Performance analysis of virtual private network segment on a per flow basis

1. A method, comprising:

generating one or more Virtual Private Network (“VPN”) encapsulated packets having anonymized headers;

maintaining a table at a first network device configured to map the anonymized headers to original headers of the VPN encapsulated packets;

receiving a trace request from an initiator;

generating, based at least in part on the received trace request, an out-of-tunnel trace request to be sent toward a second network device via at least one intermediate network device using the anonymized headers; and

forwarding the received trace request as an in-tunnel trace request through a VPN tunnel.

2. The method of claim 1 , further comprising:

updating a mapping cache with anonymized header information; and

providing a response to the out-of-tunnel trace request to the first network device.

3. The method of claim 1 , further comprising:

providing per-flow statistics on the anonymized headers; and

sending a response to the out-of-tunnel trace request to the first network device.

4. The method of claim 1 , further comprising:

sending received responses for the out-of-tunnel trace request to the initiator.

5. The method of claim 4 , further comprising:

consolidating the received responses to the out-of-tunnel trace request prior to sending them to the initiator.

6. The method of claim 4 , further comprising:

adding flow identifiers, which can be associated with the first network device and the second network device, to the received responses prior to sending them to the initiator.

7. The method of claim 1 , wherein the anonymized headers are provided in unencrypted and unencapsulated portions of one or more packets that are accessible to the at least one intermediate network device.

8. The method of claim 1 , wherein the first network device is associated with a head end of the tunnel and the second network device is associated with a tail end of the tunnel.

9. The method of claim 1 , wherein the table is used to map one or more User Datagram Protocol (UDP) and Real-time Transport Protocol (RTP) header fields to new values for those fields, and wherein the table includes an index to one or more of the original headers.

10. One or more non-transitory tangible media that includes code for execution and when executed by a processor is operable to perform operations comprising:

generating one or more Virtual Private Network (“VPN”) encapsulated packets having anonymized headers;

maintaining a table at a first network device configured to map the anonymized headers to original headers of the VPN encapsulated packets;

receiving a trace request from an initiator;

generating, based at least in part on the received trace request, an out-of-tunnel trace request to be sent toward a second network device via at least one intermediate network device using the anonymized headers; and

forwarding the received trace request as an in-tunnel trace request through a VPN tunnel.

11. The media of claim 10 , wherein the operations further comprise:

updating a mapping cache with anonymized header information; and

providing a response to the out-of-tunnel trace request to the first network device.

12. The media of claim 10 , wherein the operations further comprise:

providing per-flow statistics on the anonymized headers; and

sending a response to the out-of-tunnel trace request to the first network device.

13. The media of claim 10 , wherein the operations further comprise:

sending received responses for the out-of-tunnel trace request to the initiator.

14. The media of claim 13 , wherein the operations further comprise:

consolidating the received responses to the out-of-tunnel trace request prior to sending them to the initiator.

15. The media of claim 10 , wherein the operations further comprise:

adding flow identifiers, which can be associated with the first network device and the second network device, to the received responses prior to sending them to the initiator.

16. The media of claim 10 , wherein the anonymized headers are provided in unencrypted and unencapsulated portions of one or more packets that are accessible to the at least one intermediate network device.

17. The media of claim 10 , wherein the table is used to map one or more User Datagram Protocol (UDP) and Real-time Transport Protocol (RTP) header fields to new values for those fields, and wherein the table includes an index to one or more of the original headers.

18. An apparatus, comprising:

a memory element configured to store data;

a processor operable to execute instructions associated with the data; and

a mapping module configured to interface with the processor and the memory element such that the apparatus is configured to:

generate one or more Virtual Private Network (“VPN”) encapsulated packets having anonymized headers;

maintain a table to map the anonymized headers to original headers of the VPN encapsulated packets;

receive a trace request from an initiator;

generate, based at least in part on the received trace request, an out-of-tunnel trace request to be sent toward a network device via at least one intermediate network device using the anonymized headers; and

forward the received trace request as an in-tunnel trace request through a VPN tunnel.

19. The apparatus of claim 18 , wherein the anonymized headers are provided in unencrypted and unencapsulated portions of one or more packets that are accessible to the at least one intermediate network device.

20. The apparatus of claim 18 , wherein the table is used to map one or more User Datagram Protocol (UDP) and Real-time Transport Protocol (RTP) header fields to new values for those fields, and wherein the table includes an index to one or more of the original headers.