Packet switch methods and systems
The present invention relates to a packet switch and a packet switching method. An example embodiment of the present invention comprises at least three network ports, at least one instrument port, a mux-switch, a packet switch fabric, and an address table. The embodiment updates the address table to include the source address of each ingress packet of each network port and associate the source address with that network port. The mux-switch routes the ingress packet traffic of each network port according to the identity of the network port so that at least a copy of the packet traffic of one of the network ports is routed to an instrument port. The packet switch fabric routes the packets from the instrument ports to the network ports according the destination address of the packet and the identity of the network port that is associated with the destination address as recorded in the address table.
1. A packet switch configured to be connected to a traffic production network and a network monitoring instrument, the packet switch comprising:
a network port to be connected to the traffic production network, wherein the packet switch is an out-of-band device with respect to the traffic production network, and the network port is configured to receive packets from the traffic production network;
an instrument port for communication with the network monitoring instrument; and
a computer-readable medium containing computer-executable instructions to operate the packet switch, comprising instructions to:
establish a logical connection between the network port and the instrument port based on a network flow; and
forward packets received from the traffic production network through the network port to the instrument port based on the packets belonging to the network flow.
2. A method for sampling packets for a network flow, comprising:
receiving a packet at a network port of a network switch appliance, the network switch appliance comprising an instrument port for communication with a network monitoring instrument, wherein the network switch appliance is an out-of-band device with respect to a traffic production network, and the packet is received by the network switch appliance from the traffic production network; and
passing the packet to the instrument port;
wherein the packet is passed to the instrument port based on the packet belonging to a certain network flow.
3. The method of claim 2 , wherein the network flow is characterized by a source IP address.
4. The method of claim 2 , wherein the network flow is characterized by a destination IP address.
5. The method of claim 2 , wherein the network flow is characterized by a TCP port number.
6. The method of claim 2 , wherein the network flow is characterized by network protocol parameters.
7. The method of claim 2 , wherein the act of passing the packet to the instrument port is performed based on L 2 information.
8. The method of claim 2 , wherein the act of passing the packet to the instrument port is performed based on L 3 information.
9. The method of claim 2 , wherein the act of passing the packet to the instrument port is performed based on L 4 information.
10. The method of claim 2 , wherein the act of passing the packet to the instrument port is performed using a hashing algorithm.
11. The method of claim 2 , further comprising receiving additional packets for the network flow, and passing all of the additional packets to the instrument port.
12. The method of claim 2 , wherein the packet is passed to the instrument port in an out-of-band configuration.
13. The method of claim 2 , wherein the network switch appliance comprises an additional instrument port for communication with an additional network monitoring instrument, and wherein the method further comprises:
receiving an additional packet belonging to an additional network flow; and
passing the additional packet to the additional instrument port.
14. A network switch apparatus comprising:
a network port for receiving a packet, wherein the network switch appliance is an out-of-band device with respect to a traffic production network, and the network port is configured to receive the packet from the traffic production network;
an instrument port for communication with a network monitoring instrument; and
a processing unit communicatively coupled with the network port and the instrument port, wherein the processing unit is configured for passing the packet to the instrument port based on the packet belonging to a certain network flow.
15. The network switch apparatus of claim 14 , wherein the network flow is characterized by a source IP address.
16. The network switch apparatus of claim 14 , wherein the network flow is characterized by a destination IP address.
17. The network switch apparatus of claim 14 , wherein the network flow is characterized by a TCP port number.
18. The network switch apparatus of claim 14 , wherein the network flow is characterized by network protocol parameters.
19. The network switch apparatus of claim 14 , wherein the processing unit is configured to pass the packet to the instrument port based on L 2 information.
20. The network switch apparatus of claim 14 , wherein the processing unit is configured to pass the packet to the instrument port based on L 3 information.
21. The network switch apparatus of claim 14 , wherein the processing unit is configured to pass the packet to the instrument port based on L 4 information.
22. The network switch apparatus of claim 14 , wherein the processing unit is configured to pass the packet to the instrument port using a hashing algorithm.
23. The network switch apparatus of claim 14 , wherein the processing unit is configured for receiving additional packets for the network flow, and passing all of the additional packets to the instrument port.
24. The network switch apparatus of claim 14 , wherein the processing unit is configured to pass the packet to the instrument port in an out-of-band configuration.
25. The network switch apparatus of claim 14 , further comprising an additional instrument port for communication with an additional network monitoring instrument;
wherein the processing unit is configured for:
receiving an additional packet belonging to an additional network flow; and
passing the additional packet to the additional instrument port.
26. A computer product having a non-transitory medium storing instruction, an execution of which causes a method to be performed, the method comprising:
receiving a packet at a network port of a network switch appliance, the network switch appliance comprising an instrument port for communication with a network monitoring instrument, wherein the network switch appliance is an out-of-band device with respect to a traffic production network, and the packet is received by the network switch appliance from the traffic production network; and
passing the packet to the instrument port;
wherein the packet is passed to the instrument port based on the packet belonging to a certain network flow.