Apparatus, system, and method for self-regulating sampling domains within network devices

A disclosed method may include (1) sampling, by way of at least one CPU on a network device, packets traversing a network in connection with at least one communication session that involves computing devices, (2) calculating a total number of packets sampled by way of the CPU over a certain period of time, (3) identifying a sampling threshold that represents a target number of packets to be sampled by way of the CPU over the certain period of time, (4) determining that the total number of packets sampled over the certain period of time exceeds the sampling threshold, and in response to determining that the total number of packets sampled exceeds the sampling threshold, (5) decreasing a sampling rate at which the CPU is to sample subsequent packets traversing the network in connection with the communication session. Various other systems and methods are also disclosed.

BACKGROUND

Network devices (such as routers and switches) are often used to forward traffic within a network and/or across networks. These network devices may represent and/or form the infrastructure of such networks. Network administrators and/or the network devices themselves may be interested in analyzing the traffic passing through the network for various reasons. For example, network devices may perform traffic analyses to gain insight into the types and/or amounts of traffic that they handle. Additionally or alternatively, these network devices may perform such traffic analyses to evaluate network utilization, the contents of packets included in the traffic, the upload and/or download speeds of the traffic, and/or the origins and/or destinations of the traffic.

Unfortunately, these traffic analyses may consume significant computing power and/or resources. As a result, such traffic analyses may, if not properly regulated, impair the performance and/or behavior of the network devices handling the traffic. For example, in some traditional contexts, network devices may carry out much of the traffic analyses by way of their Central Processing Units (CPUs). As part of these traffic analyses, the network devices may sample a certain ratio of packets. If the sampling rate is too high, the network devices may be dedicating too much CPU usage to the traffic analyses, thereby reducing the network devices' ability to handle, direct, and/or forward traffic at peak performance levels. The instant disclosure, therefore, identifies and addresses a need for additional and improved apparatuses, systems, and methods for self-regulating sampling domains within network devices.

SUMMARY

As will be described in greater detail below, the instant disclosure generally relates to apparatuses, systems, and methods for self-regulating sampling domains within network devices. In one example, a method for accomplishing such a task may include (1) sampling, by way of at least one CPU on a network device a set of packets traversing a network in connection with at least one communication session that involves a plurality of computing devices, (2) calculating a total number of the packets sampled by way of the CPU over a certain period of time, (3) identifying a sampling threshold that represents a target number of packets to be sampled by way of the CPU over the certain period of time, (4) determining that the total number of packets sampled over the certain period of time exceeds the sampling threshold, and then in response to determining that the total number of packets sampled exceeds the sampling threshold, (5) decreasing a sampling rate at which the CPU is to sample subsequent packets traversing the network in connection with the communication session that involves the plurality of computing devices.

Similarly, a system that implements the above-identified method may include a CPU configured to execute various modules stored in memory on a network device. In one example, this system may include and/or execute (1) a sampling module that samples, by way of the CPU on the network device, a set of packets traversing a network in connection with at least one communication session that involves a plurality of computing devices, (2) a calculating module that calculates a total number of the packets sampled by way of the CPU over a certain period of time, (3) a threshold module that (A) identifies a sampling threshold that represents a target number of packets to be sampled by way of the CPU over the certain period of time and (B) determines that the total number of packets sampled over the certain period of time exceeds the sampling threshold, and (4) a rate module that decreases a sampling rate at which the CPU is to sample subsequent packets traversing the network in connection with the communication session in response to the determination that the total number of packets sampled exceeds the sampling threshold.

Additionally or alternatively, an apparatus that implements the above-identified method may include at least one physical CPU that is communicatively coupled to at least one physical network interface. In one example, this physical CPU may (1) sample a set of packets traversing the network in connection with the communication session that involves the plurality of computing devices, (2) calculate a total number of the packets sampled over a certain period of time, (3) identify a sampling threshold that represents a target number of packets to be sampled over the certain period of time, (4) determine that the total number of packets sampled over the certain period of time exceeds the sampling threshold, and then (5) decrease a sampling rate at which the CPU is to sample subsequent packets traversing the network in connection with the communication session in response to the determination that the total number of packets sampled exceeds the sampling threshold.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

The present disclosure describes various systems and methods for self-regulating sampling domains within network devices. As will be explained in greater detail below, embodiments of the instant disclosure may facilitate the regular and/or ongoing sampling of traffic handled by network devices. In particular, embodiments of the instant disclosure may involve setting and/or configuring a sampling threshold that serves as a target number and/or ratio of packets to be sampled by way of a network device's CPU over a certain period of time. After having sampled a set of packets over that period of time, these embodiments may involve calculating the total number of packets sampled by the CPU.

In the event that the number of sampled packets is above the sampling threshold, these embodiments may involve decreasing the sampling rate at which the CPU is to sample such packets in the future. Conversely, in the event that the number of sampled packets is below the sampling threshold, these embodiments may involve increasing the sampling rate at which the CPU is to sample such packets in the future. By doing so, these embodiments may stabilize CPU usage in connection with the processing and/or sampling application, provide reasonably accurate statistics about the volume of traffic traversing different sampling domains within the network device, and/or regulating the sampling rates of different sampling domains to a certain target and/or goal.

The following will provide, with reference toFIGS. 1, 2, and 4, detailed descriptions of exemplary apparatuses, systems, and corresponding implementations for self-regulating sampling domains within network devices. Detailed descriptions of corresponding computer-implemented methods will be provided in connection withFIG. 3. Detailed descriptions of exemplary sampling thresholds and sampling results will be provided in connection withFIGS. 5 and 6. In addition, detailed descriptions of an exemplary computing system for carrying out these methods will be provided in connection withFIG. 7.

FIG. 1shows an exemplary system100that facilitates self-regulating sampling domains within network domains. As illustrated inFIG. 1, system100may include one or more modules102for performing one or more tasks. As will be explained in greater detail below, modules102may include a sampling module104, a calculating module106, a threshold module108, and a rate module110. Although illustrated as separate elements, one or more of modules102inFIG. 1may represent portions of a single module or application (such as an operating system, a processing application, and/or a sampling application) running on a CPU, a routing engine, a field-replaceable unit, a packet forwarding engine, and/or any other suitable component within a network device.

As illustrated inFIG. 1, exemplary system100may further include one or more databases, such as a database120. In some examples, database120may store and/or maintain a sampling threshold122. In these examples, sampling threshold122may correspond to and/or represent a target number of packets to be sampled by way of physical processor130and/or a CPU over a certain period of time. In one example sampling threshold122may be formatted and/or represented as a fixed number. Additionally or alternatively, sampling threshold122may be formatted and/or represented as a 1-to-N ratio in which one packet is sampled for every N packets handled by the network device in connection with the communication session that involves the plurality of computing devices.

As illustrated inFIG. 1, exemplary system100may additionally include one or more sampling points, such as sampling points124(1)-(N). The term “sampling point,” as used herein, generally refers to any type or form of interface, component, and/or device at which packets traversing a network device are intercepted and/or sampled. In some examples, sampling points124(1)-(N) may correspond to and/or represent a physical interface at which packets are selected and/or intercepted from a communication session between computing devices within a network. In such examples, upon selecting and/or intercepting those packets, sampling points124(1)-(N) may forward and/or pass the same to physical processor130and/or a CPU for processing, computation, and/or analysis. Examples of sampling points124(1)-(N) include, without limitation, packet forwarding engines, routing engines, Physical Interface Cards (PICs), Flexible PIC Concentrators (FPCs), Switch Interface Boards (SIBs), control boards, communication ports, fan trays, connector interface panels, line cards, egress interfaces, ingress interfaces, portions of one or more of the same, combinations or variations of one or more of the same, and/or any other suitable sampling points.

Exemplary system100inFIG. 1may be implemented in a variety of ways. For example, all or a portion of exemplary system100may represent portions of exemplary system200inFIG. 2. As shown inFIG. 2, system200may include a network device208in communication with a computing device202and/or a computing device206via a network204. In one example, network204may include and/or incorporate a network device208. Network device208may also include and/or incorporate memory140and a CPU230. In this example, CPU230may execute one or more of modules102stored in memory140for the purpose of self-regulating sampling domains within network devices. In addition, network device208may include and/or provide sampling points124(1)-(N).

For example, and as will be described in greater detail below, one or more of modules102may cause network device208to (1) sample a set of packets traversing the network in connection with the communication session that involves the plurality of computing devices, (2) calculate a total number of the packets sampled over a certain period of time, (3) identify a sampling threshold that represents a target number of packets to be sampled over the certain period of time, (4) determine that the total number of packets sampled over the certain period of time exceeds the sampling threshold, and then (5) decrease a sampling rate at which the CPU is to sample subsequent packets traversing the network in connection with the communication session in response to the determination that the total number of packets sampled exceeds the sampling threshold.

Network device208generally represent any type or form of physical computing device capable of reading computer-executable instructions and/or handling network traffic. In one example, network device208may include and/or represent a router (such as a provider edge router, hub router, spoke router, autonomous system boundary router, and/or area border router) that receives, routes, forwards, and/or otherwise handles network traffic. Additional examples of network device208include, without limitation, switches, hubs, modems, bridges, repeaters, gateways multiplexers, network adapters, network interfaces, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems wearable devices, gaming consoles, variations or combinations of one or more of the same, and/or any other suitable network devices. An apparatus for self-regulating sampling domains within network devices may include and/or represent all or a portion of network device208.

Network204generally represents any medium or architecture capable of facilitating communication or data transfer. In one example, network204may facilitate communication between network device208and computing device202and/or computing device206. In this example, network204may facilitate communication or data transfer using wireless and/or wired connections. Examples of network204include, without limitation, an intranet, a Wide Area Network (WAN), a Local Area Network (LAN), a Personal Area Network (PAN), the Internet, Power Line Communications (PLC), a cellular network (e.g., a Global System for Mobile Communications (GSM) network), portions of one or more of the same, variations or combinations of one or more of the same, and/or any other suitable network. Although illustrated as being external to network204inFIG. 2, computing devices202and206may each represent a portion of network204and/or be included in network204.

Computing devices202and206generally represents any type or form of computing device capable of reading computer-executable instructions. In one example, computing devices202and206may include and/or represent client devices involved and/or engaged in a communication session with one another. In another example, computing devices202and206may include and/or represent a network device (such as a router and/or switch) that handles and/or forwards traffic within a network and/or across networks. Additional examples of computing devices202and206include, without limitation, end-point devices, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, wearable devices (e.g., smart watches, smart glasses, etc.), gaming consoles, variations or combinations of one or more of the same, and/or any other suitable computing device.

FIG. 3is a flow diagram of an exemplary computer-implemented method300for self-regulating sampling domains within network devices. The steps shown inFIG. 3may be performed by any suitable computer-executable code and/or computing system, including system100inFIG. 1, system200inFIG. 2, system700inFIG. 7, and/or variations or combinations of one or more of the same. In one example, each of the steps shown inFIG. 3may represent an algorithm whose structure includes and/or is represented by multiple sub-steps, examples of which will be provided in greater detail below.

As illustrated inFIG. 3, at step310one or more of the systems described herein may sample, by way of at least one CPU on a network device, a set of packets traversing a network in connection with at least one communication session that involves a plurality of computing devices. For example, sampling module104may, as part of network device208inFIG. 2, sample packets224(1)-(N) inFIG. 2as they traverse network204in connection with at least one communication session that involves computing devices202and206. In one example, network device208may perform and/or execute the sampling of such packets by way of and/or via CPU230.

The systems described herein may perform step310in a variety of ways and/or contexts. In some examples, sampling module104may intercept and/or collect packets224(1)-(N) at sampling points124(1)-(N) within network device208. For example, sampling module104may identify a sampling rate set for and/or applied to the packets traversing through sampling points124(1)-(N) as part of the communication session involving computing devices202and206. In one example, the sampling rate may be formatted and/or represented as a 1-to-N ratio in which one packet is sampled for every N packets passing through sampling points124(1)-(N) in connection with the communication session. Sampling module104may select 1 packet out of every N packets that pass through one or more of sampling points124(1)-(N) and then flag that packet for processing and/or inspection.

In some examples, sampling module104may direct and/or cause the selected and/or sampled packets to undergo processing and/or inspection at sampling points124(1)-(N). Additionally or alternatively, sampling module104may direct and/or cause the selected and/or sampled packets to undergo processing and/or inspection at a centralized and/or management component (e.g., physical processor130and/or CPU230) within network device208.

In other words, the sampling may involve an interception phase and/or a processing phase. The interception phase may be performed and/or executed by and/or at sampling points124(1)-(N). In one example, the processing phase may, like the interception phase, be performed and/or executed by and/or at sampling points124(1)-(N). Additionally or alternatively, the processing phase may, unlike the interception phase, be performed and/or executed by and/or at a CPU that is separate from sampling points124(1)-(N).

In a specific example, the sampling rate may be configured as a 1-to-1,000 ratio in which 1 packet is sampled at each sampling point for every 1,000 packets passing through each sampling point. In this example, sampling module104may direct and/or cause sampling point124(1) to select and/or intercept 1 packet out of every 1,000 packets passing through sampling point124(1) and then forward each selected and/or intercepted packet to CPU230for processing. Similarly, sampling module104may direct and/or cause sampling point124(N) to select and/or intercept 1 packet out of every 1,000 packets passing through sampling point124(N) and then forward each selected and/or intercepted packet to CPU230for processing.

Alternatively, rate module110may establish and/or apply different sampling rates across the various sampling points. For example, a sampling rate applied to sampling point124(1) may be configured as a 1-to-500 ratio in which 1 packet is sampled at sampling point124(1) for every 500 packets passing through sampling point124(1). In this example, a sampling rate applied to sampling point124(N) may be configured as a 1-to-2,000 ratio in which 1 packet is sampled at sampling point124(N) for every 2,000 packets passing through sampling point124(N). Accordingly, sampling module104may direct and/or cause sampling point124(1) to select and/or intercept 1 packet out of every 500 packets passing through sampling point124(1) and then forward each selected and/or intercepted packet to CPU230for processing. In contrast, sampling module104may direct and/or cause sampling point124(N) to select and/or intercept 1 packet out of every 2,000 packets passing through sampling point124(N) and then forward each selected and/or intercepted packet to CPU230for processing.

In other examples, each sampling point may include and/or implement a CPU that performs the interception phase and/or the processing phase. In these examples, sampling points124(1)-(N) may be able to perform all phases of sampling themselves without outsourcing and/or delegating certain responsibilities to other components external to sampling points124(1)-(N) within network device208.

In some examples, embodiments of the instant disclosure may be especially beneficial and/or constitute a significant improvement for network devices that do not include and/or incorporate a hardware-accelerated sampling device, such as an Application Specific Integrated Circuit (ASIC), that is dedicated to sampling packets. For example, some network devices may include and/or incorporate a hardware-accelerated sampling device that is dedicated to sampling packets. In such situations, those network devices with hardware-accelerated sampling devices may be able to achieve the desired sampling of packets without necessitating increased CPU usage by simply directing the hardware-accelerated sampling device to export the sampled packets to a collector that processes the sampled packets, stores the packets for processing, and/or maintains information about the sampled packets within a file system.

However, other network devices without any hardware-accelerated sampling devices may rely on CPUs to uplift sampled packets to an intermediary processing application that modifies the sampled packets prior to forwarding the same to the collector. This uplifting of the sampled packets to the intermediary processing application may significantly increase the CPU usage, thereby reducing the network devices' ability to handle, direct, and/or forward traffic at peak performance levels. In an effort to mitigate the impact on the network devices' performance, the various embodiments described herein may be able to regulate the sampling domains of the network devices even though CPUs are used to uplift the sampled packets to the intermediary processing application prior to arriving at the collector.

In one example, sampling module104may determine that network device208lacks a hardware-accelerated sampling device dedicated to sampling packets handled by network device208in connection with the communication session that involves computing devices202and206. In this example, sampling module104may direct and/or cause CPU230to execute and/or perform the sampling of packets224(1)-(N). Additionally or alternatively, sampling module104may direct and/or cause CPU230to export the sampled packets to the collector. In a further example, sampling module104may direct and/or cause CPU230to uplift the sampled packets to an intermediary processing application that modifies the sampled packets (by, e.g., inserting information into the sampled packets) prior to forwarding the same to the collector.

Returning toFIG. 3, at step320one or more of the systems described herein may calculate a total number of the packets sampled by way of the CPU over a certain period of time. For example, calculating module106may, as part of network device208inFIG. 2, calculate the total number of packets sampled by way of CPU230over a certain period of time. In this example, calculating module106may calculate the number of packets224(1)-(N) included in the set intercepted and/or collected at sampling points124(1)-(N). In this example, the certain period of time may amount to and/or represent any duration (e.g., 30 seconds, 60 seconds, 90 seconds, 120 seconds, etc.) that is sufficient to meaningfully demonstrate the sample size of packets224(1)-(N).

The systems described herein may perform step320in a variety of ways and/or contexts. In some examples, calculating module106may count the number of packets224(1)-(N) that have been intercepted and/or flagged for sampling. In one example, calculating module106may direct and/or cause each sampling point to maintain a running count of the number of packets sampled from that sampling point. Additionally or alternatively, calculating module106may direct and/or cause each sampling domain to maintain a running count of the number of packets sampled from that sampling domain over a certain period of time.

FIG. 4shows exemplary sampling domains430(1) and430(2). As illustrated inFIG. 4, sampling domain430(1) may include and/or represent sampling points124(1) and124(2), and sampling domain430(2) may include and/or represent sampling points124(3) and124(4). The term “sampling domain,” as used herein, generally refers to a specific grouping of multiple sampling points whose statistics and/or metrics are combined for sampling and/or regulation purposes.

As illustrated inFIG. 4, packets402,404, and406may pass through sampling point124(1) as they traverse network device208in connection with a communication session. In this example, sampling point124(1) may select and/or intercept packet404for sampling in connection with that communication session. In contrast, sampling point124(1) may refuse to select and/or intercept packets402and406, thereby allowing those packets to continue traversing network device208normally without inclusion in the sample set.

As further illustrated inFIG. 4, packets408,410and412may pass through sampling point124(2) as they traverse network device208in connection with another communication session. In this example sampling point124(2) may select and/or intercept packet410for sampling in connection with that other communication session. In contrast, sampling point124(2) may refuse to select and/or intercept packets408and412, thereby allowing those packets to continue traversing network device208normally without inclusion in the sample set.

In addition, packets414,416, and418may pass through sampling point124(3) as they traverse network device208in connection with an additional communication session. In this example, sampling point124(3) may select and/or intercept packet416for sampling in connection with that additional communication session. In contrast sampling point124(3) may refuse to select and/or intercept packets414and418, thereby allowing those packets to continue traversing network device208normally without inclusion in the sample set.

Similarly, packets420,422, and424may pass through sampling point124(4) as they traverse network device208in connection with an further communication session. In this example, sampling point124(4) may select and/or intercept packet422for sampling in connection with that further communication session. In contrast, sampling point124(4) may refuse to select and/or intercept packets420and424, thereby allowing those packets to continue traversing network device208normally without inclusion in the sample set.

Returning toFIG. 3, at step330one or more of the systems described herein may identify a sampling threshold that represents a target number of packets to be sampled by way of the CPU over the certain period of time. For example, threshold module108may, as part of network device208inFIG. 2, identify a sampling threshold122that represents a target number of packets to be sampled by way of CPU230over the certain period of time. In this example, the target number of packets may suffice for sampling purposes but also avoid unduly burdening and/or impairing the performance of CPU230. Sampling threshold122may be formatted and/or represented as a fixed number of packets.

The systems described herein may perform step330in a variety of ways and/or contexts. In some examples, threshold module108may search for and find sampling threshold122in database120. In other examples, threshold module108may compute sampling threshold122based at least in part on certain characteristics of network device208. Examples of such characteristics include, without limitation, the make and/or model of network device208, performance goals of network device208, CPU usage and/or stability metrics, requirements of the communication session between computing devices202and206, the system settings and/or configuration of network device208, combinations or variations of one or more of the same, and/or any other suitable characteristics of network device208.

In some examples, threshold module108may identify sampling threshold122by obtaining user input from an administrator responsible for network device208. In such examples, the user input may specify the target number of packets represented by sampling threshold122. As a specific example, the user input may indicate that network device208is to set sampling threshold122as 1,000 packets over the certain period of time.

In some examples, threshold module108may determine that sampling a certain number of packets would support a stable amount of CPU usage by network device208. In such examples, threshold module108may apply and/or set that number of packets as the target for CPU230and/or one or more of sampling points124(1)-(N). Accordingly, threshold module108may configure sampling threshold122to identify and/or represent that number of packets as the target in an effort to stabilize the usage of CPU230in connection with the communication session involving computing devices202and206.

Returning toFIG. 3, at step340one or more of the systems described herein may determine that the total number of packets sampled over the certain period of time exceeds the sampling threshold. For example, threshold module108may, as part of network device208inFIG. 2, determine that the total number of packets224(1)-(N) sampled over the certain period of time exceeds sampling threshold122. In one example, the total number of packets224(1)-(N) may correspond to and/or represent only those packets sampled from a single sampling point (e.g., one of sampling points124(1)-(N)). In another example, the total number of packets224(1)-(N) may correspond to and/or represent only those packets sampled from a single sampling domain (e.g., one of sampling domains430(1) and430(2)). In a further example, the total number of packets224(1)-(N) may correspond to and/or represent all the packets sampled from all the sampling points and/or domains.

The systems described herein may perform step340in a variety of ways and/or contexts. In some examples, threshold module108may compare the total number of packets224(1)-(N) to sampling threshold122. Upon completion of this comparison, threshold module108may determine that the total number of packets224(1)-(N) exceeds sampling threshold122.

As a specific example, threshold module108may identify sampling threshold122inFIG. 5. As illustrated inFIG. 5, sampling threshold122may indicate that 1,000 is the target number of packets to be sampled over a 30-second time period. In this example, threshold module108may also determine and/or access sampling results502inFIG. 5.

As illustrated inFIG. 5, sampling results502may indicate that CPU230and/or sampling points124(1)-(N) sampled a total of 2,000 packets. Sampling results502may also indicate that 500 of those packets were selected and/or intercepted at sampling point124(1) over the 30-second sample time period. Sampling results502may further indicate that 1,500 of those packets were selected and/or intercepted at sampling point124(N) over the 30-second sample time period.

In one example, sampling threshold122may represent a target average for sampling across sampling points124(1)-(N). For example, because the total number of sampled packets is 2,000 across sampling points124(1) and124(N) is 2000, the average number of packets across sampling points124(1) and124(N) is 1,000. In this example, threshold module108may compare the 1,000-packet average from sampling points124(1) and124(N) against the 1,000-packet sampling threshold. By doing so, threshold module108may determine that the number of packets collectively sampled from sampling points124(1) and124(N) satisfy the 1,000-packet sampling threshold.

In another example, sampling threshold122may represent a target number of packets sampled from each of sampling points124(1)-(N). In this example, threshold module108may compare the 500 packets selected and/or intercepted at sampling point124(1) against the 1,000-packet sampling threshold. By doing so, threshold module108may determine that sampling point124(1) sampled below and/or less than the 1,000-packet sampling threshold. However, threshold module108may also compare the 1,500 packets selected and/or intercepted at sampling point124(N) against the 1,000-packet sampling threshold. Accordingly, threshold module108may determine that sampling point124(N) sampled above and/or more than the 1,000-packet sampling threshold.

As another specific example, threshold module108may identify sampling thresholds122and622inFIG. 6. As illustrated inFIG. 6, sampling threshold122may indicate that 1,500 is the target number of packets to be sampled from sampling point124(1) over a 60-second time period, and sampling threshold622may indicate that 250 is the target number of packets to be sampled from sampling point124(N) over the 60-second time period. In this example, threshold module108may also determine and/or access sampling results602inFIG. 6.

As illustrated inFIG. 6, sampling results602may indicate that CPU230and/or sampling points124(1)-(N) sampled a total of 1,250 packets. Sampling results602may also indicate that 750 of those packets were selected and/or intercepted at sampling point124(1) over the 60-second sample time period. Sampling results602may further indicate that 500 of those packets were selected and/or intercepted at sampling point124(N) over the 60-second sample time period.

Continuing with this example, sampling threshold122may represent a target number of packets sampled from each of sampling points124(1)-(N). In this example, threshold module108may compare the 750 packets selected and/or intercepted at sampling point124(1) against the 1,500-packet sampling threshold. By doing so, threshold module108may determine that sampling point124(1) sampled below and/or less than the 1,500-packet sampling threshold. However, threshold module108may also compare the 500 packets selected and/or intercepted at sampling point124(N) against the 250-packet sampling threshold. Accordingly, threshold module108may determine that sampling point124(N) sampled above and/or more than the 250-packet sampling threshold.

Returning toFIG. 3, at step350one or more of the systems described herein may decrease a sampling rate at which the CPU is to sample subsequent packets traversing the network in connection with the communication session that involves the plurality of computing devices. For example, rate module110may as part of network device208inFIG. 2, decrease the sampling rate at which CPU230is to sample subsequent and/or future packets traversing network204in connection with the communication session involving computing device202and206. In this example, rate module110may initiate the decrease in the sampling rate in response to the determination that the total number of packets224(1)-(N) exceeds sampling threshold122.

Additionally or alternatively, rate module110may increase the sampling rate at which CPU230is to sample subsequent and/or future packets traversing network204in connection with the communication session involving computing device202and206. In this example, rate module110may initiate the increase in the sampling rate in response to the determination that the total number of packets224(1)-(N) is below sampling threshold122.

The systems described herein may perform step350in a variety of ways and/or contexts. In some examples, rate module110may direct and/or cause CPU230to decrease the sampling rate such that CPU230processes less packets for sampling purposes than before. Additionally or alternatively, rate module110may direct and/or cause one or more of sampling points124(1)-(N) to decrease the sampling rate such that those sampling points select and/or intercept less packets for sampling purposes than before.

In some examples, rate module110may direct and/or cause CPU230to increase the sampling rate such that CPU230processes more packets for sampling purposes than before. Additionally or alternatively, rate module110may direct and/or cause one or more of sampling points124(1)-(N) to increase the sampling rate such that those sampling points select and/or intercept more packets for sampling purposes than before.

As a specific example, returning toFIG. 6, rate module110may decrease the sampling rate applied to sampling point124(N) by one half. For example assuming the sampling rate applied at sampling point124(N) was initially a 1-to-1,000 ratio, rate module110may halve that sampling rate to a 1-to-2,000 ratio in an effort to decrease the number of packets sampled at sampling point124(N) from 500 to 250 over a 60-second time period, thereby preserving computing power and/or resources.

Inversely, continuing withFIG. 6, rate module110may increase the sampling rate applied to sampling point124(1) by two-fold. For example, assuming the sampling rate applied at sampling point124(1) was initially a 1-to-1,000 ratio, rate module110may double that sampling rate to a 1-to-500 ratio in an effort to increase the number of packets sampled at sampling point124(1) from 750 to 1,500 over a 60-second time period, thereby providing an larger sample size.

In some examples, to initiate an increase or decrease in the sampling rate, the differential between the number of packets sampled and the target number of packets may need to satisfy a certain threshold. For example, to initiate decreasing the sampling rate at sampling point124(N) by one half, rate module110may need to confirm that the number of packets (e.g., 500) sampled at sampling point124(1) exceeded the target number of packets (e.g., 250) by a certain amount over the 60-second time period. As another example, to initiate increasing the sampling rate at sampling point124(1) by two-fold, rate module110may need to confirm that the number of packets (e.g., 750) sampled at sampling point124(1) fell short of the target number of packets (e.g., 1,500) by a certain amount over the 60-second time period.

The sampling results may serve a variety of purposes. In some examples, the sampling results may necessitate, trigger, and/or cause one or more actions to be performed. For example, calculating module106may calculate an amount of traffic passing through sampling points124(1)-(N) based at least in part on the packets selected and/or intercepted at those sampling points. In this example, network device208and/or rate dole110may perform one or more actions in response to and/or based at least in part on the amount of traffic passing through those sampling points. Examples of such actions include, without limitation, generating records of traffic statistics, notifying administrators of the amount of traffic, changing the speed and/or rate of traffic, diverting and/or redirecting traffic, bringing up interfaces to assist with traffic, shutting down interfaces that are malfunctioning in connection with traffic, combinations or variations of one or more of the same, and/or any other suitable actions.

In some examples, threshold module108may determine that at least one of sampling points124(1)-(N) intercepted at least a portion of packets224(1)-(N) at an interception rate that exceeds sampling threshold122. In response to this determination, network device208and/or rate module110may flag and/or mark that sampling point to identify it as malfunctioning. Additionally or alternatively, network device208and/or rate module110may suspend and/or shut down the malfunctioning sampling point, thereby diverting and/or redirecting traffic to an alternative route.

In some examples, rate module110may reduce the total number of packets sampled collectively across sampling points124(1)-(N) to comply with the decreased sampling rate. In other examples, rate module110may increase the total number of packets sampled collectively across sampling points124(1)-(N) to comply with the increased sampling rate.

In one example, network device208and/or sampling module104may form sampling domain430(1) inFIG. 4to include sampling points124(1) and124(2). In this example, network device208and/or sampling module104may also form sampling domain430(2) inFIG. 4to include sampling points124(3) and124(4). Sampling module104and/or rate module110may apply one sampling rate to sampling domain430(1) and a different sampling rate to sampling domain430(2). Accordingly, sampling module104and/or rate module110may regulate the sampling rate applied to sampling domain430(1) and the different sampling rate applied to sampling domain430(2) independently of one another.

FIG. 7is a block diagram of an exemplary computing system700capable of implementing and/or being used in connection with one or more of the embodiments described and/or illustrated herein. In some embodiments, all or a portion of computing system700may perform and/or be a means for performing, either alone or in combination with other elements, one or more of the steps described in connection withFIG. 3. All or a portion of computing system700may also perform and/or be a means for performing and/or implementing any other steps, methods, or processes described and/or illustrated herein.

Computing system700broadly represents any type or form of electrical load, including a single or multi-processor computing device or system capable of executing computer-readable instructions. Examples of computing system700include, without limitation, workstations, laptops, client-side terminals, servers, distributed computing systems, mobile devices, network switches, network routers (e.g., backbone routers edge routers, core routers, mobile service routers, broadband routers, etc.), network appliances (e.g., network security appliances, network control appliances, network timing appliances, SSL VPN (Secure Sockets Layer Virtual Private Network) appliances, etc.), network controllers, gateways (e.g., service gateways, mobile packet gateways, multi-access gateways security gateways, etc.), and/or any other type or form of computing system or device.

Computing system700may be programmed, configured, and/or otherwise designed to comply with one or more networking protocols. According to certain embodiments, computing system700may be designed to work with protocols of one or more layers of the Open Systems Interconnection (OSI) reference model, such as a physical layer protocol, a link layer protocol, a network layer protocol, a transport layer protocol, a session layer protocol, a presentation layer protocol, and/or an application layer protocol. For example, computing system700may include a network device configured according to a Universal Serial Bus (USB) protocol, an Institute of Electrical and Electronics Engineers (IEEE) 1394 protocol, an Ethernet protocol, a T1 protocol, a Synchronous Optical Networking (SONET) protocol, a Synchronous Digital Hierarchy (SDH) protocol, an Integrated Services Digital Network (ISDN) protocol, an Asynchronous Transfer Mode (ATM) protocol, a Point-to-Point Protocol (PPP), a Point-to-Point Protocol over Ethernet (PPPoE), a Point-to-Point Protocol over ATM (PPPoA), a Bluetooth protocol, an IEEE 802.XX protocol, a frame relay protocol, a token ring protocol, a spanning tree protocol, and/or any other suitable protocol.

Computing system700may include various network and/or computing components. For example, computing system700may include at least one processor714and a system memory716. Processor714generally represents any type or form of processing unit capable of processing data or interpreting and executing instructions. For example, processor714may represent an application-specific integrated circuit (ASIC) a system on a chip (e.g., a network processor), a hardware accelerator, a general purpose processor, and/or any other suitable processing element.

Processor714may process data according to one or more of the networking protocols discussed above. For example, processor714may execute or implement a portion of a protocol stack, may process packets, may perform memory operations (e.g., queuing packets for later processing), may execute end-user applications, and/or may perform any other processing tasks.

System memory716generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and/or other computer-readable instructions. Examples of system memory716include, without limitation, Random Access Memory (RAM), Read Only Memory (ROM), flash memory, or any other suitable memory device. Although not required, in certain embodiments computing system700may include both a volatile memory unit (such as, for example, system memory716) and a non-volatile storage device (such as, for example, primary storage device732, as described in detail below). System memory716may be implemented as shared memory and/or distributed memory in a network device. Furthermore, system memory716may store packets and/or other information used in networking operations.

In certain embodiments, exemplary computing system700may also include one or more components or elements in addition to processor714and system memory716. For example, as illustrated inFIG. 7, computing system700may include a memory controller718, an Input/Output (I/O) controller720, and a communication interface722, each of which may be interconnected via communication infrastructure712. Communication infrastructure712generally represents any type or form of infrastructure capable of facilitating communication between one or more components of a computing device. Examples of communication infrastructure712include, without limitation, a communication bus (such as a Serial ATA (SATA), an Industry Standard Architecture (ISA), a Peripheral Component Interconnect (PCI), a PCI Express (PCIe), and/or any other suitable bus), and a network.

Memory controller718generally represents any type or form of device capable of handling memory or data or controlling communication between one or more components of computing system700. For example, in certain embodiments memory controller718may control communication between processor714, system memory716, and I/O controller720via communication infrastructure712. In some embodiments, memory controller718may include a Direct Memory Access (DMA) unit that may transfer data (e.g., packets) to or from a link adapter.

I/O controller720generally represents any type or form of device or module capable of coordinating and/or controlling the input and output functions of a computing device. For example, in certain embodiments I/O controller720may control or facilitate transfer of data between one or more elements of computing system700, such as processor714, system memory716, communication interface722, and storage interface730.

Communication interface722broadly represents any type or form of communication device or adapter capable of facilitating communication between exemplary computing system700and one or more additional devices. For example, in certain embodiments communication interface722may facilitate communication between computing system700and a private or public network including additional computing systems. Examples of communication interface722include, without limitation, a link adapter, a wired network interface (such as a network interface card), a wireless network interface (such as a wireless network interface card), and any other suitable interface. In at least one embodiment, communication interface722may provide a direct connection to a remote server via a direct link to a network, such as the Internet. Communication interface722may also indirectly provide such a connection through, for example, a local area network (such as an Ethernet network), a personal area network, a wide area network, a private network (e.g., a virtual private network), a telephone or cable network, a cellular telephone connection, a satellite data connection, or any other suitable connection.

In certain embodiments, communication interface722may also represent a host adapter configured to facilitate communication between computing system700and one or more additional network or storage devices via an external bus or communications channel. Examples of host adapters include, without limitation, Small Computer System Interface (SCSI) host adapters, Universal Serial Bus (USB) host adapters, IEEE 1394 host adapters, Advanced Technology Attachment (ATA), Parallel ATA (PATA), Serial ATA (SATA), and External SATA (eSATA) host adapters, Fibre Channel interface adapters, Ethernet adapters, or the like. Communication interface722may also enable computing system700to engage in distributed or remote computing. For example, communication interface722may receive instructions from a remote device or send instructions to a remote device for execution.

As illustrated inFIG. 7, exemplary computing system700may also include a primary storage device732and/or a backup storage device734coupled to communication infrastructure712via a storage interface730. Storage devices732and734generally represent any type or form of storage device or medium capable of storing data and/or other computer-readable instructions. For example, storage devices732and734may represent a magnetic disk drive (e.g., a so-called hard drive), a solid state drive, a floppy disk drive, a magnetic tape drive, an optical disk drive, a flash drive, or the like. Storage interface730generally represents any type or form of interface or device for transferring data between storage devices732and734and other components of computing system700.

In certain embodiments, storage devices732and734may be configured to read from and/or write to a removable storage unit configured to store computer software, data, or other computer-readable information. Examples of suitable removable storage units include, without limitation, a floppy disk, a magnetic tape, an optical disk, a flash memory device, or the like. Storage devices732and734may also include other similar structures or devices for allowing computer software, data, or other computer-readable instructions to be loaded into computing system700. For example, storage devices732and734may be configured to read and write software, data, or other computer-readable information. Storage devices732and734may be a part of computing system700or may be separate devices accessed through other interface systems.

In some examples, all or a portion of system100inFIG. 1may represent portions of a cloud-computing or network-based environment. Cloud-computing and network-based environments may provide various services and applications via the Internet. These cloud-computing and network-based services (e.g., software as a service, platform as a service, infrastructure as a service, etc.) may be accessible through a web browser or other remote interface. Various functions described herein may also provide network switching capabilities, gateway access capabilities, network security functions, content caching and delivery services for a network, network control services, and/or and other networking functionality.