Patent Application
20250233876
Network monitoring tools are often deployed to identify security threats, prevent unauthorized access, and thwart cyber-attacks. Monitoring the traffic in a conventional communications network in order to detect malicious activities often requires a physical connection to a network appliance disposed in the network. Establishing a physical connection to an appliance used in today's extensive and highly complex enterprise or datacenter networks is costly, time consuming and unscalable. A need continues to exist for an improved technique for monitoring network traffic.
With respect to the discussion to follow, and in particular, to the drawings, it is stressed that the particulars shown represent examples for purposes of illustrative discussion and are presented in the cause of providing a description of principles and conceptual aspects of the present disclosure. In this regard, no attempt is made to show implementation details beyond what is needed for a fundamental understanding of the present disclosure. The discussion to follow, in conjunction with the drawings, makes apparent to those of skill in the art how embodiments in accordance with the present disclosure may be practiced. Similar or same reference numbers may be used to identify or otherwise refer to similar or same elements in the various drawings and supporting descriptions. In the accompanying drawings:
The present disclosure is directed to real-time monitoring and deep packet inspection (DPI) of sessions occurring in a network communication system. Network traffic is tapped at one or more points in a production network (also referred to herein as production fabric), mirrored and forwarded to a monitoring fabric in which real-time DPI operation is carried out. As described further below, a network monitoring system, in accordance with embodiments of the present disclosure, is highly scalable and has a distributed architecture. Because the DPI, in accordance with embodiments of the present disclosure, is performed in the monitoring fabric, relatively large and complex production fabrics may be monitored without being subjected to performance degradation.
The monitoring fabric includes, in part, one or more service nodes that receive and session-slice the mirrored traffic so that only a subset of packets of each session (e.g., TCP session) are selected for the DPI operation. In one example, the subset of packets selected for the DPI operation may be the first 5-15 packets of a TCP session, thus significantly reducing the amount of data used to inspect the traffic, while concurrently improving the performance, and reducing the storage requirements. In accordance with another aspect of the present disclosure, mirrored packets may be encapsulated into layer 2 generic routing encapsulation (L2GRE) packets and forwarded to a service node for the DPI operation via, for example, a layer-3 network. It is understood that the mirrored packets may be encapsulated using any packet encapsulation protocol other than the L2GRE, and that embodiments of the present disclosure are not limited to L2GRE or any other packet encapsulation protocol.
Because, in accordance with one aspect of the present disclosure, DPI is performed by the service nodes on the monitoring fabric, the traffic flow in the production fabric is not degraded. Information obtained by performing DPI on the session-sliced packets includes, for example, the type and identity of application from which the packets are mirrored. Such information may be transferred by the service nodes to a collector using, for example, the IPFIX protocol. By identifying the application type and other metadata associated with the traffic flow, malicious activity, such as access to malicious websites and transmission of sensitive data, is prevented.
A network monitoring system, in accordance with embodiments of the present disclosure, therefore, dispenses with the need for time consuming and costly wiring that would otherwise be required to access and monitor the traffic in, for example, a subnet or a network leaf node where suspicious activity may be underway. By making modifications to an existing set of network policies, the network traffic from the subnet may be directed and delivered to the monitoring network for a DPI operation. Moreover, a network monitoring system, in accordance with embodiments of the present disclosure, enables DPI to be carried out for a user-specified number of IP addresses or IP protocols, thus providing network administrators with a network monitoring tool that is scalable, flexible, configurable, easy to use, and less costly than conventional network monitoring tools. In some embodiments, the network monitoring system of the present disclosure uses the DANZ Monitoring Fabric® (DMF) that is commercially available from Arista Networks of Santa Clara, California.
Production fabric 130 is shown as including, in part, a multitude of interconnected network devices (ND) 102. Network devices 102 may include routing and switching devices such as top-of-rack (“ToR”) switches, aggregation switches, gateways, ingress and/or egress switches, provider edge devices, and the like. Network devices 102 form a communications network among clients 104 which may be, for example, computing devices (e.g., desktop computers, laptops, mobile devices, etc.) and servers (e.g., database servers, web services, etc.). Production fabric 130 may be connected to an external network 140, such as a public switched network. Clients 104 may communicate with one another via network devices 102.
Production fabric 130 is also shown as including, in part, a multitude of data taps 106 configured to enable the monitoring and analysis of the traffic flowing among network devices 102. Data taps 106 are configured to mirror (copy) the packets flowing in production fabric 130 and deliver the mirrored packets to monitoring fabric 150. Each data tap 106 may be a network tap devices, or a switched-port analyzer (SPAN) port, and the like. Monitoring fabric 150 includes one or more service nodes (SN) 152 configured to receive and analyze the mirrored packets, as described in detail below.
In some embodiments, service nodes 152 are configured to perform DPI on a subset of the mirrored packets and supply the inspection results to one or more network monitoring and security tools 160 adapted to monitor network performance, detect and respond to threats, identify malicious actors, and the like. Network monitoring tools 160 include, but are not limited to, packet analyzers, packet recorders, bandwidth monitors, and the like.
Monitoring fabric 150 is shown in
Each service node is configured to perform real-time DPI operation on a subset of the mirrored packets in accordance with a network configuration policy received from, for example, controller 260. Each service node may also be configured to modify the received packets, for example, by adding headers and trailers to the packets, truncating the packets to a specified length, decapsulating the packets by stripping off specified encapsulations, searching for specific regular expressions in the packets, masking out bytes matching specific regular expressions, and the like.
Prior to performing a DPI operation, service node 152 session slices the mirrored packets associated with a session (e.g., TCP session) to select a subset of the mirrored packets of each session for the DPI operation. In one example, only the first 5-15 packets of each session are used for the DPI. The session-sliced packets may also be forwarded to a monitoring tool 270 via switch network 250 for further operations. In one embodiment, a service node may be configured to store packets. In other embodiments, a packet recorder 280 disposed in the monitoring fabric may be configured to store the mirrored packets for subsequent review, playback and DPI inspection. Moreover, by changing the network configuration policy, mirrored traffic from, for example, a subnet or a network leaf node of a production fabric is encapsulated into L2GRE packets and delivered via a layer-3 network to a service node for a DPI operation.
Each service node 152 is shown as including, in part, an optional session slicer 190 and a session table 192. Session table 192 includes entries about each session in connection with which the service node has received mirrored packets. Session slicer 190 is configured to pass portions of the mirrored traffic 302 in a session slicing operation and forward a subset of the packets of each sliced session to DPI block 270 for a DPI operation. Session slicer 190 is configured to identify sessions in the mirrored traffic using the entries in session table 192. Session slices of each session that are not passed back to switch fabric 250 are dropped. DPI block 270 is adapted to perform DPI operation on the subset of the mirrored packets to identify, among other things, the type and identity of the application generating the traffic flow from which the packets were mirrored, the source of the traffic, the destination of the traffic, as described further below. Although service node 152 is shown as including, in part, a session slicer 190, it is understood that embodiments of the present disclosure are not so limited, and that other embodiments of the present disclosure may operate without a session slicer.
A number of advantages are achieved by performing DPI operations, in accordance with embodiments of the present disclosure. For example, embodiments of the present disclosure may apply DPI to enable network administrators to enhance network security by monitoring network traffic, thereby identifying and preventing potential security threats, such as malware, viruses, and hacking attempts. In accordance with another embodiment of the present disclosure, DPI may be used to block access to malicious websites and prevent the transmission of sensitive data. Embodiments of the present disclosure may further be used to enhance network performance by applying DPI to identify and prioritize network traffic based on the traffic's content, thus enabling more efficient use of network resources. Therefore, latency is reduced and network speed is increased. Applying DPI, in accordance with embodiments of the present disclosure, further enables application based routing, thus enhancing, for example, the performance of software as a service (SaaS) applications.
The DPI, when applied in accordance with embodiments of the present disclosure, may improve quality of service (QOS) by prioritizing certain types of network traffic, such as voice and video, over other types of network traffic, such as email or web browsing. Therefore, more critical applications receive the bandwidth and resources they require to function as intended. Moreover, improved network monitoring and troubleshooting may be achieved by providing administrators with detailed information about network traffic and usage patterns, which may be used to diagnose and resolve network issues more quickly and efficiently.
By enabling network administrators to monitor and control the transmission of sensitive data, embodiments of the present disclosure may apply DPI to help organizations comply with various regulations and standards, such as the payment card industry data security standard (PCI DSS). In other words, when applied in accordance with embodiments of the present disclosure, DPI provides network administrators with greater visibility and control over the networks, thereby leading to improved security, performance, and reliability.
Network interface subsystem 416 operates as an interface for communicating data between computer system 400 and other devices (e.g., a switch in monitoring fabric 150). Network interface subsystem 416 may include, e.g., an Ethernet card. User interface input devices 412 may include a keyboard, pointing devices (e.g., mouse, trackball, touchpad), a touch-screen incorporated into a display, audio input devices (e.g., voice recognition systems, microphones) and other types of input devices. In general, use of the term “input device” is intended to include all possible types of devices and mechanisms for inputting information into computer system 400.
User interface output devices 414 can include a display subsystem, a printer, or nonvisual displays such as audio output devices, etc. The display subsystem can be, e.g., a flat-panel device such as a liquid crystal display (LCD) or organic light-emitting diode (OLED) display. In general, use of the term “output device” is intended to include all possible types of devices and mechanisms for outputting information from computer system 400.
Data subsystem 406 includes memory subsystem 408, and file/disk storage subsystem 410 represent non-transitory computer-readable storage media that can store program code and/or data, which when executed by processor 402, can cause processor 402 to perform operations in accordance with embodiments of the present disclosure.
Memory subsystem 408 includes a number of memories including random access memory (RAM) 418 for storage of instructions and data during program execution and read-only memory (ROM) 420 in which fixed instructions are stored. File storage subsystem 410 provided persistent (i.e., non-volatile) storage for program and data files, and may include a magnetic or solid-state hard disk drive, an optical drive along with associated removable media (e.g., CD-ROM, DVD, Blu-Ray, etc.), a removable flash memory-based drive or card, and/or other types of storage media known in the art. It is understood that computer system 400 is illustrative and many other configurations having more or fewer components than system 400 are possible.
The above description illustrates various embodiments of the present disclosure together with examples of how aspects of the present disclosure may be implemented. The above examples and embodiments should not be deemed to be the only embodiments, and are presented to illustrate the flexibility and advantages of the present disclosure as defined by the following claims. Based on the above disclosure and the following claims, other arrangements, embodiments, implementations and equivalents may be employed without departing from the scope of the disclosure as defined by the claims.
The present application is related to U.S. patent application Ser. No. 17/644,410, filed on Dec. 15, 2021, the content of which is incorporated herein by reference in its entirety.
