Abstract:
A method is disclosed. The method includes capturing a first packet at a network monitoring card, capturing the first packet at a first filter, generating a first tag corresponding to the first filter and storing the first packet in memory with the first tag.

Description:
BACKGROUND 
       [0001]    This invention relates to network test and measurement, and more particularly to an apparatus and method for tagging packets in network traffic. 
         [0002]    In operation and maintenance of networks, determination of where issues or problem points arise can be complex. Thus, a test instrument/analyzer may be implemented for such determinations. Such an instrument typically includes one or more network interfaces that capture packets from a network and forward the packets to a processor for analysis. 
         [0003]    During the analysis process different types of packets are decoded in order to find the desired information needed for testing. However, finding the information may be difficult because data may vary widely within each packet. Subsequently, a determination is to be made as to where the packet is to be transmitted (e.g., what subsequent processing step (capture, analyze, discard, etc.) is to next be performed on the packet). The above-described transactions are typically performed using software executed on the host processor. Having to perform such transactions via software negatively impacts the performance of the host processor. 
       SUMMARY 
       [0004]    In one embodiment, a method is disclosed. The method includes capturing a first packet at a network monitoring card, capturing the first packet at a first filter, generating a first tag corresponding to the first filter and storing the first packet in memory with the first tag. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0005]    A better understanding of the present invention can be obtained from the following detailed description in conjunction with the following drawings, in which: 
           [0006]      FIG. 1  is a block diagram of one embodiment of a network with a test instrument installed thereon; 
           [0007]      FIG. 2  is a block diagram of one embodiment of a test instrument; 
           [0008]      FIG. 3  is a block diagram of one embodiment of a network monitoring card; and 
           [0009]      FIG. 4  is a flow diagram illustrating one embodiment of a packet tagging process. 
       
    
    
     DETAILED DESCRIPTION 
       [0010]    A packet tagging mechanism is disclosed. In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without some of these specific details. In other instances, well-known structures and devices are shown in block diagram form to avoid obscuring the underlying principles of the present invention. 
         [0011]    Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment. 
         [0012]      FIG. 1  illustrates one embodiment of a block diagram of a network with an apparatus. The network includes a multitude of network devices  10  that communicate over a network  12  by transmitting and receiving network traffic  18 . The traffic may be sent in packet form, with varying protocols and formatting thereof. 
         [0013]    A network analyzer  14  is also coupled to the network, and may include a remote network analyzer user interface  16 . Remote network analyzer user interface  16  enables a user to interact with network analyzer  14  to operate analyzer  14  and remotely obtain data therefrom. In one embodiment, remote network analyzer user interface  16  typically is operated by running on a computer or workstation interfaced with the network. 
         [0014]    According to one embodiment, network analyzer  14  includes hardware and software, CPU, memory, interfaces that operate to monitor traffic on the network. In a further embodiment, network analyzer  14  performs various testing and measurement operations, as well as transmitting and receiving data. 
         [0015]      FIG. 2  is a block diagram illustrating one embodiment of network analyzer  14 . According to one embodiment, network analyzer  14  includes network interfaces  22  that couple to network  12  via multiple ports. Network analyzer  14  also includes one or more processors  23 , memory such as RAM/ROM  24  and persistent storage  26 , and display  28 . Further, user input devices  30  (e.g., keyboard, mouse or other pointing devices, touch screen, etc.), a power supply  32  and an input/output interface  34  to couple to another network or external devices (e.g., storage, other computer, etc.) are included within network analyzer  14 . 
         [0016]    In one embodiment, network analyzer  14  includes a packet processing module  25  to process packets received at analyzer  14 . In such an embodiment, processing of the packets includes adding a header (or tag) to each packet received via network interfaces  22 . According to one embodiment, packet processing module  25  may be implemented as a network monitoring card. 
         [0017]      FIG. 3  is a block diagram illustrating one embodiment of such a network monitoring card  42  inserted into a PCIe slot in a high-performance server  44 . According to one embodiment, network monitoring card  42  filters, aggregates, and buffers Ethernet traffic received from network  12  over multiple ports at line rates. Server  44  also includes a memory  46  to store packets received from card  42 . 
         [0018]      FIG. 4  is a flow diagram illustrating one embodiment of a packet tagging process. At processing block  410 , packets are captured at network monitoring card  42 . At processing block  420 , the card  42  hardware analyzes each captured using filters. In one embodiment, each packet is compared against various filters for IP address, port number, packet length and/or keywords. In such an embodiment, the filters are configurable in the card  42  hardware. As an example, card  42  may include a filter “X” configured to capture all received HTTP traffic. 
         [0019]    At processing block  430 , the packets are captured at one or more filters based on a criteria match. For example, packets that match a criteria “X” are captured by filter “X”, packets that match a criteria “Y” are captured by another filter “Y”. At processing block  440 , a tag is generated for each packet by a tagging module  48  based on the filter results. 
         [0020]    In one embodiment, tagging module  48  is a software module that generates a packet report for each packet that corresponds to the matching filter. Thus, the packet report includes a unique ID that indicates that a packet has been captured because the packet matches the filter. In such an embodiment, the packet report is header data that is stored with the packet in memory  46  to assist in the routing and processing of the packet. For example, each packet captured at card  42  may include a fixed data length (e.g., 100 B), while the packet report tag is an additional length (e.g., 20 B, 48 B, etc.). 
         [0021]    At processing block  450 , each packet and corresponding tag is stored at memory  46 . At processing block  460 , each packet and tag are subsequently retrieved by a process that determines a particular action that is to be performed for each packet based on the tag. In one embodiment, actions to be performed on a packet are determined by predetermined rules configured for the filters. 
         [0022]    The above-described process obviates the need for the software to inspect each full packet to determine an action to take. Instead, the software only needs to analyze the shorter tag. Thus, performance is improved due to the increased speed at which the software can make decisions about packets. 
         [0023]    Embodiments of the invention may include various steps as set forth above. The steps may be embodied in machine-executable instructions. The instructions can be used to cause a general-purpose or special-purpose processor to perform certain steps. Alternatively, these steps may be performed by specific hardware components that contain hardwired logic for performing the steps, or by any combination of programmed computer components and custom hardware components. 
         [0024]    Elements of the present invention may also be provided as a machine-readable medium for storing the machine-executable instructions. The machine-readable medium may include, but is not limited to, floppy diskettes, optical disks, CD-ROMs, and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, magnetic or optical cards, propagation media or other type of media/machine-readable medium suitable for storing electronic instructions. For example, the present invention may be downloaded as a computer program which may be transferred from a remote computer (e.g., a server) to a requesting computer (e.g., a client) by way of data signals embodied in a carrier wave or other propagation medium via a communication link (e.g., a modem or network connection). 
         [0025]    Whereas many alterations and modifications of the present invention will no doubt become apparent to a person of ordinary skill in the art after having read the foregoing description, it is to be understood that any particular embodiment shown and described by way of illustration is in no way intended to be considered limiting. Therefore, references to details of various embodiments are not intended to limit the scope of the claims, which in themselves recite only those features regarded as essential to the invention.