rate token bucket are dynamically replenished with a number of tokens based on a recurrence rate of the event.

Assignments (1)

Continuity (3)

References Cited (198)