Design of a Real-Time Traffic Mirroring System

Network monitoring and analysis is a vital component of network infrastructure reliability, availability, and sustainability. As network bandwidth consumption continues to grow exponentially, real-time traffic data analysis becomes increasingly challenging and expensive. In many cases, monitoring can only be achieved via hardware Test Access Point (TAP) devices. Due to the intrusiveness and inflexibility of deploying such hardware, this approach is intractable in an SDN environment, where network resource allocation programmability is key to network orchestration and deployment. In our prior work we developed a technology to improve VIRTIO port mirroring via network device mirror offloading. In this paper, we extend our mirror offloading work to include a novel mirror tunnel design. Mirror tunneling technology transports traffic from any device capable of supporting a software TAP to a mirror tunnel device that supports mirror hardware offloading. In addition, we develop a mirror controller based upon SR-IOV technology and the kernel netdev interface. With minimal changes required for the traffic source network function, the host system can dynamically reconFigure traffic mirror management settings via pre-existing kernel-based Internet Protocol (IP) management tools.