Abstract:
An arrangement in a network tap for monitoring state of a monitoring system is provided. The arrangement includes a set of network ports that includes a set of input network ports for receiving data traffic and a set of output network ports for outputting the data traffic from the network tap. The arrangement also includes a monitoring port that is configured to receive the data traffic from the set of network ports and to forward the data traffic onward to the monitoring system. The arrangement further includes a logic component configured for executing a sequential heartbeat diagnostic test. The sequential heartbeat diagnostic test is configured for providing a first set of sequential heartbeat packets for testing and determining the state of the monitoring system. The arrangement yet also includes a logic component for activating one or more events when a failure condition exists for the state of the monitoring system.

Description:
PRIORITY CLAIM 
       [0001]    The present invention claims priority under 35 U.S.C. 119(e) to the following commonly owned provisionally filed patent application entitled “Sequential Heartbeat Packet Arrangement and Methods Thereof,” U.S. Application No. 61/308,867, Attorney Docket No. NETO-P018P1, filed on Feb. 26, 2010, by inventors Matityahu et al., all of which is incorporated herein by reference. 
     
    
     CROSS REFERENCE TO RELATED APPLICATIONS 
       [0002]    The present invention is related to the following applications, all of which are incorporated herein by reference: 
         [0003]    Commonly assigned application entitled “Communications Network Tap with Heartbeat Monitor,” filed on Jul. 1, 2005 by Matityahu et al. (application Ser. No. 11/174,238; Attorney Docket Number NETO-P007); 
         [0004]    Commonly assigned application entitled “iBypass High Density Device and Methods Thereof,” filed on even date herewith by Matityahu et al (Attorney Docket Number NETO-P019), which claims priority under 35 U.S.C. 119(e) to a commonly owned provisionally filed patent application entitled “iBypass High Density Device and Methods Thereof,” U.S. Application No. 61/308,868, Attorney Docket No. NETO-P019P1, filed on Feb. 26, 2010, by inventors Matityahu, all of which is incorporated herein by reference; and 
         [0005]    Commonly assigned application entitled “Dual Bypass Module and Methods Thereof,” filed on even date herewith by Matityahu et al (Attorney Docket Number NETO-P021), which claims priority under 35 U.S.C. 119(e) to a commonly owned provisionally filed patent application entitled “iBypass High Density Device and Methods Thereof,” U.S. Application No. 61/308,868, Attorney Docket No. NETO-P019P1, filed on Feb. 26, 2010, by inventors Matityahu, all of which is incorporated herein by reference. 
       BACKGROUND OF THE INVENTION 
       [0006]    In today society, a company may depend upon its network to be fully functionally in order to conduct business. To ensure the vitality of the company, the network may have to be protected from external attacks (such as virus attacks, malware attacks, etc.). Accordingly, the network may be monitored to ensure reliable operation, fault detection, timely mitigation of potentially malicious activities and the like. One method for monitoring the network includes the installation of an inline network tap and one or more monitoring systems (such as an intrusion prevention system, an intrusion detection system, a firewall, a packet sniffer, and the like). 
         [0007]    To facilitate discussion,  FIG. 1A  shows a simple diagram of a network environment with a monitoring system, such as an intrusion prevention system (IPS). Consider the situation wherein, for example, a network tap  106  may be employed to gather information about data traffic flowing between two network devices (such as network device  102  and network device  104 ). In other words, data traffic may flow from network device  102  along a path  108  through network tap  106  (into a port  110  and out of a port  112 ) along a path  114  to network device  104 . In a full-duplex network, network tap  106  may also be configured to monitor data traffic flowing from network device  104  to network device  102  (from port  112  to port  110 ). 
         [0008]    To protect itself, a company may install a monitoring system, such as an intrusion prevention system (IPS)  116 . In the aforementioned example, data traffic may flow through IPS  116  before being forwarded onward. In an example, data traffic coming from network device  102  may flow into port  110  then out of a port  120  to IPS  116 . Data traffic may then flow from IPS  116  back to network tap  106  via a port  122  before being sent onward along path  114  to network device  104 . Similarly, data traffic coming from port  104  may also be flowing though IPS  116  (path includes port  112 -port  122 -IPS  116 -port  120 -port  110 ). 
         [0009]    However, malfunction may also occur resulting in the network being unprotected. To ensure that IPS  116  is able to receive and transmit the data traffic, a diagnostic test may be performed to determine the condition of IPS  116 . The diagnostic test includes inserting a unique data packet, known as a heartbeat packet, into the network data traffic flowing to IPS  116 . IPS  116  is considered to be working properly if the heartbeat packet is received by IPS  116  and sent back to network tap  106  within a predefined period. 
         [0010]    Consider the situation wherein, for example, a diagnostic test is being performed to determine the condition of IPS  116 . In a typical diagnostic test, the user may define two parameters. The first parameter may be the time interval (e.g., every one second) for sending a heartbeat packet. The second parameter may be the set of fail conditions. In an example, the diagnostic test may be considered to have failed if network tap  106  fails to receive back from IPS  116  three consecutive heartbeat packets. Both of these parameters may be user-configurable and may vary depending upon the network condition and/or network hardware. 
         [0011]    To facilitate the discussion,  FIG. 1A  will be discussed in relation to  FIG. 1B , which shows a simple flow chart illustrating a method for performing a diagnostic test. 
         [0012]    Before executing the diagnostic test, a counter may be initialized to zero (step  152 ). 
         [0013]    At a next step  154 , a heartbeat packet may be inserted into the data traffic and sent from a network tap  106  to an IPS  116  via a port  120 . 
         [0014]    At a next step  156 , the counter may be increased by one. The counter may be increased by one each time a heartbeat packet is sent and the counter may be reset to zero each time the heartbeat packet is received back from IPS  116 . In other word, if the heart beat packet is sent back to network tap  106  via a port  122 , the counter may be reset to zero. 
         [0015]    At a next step  158 , the system of network tap  106  performs a parameter check. A parameter check may include checking to see if the predefined time interval has passed. If the time interval has passed, another heartbeat packet may be sent. Another parameter check may include determining if the one of the fail conditions has been met. In this example, one of the fail conditions is three consecutive heartbeat packets not being received back by network tap  106 . 
         [0016]    At a next step  160 , the system makes a determination if a fail condition exists. If a fail condition does not exist, the system returns to step  154  to continue the diagnostic test. However, if a fail condition exists, network tap  106  is switched from a normal mode to a bypass mode and the data traffic is rerouted (step  162 ). In other words, data traffic is no longer routed through IPS  116 . 
         [0017]    Although the single heartbeat diagnostic test may provide a method for identify a condition in which the data traffic may not be properly protected, other conditions may exist that may not be identified through the single heartbeat diagnostic test. Thus, companies continue to seek additional measures to ensure reliable operation, fault detection, and/or timely mitigation of potentially malicious activities. 
     
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
         [0018]    The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which: 
           [0019]      FIG. 1A  shows a simple diagram of a network environment with an intrusion prevention system. 
           [0020]      FIG. 1B  shows a simple flow chart illustrating a method for performing a diagnostic test. 
           [0021]      FIG. 2  shows, in an embodiment of the invention a simple block diagram of a secured network environment. 
           [0022]      FIG. 3A  shows, in an embodiment of the invention, a simple logic block diagram of a sequential heartbeat diagnostic test. 
           [0023]      FIG. 3B  shows, in an embodiment of the invention, examples of diagnostic test conditions. 
           [0024]      FIG. 3C  shows, in an embodiment of the invention, examples of different flow path at different time periods. 
           [0025]      FIG. 4  shows, in an embodiment of the invention, examples of different failure conditions that may be established to determine when an IPS is not functioning properly. 
           [0026]      FIG. 5  shows, in an embodiment of the invention, a simple flow chart illustrating a method for implementing a sequential heartbeat diagnostic test. 
       
    
    
     DETAILED DESCRIPTION OF EMBODIMENTS 
       [0027]    The present invention will now be described in detail with reference to a few embodiments thereof as illustrated in the accompanying drawings. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without some or all of these specific details. In other instances, well known process steps and/or structures have not been described in detail in order to not unnecessarily obscure the present invention. 
         [0028]    Various embodiments are described hereinbelow, including methods and techniques. It should be kept in mind that the invention might also cover articles of manufacture that includes a computer readable medium on which computer-readable instructions for carrying out embodiments of the inventive technique are stored. The computer readable medium may include, for example, semiconductor, magnetic, opto-magnetic, optical, or other forms of computer readable medium for storing computer readable code. Further, the invention may also cover apparatuses for practicing embodiments of the invention. Such apparatus may include circuits, dedicated and/or programmable, to carry out tasks pertaining to embodiments of the invention. Examples of such apparatus include a general-purpose computer and/or a dedicated computing device when appropriately programmed and may include a combination of a computer/computing device and dedicated/programmable circuits adapted for the various tasks pertaining to embodiments of the invention. 
         [0029]    The invention is described with reference to specific architectures and protocols. Those skilled in the art will recognize that the description is for illustration and to provide examples of different mode of practicing the invention. The description is not meant to be limiting. For example, reference is made to network traffic and packets, while other forms of data and addresses can be used in the invention. Likewise, reference is made to monitoring/security systems, but the invention may be applied toward other components that may benefit from fault detection. The invention is applicable to both wire and optical technologies. In addition, even though the invention may be described using an inline tap example, the invention is not limited to an inline device and may include programmable logic for performing inline and/or span functions. 
         [0030]    In accordance with embodiments of the present invention, a sequential heartbeat arrangement and methods are provided for implementing fault detection. Embodiments of the invention include methods for simulating a communication session between a network tap and a monitoring system (such as an intrusion prevention system, an intrusion detection system, a firewall, a packet sniffer, and the like). Embodiments of the invention also include methods for testing operation condition of the monitoring system. 
         [0031]    In an embodiment of the invention, methods are provided for determining the condition of a monitoring system (such as an intrusion prevention system, an intrusion detection system, a firewall, a packet sniffer, and the like). In the prior art, a diagnostic test includes the transmission of a single heartbeat packet that is configured to test the condition of the path between the network tap and the monitoring system. In an embodiment of the invention, a sequential heartbeat diagnostic test is provided for identifying conditions that may cause a component, such as the monitoring system, to be faulty. 
         [0032]    Unlike the prior art, a sequential heartbeat diagnostic test is configured to send one or more sets of sequential heartbeat packets to determine the state of a monitoring system. Each set of sequential heartbeat packets may be configured to test different conditions/operation/state of a monitoring system. In an example, a sequential heartbeat diagnostic test may include three set of sequential heartbeat packets with the first set of sequential heartbeat packets being configured to test the TCP (transmission control protocol) session, the second set of sequential heartbeat packets being configured to test the first security policy of a monitoring system, and the third set of sequential heartbeat packets being configured to test the second security policy of the monitoring system. As can be appreciated from the foregoing, the number of heartbeat packets and the number of set of sequential heartbeat packets being sent in a sequential heartbeat diagnostic test may vary depending upon the conditions being tested. 
         [0033]    In an embodiment of the invention, a counter may be associated with each diagnostic test condition. Each counter may be independent of one another and may be defined by different counter rules. In an example, one counter rule may require a counter to be increased and decreased by one increment each time a heartbeat packet is sent and received, respectively. In another example, another counter rule may require a counter to be increased by one and reset to zero each time a heartbeat packet is sent and received, respectively. 
         [0034]    With a sequential heartbeat diagnostic test, an algorithm may be provided to simulate real world conditions in order to determine the true state of a monitoring system. Given the flexibility of the sequential heartbeat diagnostic test, a company can configure the diagnostic test to specifically test the conditions that have the most impact on its network. 
         [0035]    The features and advantages of the present invention may be better understood with reference to the figures and discussions that follow. 
         [0036]      FIG. 2  shows, in an embodiment of the invention a simple block diagram of a secured network environment. The network may include a plurality of network devices (including network devices  202  and  204 ). These network devices may include, but are not limited to switches, routers, server computers, client computers, and so forth. A network tap  206  may be disposed in-line between the two network devices and may be configured to communicate bi-directionally with each of the network devices. Network tap  206  may also be coupled to a monitoring system, such as an IPS  208 . 
         [0037]    To ensure the network integrity, a sequential heartbeat diagnostic test may be executed. In an embodiment, network tap  206  may include a logic component, such as a field-programmable gate array (FPGA)  210 , which may execute a sequential heartbeat diagnostic test. In an embodiment, FPGA  210  may include a sequential heartbeat packet generator  212  for generating and inserting a set of heartbeat packets into the network data traffic flowing to the monitoring system (IPS  208 ). FPGA  210 , in an embodiment, may also include a sequential heartbeat packet detector  214 , which may be configured to identify and remove the set of heartbeat packets from the data traffic when the set of heartbeat packets returns from the monitoring system (IPS  208 ). 
         [0038]    In an embodiment, FPGA  210  may also include a set of counters  216 . Each counter may be associated with a diagnostic test condition. As discussed herein, a diagnostic test condition refers to a test condition associated with the monitoring system that may be tested through a heartbeat packet. 
         [0039]    In an embodiment, FPGA  210  may also include a switch  218 . Switch  218  may be employed to switch network tap  206  from a normal mode (a mode in which the data traffic is being protected by a monitoring system) to a bypass mode (a mode in which the data traffic is being routed through a path that is not secured). 
         [0040]    In an embodiment the FPGA  210  may be user configurable, thereby enabling the parameters associated with a sequential heartbeat diagnostic test to be tailored. In an example, the user may define the time interval for generating and sending a set of heartbeat packets. In another example, the user may define the fault conditions. 
         [0041]    In an embodiment, FPGA  210  may be managed from a number of device structures via several managing device interfaces. For example, the sequential heartbeat diagnostic test may be configured over a command line interface, a web based device, system interface (such as an SNMP interface) and the like. Each of these interfaces may provide local as well as remote control of the network tap. Communication protocols for these interfaces are generally well-known in the art and may be utilized without limitation and without departing from the present invention. 
         [0042]      FIG. 3A  shows, in an embodiment of the invention, a simple logic block diagram of a sequential heartbeat diagnostic test. Consider the situation wherein, for example, data traffic flowing between two network devices ( 202  and  204 , for example) may be directed through a secured network environment. In an example, data traffic may be flowing out or port  302  through an inline monitoring system (such as IPS  208 ) back through port  306  before being transmitted onward. 
         [0043]    To determine the condition of the inline monitoring system, a sequential heartbeat diagnostic test may be executed. Unlike the prior art, the sequential heartbeat diagnostic test is not designed merely to test the data path between network tap  206  and IPS  208 . Instead, the sequential heartbeat diagnostic test may be configured to simulate different real world conditions that data traffic may experience flowing through a secured network environment. 
         [0044]    Consider the situation wherein, for example, a sequential diagnostic test is configured to test three real-world conditions (as shown in  FIG. 38 ): simulate TCP session between the network tap and IPS  208  (condition  350 ), simulate condition for a first security policy (condition  352 ), and simulate condition for a second security policy (condition  354 ). To perform the test, sequential heartbeat packet generator  212  may generate sets of sequential heartbeat packets (HB  310 , HB  312 , and FIB  314 ) and may insert the sets of sequential heartbeat packets into the network data traffic flowing to IPS  208 . As mentioned above, the number of heartbeat packets and the number of set of sequential heartbeat packets being sent in a sequential heartbeat diagnostic test may vary depending upon the conditions being tested. For example, each set of sequential heartbeat packets may be configured to test different conditions/operation/state of the monitoring system. In an example, HB  310  may be configured to simulate a TCP session, HB  312  may be configured to simulate a first security policy while FIB  314  may be configured to simulate a second security policy. 
         [0045]    In an embodiment, more than one sequential heartbeat diagnostic test may be performed. In an example, the diagnostic test conditions for data traffic flowing from port  302  to port  306  (path  330 ) may differ from the diagnostic test conditions for data traffic flowing in the reverse direction (path  332 ). For example, data traffic flowing from port  302  to port  306  may relate to data being uploaded to the company&#39;s intranet while data traffic flowing from port  306  to port  302  may relate to data being downloaded from the company&#39;s intranet. As a result, the diagnostic test condition for path  330  may focus on preventing malware attack while diagnostic test condition for path  332  may focus on preventing information leak. Accordingly, the sequential heartbeat diagnostic test may be configured to best fit the monitoring system being tested. 
         [0046]    In an embodiment, the time interval between transmitting a set of sequential heartbeat packets may vary depending upon each diagnostic test condition. In an example, each diagnostic test condition for path  330  may require a set of sequential heartbeat packets to be sent every one second. In another example, each diagnostic test condition for path  332  may require a set of sequential heartbeat packets to be sent at different intervals. For example, condition  380  (simulating a TCP session) may require a set of sequential heartbeat packets to be sent every one second while the condition  382  and condition  384  (simulating the third security policy and fourth security policy, respectively) may require a set of sequential heartbeat packets to be sent every two seconds. 
         [0047]    To illustrate,  FIG. 3C  shows two different flow paths at different time intervals. At t 0 , three set of sequential heartbeat packets (FIB  310 , FIB  312 , and HB  314 ) are sent along path  330  and three set of sequential heartbeat packets (HB  320 , HB  322 , and HB  324 ) are sent along path  332 . One second later, at t 1 , no heartbeat packets are being sent along path  332  while three set of sequential heartbeat packets continue to be sent along path  330 . However, at t 2 , both paths ( 330  and  332 ) are transmitting three set of sequential heartbeat packets each. Accordingly, the number of set of sequential heartbeat packets being transmitted may vary depending upon the time parameter that may have been defined by a user. 
         [0048]    In an embodiment of the invention, a counter may be associated with each diagnostic test condition. In an example, counter  360  is associated with condition  350 , counter  362  is associated with condition  352 , and counter  364  is associated with condition  354 . In an embodiment, each counter may be defined by different rules. In an example, counter  362  may be configured to increase by one when sequential heartbeat packet generator  212  generates a set of sequential heartbeat packets and inserts the set of sequential heartbeat packets into the network data traffic being sent to IPS  208 . Also counter  362  is configured to be decreased by one when sequential heartbeat packet detector  214  detects the incoming set of sequential heartbeat packets (counter rule  392 ). In another example, counter  360  may be configured to increase by one when a set of sequential heartbeat packets is sent and may be reset to zero when the set of sequential heartbeat packets is received back by the network tap (counter rule  390 ). 
         [0049]    As can be appreciated from the foregoing, the sequential heartbeat diagnostic test can become a complex test that may be employed to test different real-world conditions that may be faced by a company.  FIG. 4  shows, in an embodiment of the invention, examples of different failure conditions that may be established to determine when a monitoring system (such as IPS  208 ) is not functioning properly. In an example, a failure condition may exist if the number of set of sequential heartbeat packets sent that are associated with one counter is greater than a predefined threshold (failure condition  402 ). For example, three set of consecutive sequential heartbeat packets have been sent for condition  350 ; however, no set of sequential heartbeat packets has been transmitted back to sequential heartbeat packet detector. In another example, a failure condition may exist if the total number of sets of sequential heartbeat packets for all counters is above a predefined threshold (failure condition  404 ). For example, if the number of set of sequential heartbeat packets is greater then six than a failure condition exists. 
         [0050]    In an embodiment, an event is triggered when a failure condition exists. The event that is associated with a failure condition may vary. In an example, if failure condition  402  exists, the network tap may be switched from a normal mode to a bypass mode and a warning may be sent to the operator (event  450 ). In another example, if failure condition  404  exists, the network tap may be switched to a bypass mode and notification may be sent to the operator and the administrator (event  452 ). Accordingly, the type of event that is triggered, as can be appreciated from the foregoing, may depend upon the severity of the failure condition. 
         [0051]      FIG. 5  shows, in an embodiment of the invention, a flow chart illustrating a method for implementing a sequential heartbeat diagnostic test. 
         [0052]    At a first step  502 , a set of counters may be initialized to zero. As aforementioned, the number of counters may depend upon the number of diagnostic test conditions. In this example, assume that conditions  350 ,  352 , and  354  are being tested for path  330  and conditions  380 ,  382 , and  384  are being tested for path  332 . 
         [0053]    At a next step  504 , a plurality of a set of sequential heartbeat packet may be inserted into the data traffic and may be sent to IPS  208 . In an embodiment, the sequential heartbeat diagnostic test is a dual test. In other words, a diagnostic test may be performed along path  330  and path  332 . In this example, at t 0 , a set of sequential heartbeat packets is sent for each diagnostic test condition. For example, FIB  310 , HB  312 , and HB  314  are being transmitted along path  330  while HB  320 , HB  322 , and HB  324  are being transmitted along path  332 . 
         [0054]    At a next step  506 , the counter associate with each diagnostic test condition may be incremented by one. In an example, each of the counter (counters  360 ,  362 ,  364 ,  366 ,  368 , and  370 ) may be set to one. 
         [0055]    At a next step  508 , the system may perform a time interval check. If a predefined time interval has passed, another set of sequential heartbeat packets may be sent. In an example, one second has passed. As a result, another set of sequential heartbeat packets is sent for conditions  350 - 354  but no set of sequential heartbeat packets may be sent for conditions  380 ,  382  and  384 . 
         [0056]    At a next step  510 , the system makes a determination if a failure condition exists. As can be seen from  FIG. 4 , the number of failure conditions may vary depending upon a user&#39;s configuration. In an example, a financial firm may have more stringent failure conditions than a community network since more sensitive data may be flowing through the financial network. 
         [0057]    If a fail condition does not exist, the system returns to step  504  to continue the sequential heartbeat diagnostic test. However, if a fail condition exists, the system may trigger one or more events, at a next step  512 . In an example, the network tap may switch from a normal mode to a bypass mode. In another example, notification may be sent to the operator/administrator. The event(s) that may be triggered may depend upon the severity of the failure condition and may be defined by the user. 
         [0058]    Steps  508  and  510  are not sequential. In other words, step  508  does not have to occur before step  510  can be executed. 
         [0059]    Even if the network tap is in a bypass mode (state  514 ), set of sequential heartbeat packets may continue to be sent (step  516 ) by the network tap, in an embodiment. Once the monitoring system (such as IPS  208 ) is connected back to the network tap, the network tap is switched back to a normal state when the failure condition is no longer valid. 
         [0060]    In this document, various implementations may be discussed using an intrusion prevention system, as an example. This invention, however, is not limited to an intrusion prevention system and may include any monitoring and/or security arrangement (e.g., firewall, an intrusion detection system, and the like). Instead, the discussions are meant as examples and the invention is not limited by the examples presented. 
         [0061]    Further, in this document, various implementations may be discussed using a network tap, as an example. This invention, however, is not limited to a network tap and may include any network device (e.g., director device, router, switches, iBypass high density device, and the like). Instead, the discussions are meant as examples and the invention is not limited by the examples presented. 
         [0062]    As can be appreciated from the foregoing, a sequential heartbeat arrangement and methods thereof are provided for determining the status of an inline monitoring system. By executing a sequential heartbeat diagnostic test, real-world condition simulations may be performed to better analyze the true state of the monitoring system. Thus, an unsecured condition may be quickly identified and preventive/maintenance measures may be implemented to minimize a firm&#39;s network exposure to external attack. 
         [0063]    While this invention has been described in terms of several preferred embodiments, there are alterations, permutations, and equivalents, which fall within the scope of this invention. Although various examples are provided herein, it is intended that these examples be illustrative and not limiting with respect to the invention. 
         [0064]    Also, the title and summary are provided herein for convenience and should not be used to construe the scope of the claims herein. Further, the abstract is written in a highly abbreviated form and is provided herein for convenience and thus should not be employed to construe or limit the overall invention, which is expressed in the claims. If the term “set” is employed herein, such term is intended to have its commonly understood mathematical meaning to cover zero, one, or more than one member. It should also be noted that there are many alternative ways of implementing the methods and apparatuses of the present invention. It is therefore intended that the following appended claims be interpreted as including all such alterations, permutations, and equivalents as fall within the true spirit and scope of the present invention.