Packet switch methods and systems
The present invention relates to a packet switch and a packet switching method. An example embodiment of the present invention comprises at least three network ports, at least one instrument port, a mux-switch, a packet switch fabric, and an address table. The embodiment updates the address table to include the source address of each ingress packet of each network port and associate the source address with that network port. The mux-switch routes the ingress packet traffic of each network port according to the identity of the network port so that at least a copy of the packet traffic of one of the network ports is routed to an instrument port. The packet switch fabric routes the packets from the instrument ports to the network ports according the destination address of the packet and the identity of the network port that is associated with the destination address as recorded in the address table.
1. A method comprising:
receiving a plurality of packets at a network port of a network switch appliance, the network switch appliance including a first instrument port coupled to a first network monitoring instrument that is external to the network switch appliance, wherein the network switch appliance operates out-of-band with respect to a traffic production network, the plurality of packets including a first packet received by the network switch appliance from the traffic production network; and
passing the first packet to the first instrument port, based on the packet belonging to a certain network flow.
2. The method of claim 1 , wherein the network flow is characterized by a source IP address.
3. The method of claim 1 , wherein the network flow is characterized by a destination IP address.
4. The method of claim 1 , wherein the network flow is characterized by a TCP port number.
5. The method of claim 1 , wherein the network flow is characterized by network protocol parameters.
6. The method of claim 1 , wherein the act of passing the first packet to the first instrument port is performed based on L 2 information.
7. The method of claim 1 , wherein the act of passing the first packet to the first instrument port is performed based on L 3 information.
8. The method of claim 1 , wherein the act of passing the first packet to the first instrument port is performed based on L 4 information.
9. The method of claim 1 , wherein the act of passing the first packet to the first instrument port is performed using a hashing algorithm.
10. The method of claim 1 , further comprising receiving additional packets for the network flow, and passing all of the additional packets to the first instrument port.
11. The method of claim 1 , wherein the first packet is passed to the first instrument port in an out-of-band configuration.
12. The method of claim 1 , wherein the network switch appliance further comprises a second instrument port for communication with a second network monitoring instrument, and wherein the method further comprises:
receiving a second packet belonging to a second network flow; and passing the second packet to the second instrument port.
13. A network switch apparatus comprising:
a network port to receive a plurality of packets, including a first packet from a traffic production network, the network switch appliance configured to operate out-of-band with respect to the traffic production network;
a first instrument port coupled to a network monitoring instrument that is external to the network switch apparatus; and
a processor operatively coupled to the network port and the first instrument port, the processor configured to pass the first packet to the first instrument port based on the first packet belonging to a certain network flow.
14. The network switch apparatus of claim 13 , wherein the network flow is characterized by a source IP address.
15. The network switch apparatus of claim 13 , wherein the network flow is characterized by a destination IP address.
16. The network switch apparatus of claim 13 , wherein the network flow is characterized by a TCP port number.
17. The network switch apparatus of claim 13 , wherein the network flow is characterized by network protocol parameters.
18. The network switch apparatus of claim 13 , wherein the processor is configured to pass the first packet to the first instrument port based on L 2 information.
19. The network switch apparatus of claim 13 , wherein the processor is configured to pass the first packet to the first instrument port based on L 3 information.
20. The network switch apparatus of claim 13 , wherein the processor is configured to pass the first packet to the first instrument port based on L 4 information.
21. The network switch apparatus of claim 13 , wherein the processor is configured to pass the first packet to the first instrument port using a hashing algorithm.
22. The network switch apparatus of claim 13 , wherein the processing unit is configured for receiving additional packets for the network flow, and passing all of the additional packets to the first instrument port.
23. The network switch apparatus of claim 13 , wherein the processor is configured to pass the first packet to the first instrument port in an out-of-band configuration.
24. The network switch apparatus of claim 13 , further comprising a second instrument port for communication with a second network monitoring instrument;
wherein the processor is further configured to:
receive an additional packet belonging to an additional network flow; and
pass the second packet to the second instrument port.
25. A non-transitory machine-readable storage medium storing instructions that, when executed in a network switch device, cause the network switch device to perform steps comprising:
receiving a plurality of packets at a network port of the network switch device, the network switch device including a first instrument port coupled to a first network monitoring instrument that is external to the network switch device, wherein the network switch device operates out-of-band with respect to a traffic production network, the plurality of packets including a first packet received by the network switch device from the traffic production network; and
passing the first packet to the first instrument port, based on the packet belonging to a certain network flow.