Integrated switch tap arrangement with visual display arrangement and methods thereof

Integrated switch shunt configuration with visual display configuration and its method

The present invention relates to a configuration in a network device used to monitor network traffic.

Interactive case

The present invention is related to the following applications, and all the following applications are cited for reference in the present invention: The application serial number 11/370,487 (agent case number NETO-P008) filed on March 7, 2006 is shared by Matityahu et al. The US application for assignment "Intelligent Communications Network Tap Port Aggregator".

Telecommunications networks have long been used to facilitate communication between geographically dispersed users. Communication may include the transmission of data packets such as data and voice packets between multiple network devices such as routers and switches. In today's business environment, a company's network can perform an important function in that it enables the company to conduct business. The company's network may have multiple routers and/or switches connected together. In a large company, the number of routers and/or switches can easily increase to several hundred. In order to manage the company's network to ensure that the network can fully operate, Information Technology (IT) personnel can ensure that each router and/or switch is executed correctly.

A traditional method for monitoring the network may include logging into the network system to extract statistical data related to each router and/or switch. A method that consumes less labor may include: using a monitoring tool that can extract statistical data; and using an analysis application that can analyze the statistical data. Even so, it is not easy to obtain the statistical data, and information technology (IT) personnel still need to log in to the network system and/or routers and/or switches in order to access the information.

In addition, IT personnel such as technicians may not necessarily have access to statistical data that the IT personnel may need in order to perform their work of maintaining and monitoring the health of the network system. In a typical network environment, some servers may contain extremely sensitive information. Therefore, not everyone in the IT department has access to every aspect of the network. Therefore, in order to access statistics, authorization may be required.

One embodiment of the present invention relates to a configuration in a network device for monitoring network traffic. The configuration includes a set of network ports, the set of network ports includes a set of input network ports for receiving the network traffic, and a set of output network ports for outputting the network traffic from the network device. The configuration also includes an exchange chip, wherein the exchange chip is at least configured to analyze the network traffic. The configuration further includes a set of monitoring ports configured to receive the network traffic from the set of network ports. The configuration further includes a shunt module, the shunt module is at least configured to intercept at least a part of the network traffic flowing through the network device, and forward at least a part of the network traffic to the set of monitoring ports At least one monitoring port.

The above content of the invention is only one of the many embodiments of the present invention disclosed in this specification, and the intention of the content of the invention is not to limit the scope of the present invention, but will be described in the scope of patent applications in this specification. The scope. Hereinafter, the above-mentioned and other features of the present invention will be described in more detail in the embodiments of the present invention in conjunction with the various drawings.

The present invention will now be explained in detail with reference to some embodiments of the present invention shown in the drawings. In the following description, many specific details are mentioned in order to provide a thorough understanding of the present invention. However, those skilled in the art should understand that the present invention can be implemented without using these specific details. In other cases, the conventional procedure steps and/or structure are not described in detail, so as not to unnecessarily obscure the present invention.

Hereinafter in this specification, various embodiments including methods and techniques will be described. We should keep in mind that the present invention may also cover articles that include computer-readable media storing computer-readable instructions for executing embodiments of the technology of the present invention. The computer-readable medium may include a computer-readable medium such as semiconductor, magnetic, magneto-optical, optical, or other forms of computer-readable code for storing computer-readable codes. In addition, the present invention can also cover devices used to implement the embodiments of the present invention. Such equipment may include dedicated and/or programmable circuits for performing tasks related to embodiments of the present invention. Examples of such equipment include general-purpose computers and/or dedicated computing devices that have been appropriately programmed, and may include a combination of computers/computing devices and dedicated/programmable circuits suitable for various tasks related to the embodiments of the present invention .

As mentioned above, a network can include a plurality of network devices. Each network device can store statistical data related to the data traffic (for example, data traffic of data, media, voice, etc.) that can flow through the device. In order to monitor the activities on the network, a monitoring system can be used.

To help explain, Figure 1 of the prior art shows a simple network diagram with a network splitter. In the description of this manual, a network tap is an example of a network device that can be used to monitor activities on a network link. A network configuration 100 may include a set of network devices such as an Ethernet switch 102 and an Ethernet router 104 to facilitate the transmission of data packets. The network configuration 100 can also include a network splitter 106, which can be arranged side by side between the two network devices (the Ethernet switch 102 and the Ethernet router 104) On a network link between (as shown by paths 108 and 114). In one example, the data packet flow can go upstream from the Ethernet switch 102 along a path 108 to a port 110, then to a port 112, and flow out to the Ethernet router 104 via a path 114. Similarly, data from the Ethernet router 104 can travel upstream along the path 114 to the port 112, and then through the port 110 and along the path 108 to the Ethernet switch 102.

The network splitter 106 can be used as a bridge between the Ethernet switch 102 and the Ethernet router 104. By using the network splitter 106, the data traffic between the Ethernet switch 102 and the Ethernet router 104 can be monitored. The network splitter 106 may be a dual-port monitoring configuration. In one example, the data packet stream received by the port 110 can be copied and forwarded to a monitoring device 118 via a port 116. Similarly, the data packet stream received by the port 112 can be copied and forwarded to a monitoring device 122 via a port 120. Examples of monitoring devices may be devices such as personal computers (PCs), intrusion detectors, network analyzers, and intrusion prevention systems.

In order to understand how the network splitter works, Figure 2 of the prior art shows a schematic diagram of a network splitter. The network splitter 200 may include a PHY (physical interface layer) chip 202, and the PHY chip 202 may be an Ethernet transceiver. In the description of this specification, the PHY chip means a chip that can be used to receive and transmit signals that can include data packets. A media terminal 204 of the PHY chip 202 can connect the PHY chip 202 to the physical ports (206, 208, 210, and 212) of the network splitter 200. In one example, a data packet stream can be received on a port 206 and sent to the PHY chip 202 along a line 214. The data packet stream is usually received as an analog signal.

The data packet stream from the port 206 can travel through the PHY chip 202 along the path 218 and exit on a Media Access Controller (MAC) terminal 216 of the PHY chip 202. The PHY chip 202 can be used to first convert the analog signal into a digital signal and then transmit the signal on the MAC terminal 216. The data packet stream can return to the PHY chip 202 via a bus line 220 and travel to the port 208 via a path 222. Similarly, a bus line 224 can be used to loop the data packet flow from port 208 back to port 206. In one example, the bus line that can be used to return the data loop between the ports may be a reduced Gigabit Media Independent Interface (RGMII).

The network splitter 200 can also include a passive circuit 226. The passive circuit 226 can include a switch 228 that can be closed to create a bypass path between the port 206 and the port 208 when there is no power.

For monitoring purposes, the received data packet stream can be copied and sent to the monitoring device on port 210 and port 212. In one example, the data packet stream received through the port 206 of the PHY chip 202 can be transmitted. The PHY chip 202 can first convert the data packet stream from analog to digital, and then transmit the data packet stream on the MAC terminal 216. A copy of the data packet stream can be sent back to the monitoring port 210 via the PHY chip 202 along a line 230. Please note that when the digital data packet flows through the PHY chip 202, the PHY chip 202 can convert the data packet stream back to an analog signal. Similarly, the data packet stream received by the port 208 can be sent to a port 212 via a line 232.

It can be understood from the foregoing that a monitoring system such as the monitoring system described above with reference to Figures 1 and 2 can collect a plurality of statistical data related to a company's network. However, it is not easy to get the statistics. In one example, in order to retrieve the statistical data, IT personnel may need to log in to the system in order to access the data.

In one aspect of the present invention, the inventor understands here that if network data is easy to obtain, the time it may take for IT personnel to retrieve statistical data to perform maintenance and monitoring can be greatly reduced. Therefore, it is best to provide a convenient method for accessing network data (especially the usage rate of a port). The inventor understands here that if the data is displayed visually, IT personnel can quickly access the health of each component of the network without having to log in to the system in order to retrieve the information. In addition, by displaying the information visually, IT personnel can support network devices that may be associated with extremely sensitive information without having to obtain authorization to access servers that may store the extremely sensitive information.

According to an embodiment of the present invention, a network device with a visual performance display configuration is provided. The embodiment of the present invention also includes a method for calculating and displaying the usage rate of the network port. In the description of this manual, the usage rate means the actual transmission rate of a network port (throughput).

In this document, the usage rate can be used as an example to illustrate various embodiments. However, the present invention is not limited to the usage rate, and may include any network parameters. These descriptions are intended as examples instead, and the present invention is not limited to the examples shown.

In addition, in this document, a dual-port network splitter can be used as an example to illustrate various embodiments. However, the present invention is not limited to dual-port network splitters, and may include other network devices such as port aggregation splitters, bypass switches, regeneration taps, and matrix switches. These descriptions are intended as examples instead, and the present invention is not limited to the examples shown.

In an embodiment of the present invention, a network device with a visual performance display configuration for displaying extremely important network parameters can be provided. Examples of network parameters may include (but are not limited to) network parameters such as real-time utilization rate of network capacity, average utilization rate, highest peak of traffic peak, traffic type, and fault condition. In one embodiment, the network parameters of each port can be displayed. The network parameters can be displayed in text and/or graphics. It can be understood from the previous description that these network parameters can be displayed visually, without the IT staff having to log in to retrieve data, thus improving the efficiency of IT staff and reducing the response time required to deal with network abnormalities.

As can be understood from the previous description, multiple network parameters can be obtained. In an embodiment of the present invention, a logic configuration (for example, a Field-Programmable Gate Array (FPGA)) and an Application-specific Integrated Circuit (ASIC) can be configured. , And complex programmable logic devices (Complex Programmable Logic Device; CPLD for short) are used to analyze the network parameters and generate statistical data. As can be understood from the foregoing description, the logic configuration that can be used to perform analysis and calculate statistical data can be changed according to manufacturing preferences. In an example, the logic configuration may include a single programmable component (such as an FPGA). In another example, the logical configuration may be a set of programmable components (such as a set of FPGA), where each programmable component is configured to perform a different function. In yet another embodiment, the logic configuration may include a set of programmable components (such as a set of FPGA) and a set of programmable digital electronic components (such as a set of microprocessors).

One of the network parameters that is usually used to quickly determine the status of a port is the utilization rate. In order to determine the utilization rate, the logic configuration can be configured to include a set of counters for each port. In one embodiment, a first counter can be used to track every instance of a valid data packet received by a port. The data of the valid data packet can be extracted from the RX_DV signal of the RGMII bus connected to the MAC terminal of a PHY. RX_DV is a control signal that can indicate a valid data packet being received by a port. In one example, when a valid data packet is received, the RX_DV signal can be triggered (ie, enter the high level), and when the transmission has been completed, the RX_DV signal can enter the low level. Therefore, the logic configuration can analyze the RX_DV signal to identify the valid data time period.

In one embodiment, a second counter can be used to track the number of bytes received. The byte data can be extracted from an RX_CLK signal of an RGMII bus. In one embodiment, for a gigabit Ethernet device, the RX_CLK signal is a 125 MHz clock transmitted at a double rate. In other words, for each clock cycle (up and down), two bytes are received.

In order to identify the number of bytes that can be received during a valid data time, the logic configuration can correlate the RX_DV signal with the RX_CLK signal. When the number of bytes is known, the logical configuration can then convert the information from the bytes into bit information. In other words, if 7 bytes of a valid data packet are received, the logical configuration can multiply the number of received bytes by 8, and convert the same bytes into bits, thus obtaining 56 bits. .

In addition, the logic configuration can normalize the data. In an example, a monitoring period may be every second, but the data collected by the counter may be collected on every 1/10 of a second. In the above example, these 56 bits can be normalized to 560 bits per second. The normalized data can indicate the amount of data actually received by a port. In order to determine the utilization rate, the logical configuration can divide the actual rate of the received data by the line rate that a network device can carry. In this example, for a billion-bit Ethernet device capable of transmitting up to one billion bits of data, only receiving data at a rate of 560 bits per second may be a cause for concern. By displaying the usage rate for easy viewing, IT staff can quickly try to solve the problem.

The features and advantages of the present invention can be better understood by referring to the drawings and the description below.

FIG. 3A shows a simple block diagram of a network tap with a visual performance display configuration in an embodiment of the present invention.

A network splitter 300 may include a port 302 and a port 304. As mentioned above, the network tap can be used to monitor the data flow of a network. We should be able to understand that the network tap can perform its monitoring function without interfering with normal data traffic. In other words, regardless of whether power is supplied to the circuit of the network splitter 300, the data flow portion can flow between the ports 302 and 304 without interruption. In one example, data traffic can flow into port 302 to an Ethernet transceiver such as PHY 306, and flow out through port 304. Therefore, regardless of whether the network tap 300 is performing its monitoring function, data traffic can continue to flow between these ports.

However, if power is supplied to enable the network tap 300 to perform its monitoring function, the same data traffic that can flow into the port 302 and be received by the PHY 306 can be replicated. In one embodiment, the RGMII bus 308 may be configured to direct a copy of the data traffic to the monitoring devices. Those familiar with the technology should understand that the RGMII bus 308 may include a plurality of signals, including (but not limited to) RX_CLK, RX_DV, GTX_CLK, TX_EN, RXD[3:0], and TXD[3:0]. In one embodiment, two signals such as an RX_CLK signal 350 and an RX_DV signal 352 (as shown in Figure 3B) can be extracted from the RGMII bus 308, and these two signals are transmitted along a path To a logic configuration such as a field programmable gate array (FPGA) 312. The FPGA 312 may include the wisdom used to determine when the data on the RGMII bus 308 is valid based on the two signals (RX_CLK and RX_DV).

The FPGA 312 may include two counters (counter 314, counter 316, counter 318, and counter 320) for each port. In one embodiment, the counter 314 can be associated with the RX_DV signal 352, and the counter 314 can be incremented every time valid data appears. In one example, when the port 302 receives a data packet, the counter 314 can be increased by one.

In another embodiment, the counter 316 can be associated with the RX_CLK signal 350, and the counter 316 can be incremented every time a byte is received. The FPGA 312 can use the RX_CLK signal 350 as a clock to measure the number of bytes that can be received during a valid data period. In a gigabyte Ethernet network, the RX_CLK signal 350 is a 125 megahertz clock. Because the RX_CLK signal 350 can be a control signal from the RGMII bus 308, it is assumed that two bytes are received in each clock cycle. In other words, on each falling or rising edge (360, 362, 364, 366, 368, 370, and 372), a byte is received.

In order to determine the number of bytes received during a valid data period, the FPGA 312 may combine the two control signals.

In one example, when a data packet is received by a port, the RX_DV signal 352 can be triggered (ie, enter the high level). In other words, when the RX_DV signal 352 is at a high level (as shown by the shaded portion 354), a valid data packet is received. In one embodiment, the time period between the rising edge 356 and the falling edge 358 may indicate the valid data time period.

Although the RX_DV signal 352 can be used to indicate when the data is valid, the RX_DV signal 352 does not provide information about the byte size of the incoming data packet. Because the number of bytes in each packet is unknown, the RX_CLK signal 350 can be used to determine the number of bytes in a valid data packet. Those who are familiar with this technology should understand that for an RGMII bus, data is transmitted on every rising clock and every falling clock of the 125 MHz clock. Therefore, by calculating the number of rising and falling edges (360, 362, 364, 366, 368, 370, and 372) of the RX_CLK signal 350 when the RX_DV signal 352 is triggered, the number of valid data time periods can be determined The number of bytes.

Once the counters in the FPGA 312 have collected data and the two signals have been correlated to determine the number of valid bytes in each valid data period, the utilization rate can be determined. In one embodiment, the logical configuration may include one or more programmable components. In one example, the same FPGA 312 can perform analysis. In another example, the FPGA 312 can transfer the collected data to another programmable component in the logic configuration, such as a microprocessor 322, so as to determine the utilization rate. It can be understood from the above description that the calculation of the utilization rate may depend on the network device that has been adopted. In one example, for a billion-bit Ethernet, the number of bytes collected during a valid data period must be divided by one billion bits in order to determine the actual utilization rate.

In one embodiment, once the usage rate is determined, the usage rate can be forwarded along a path 324 to display the usage rate on a visual display 326 of the network splitter 300. From the previous description, we can understand that besides being displayed, the usage rate can also be distributed in other ways, for example, sending the statistical data to a remote user in the form of a report, or forwarding the data to an application Program for analysis. Therefore, it can be understood from the foregoing description that because the data can be accessed remotely, monitoring can be performed in a remote manner, so that IT personnel can have more flexibility in performing their tasks of maintaining the full functioning of the network.

As shown in Figures 3A and 3B, by extracting relevant control signals from the bus line, logic configurations such as FPGAs and microprocessors can calculate the utilization rate of a network port. By displaying the usage rate, IT staff can easily view the data without logging in to the network system in order to retrieve the data. In addition to viewing real-time data, the visual performance display configuration can also display historical trends such as maximum traffic spikes to help IT personnel maintain and monitor the network. It can be understood from the above description that by obtaining the data visually, the need for access to the authorization code of the network device associated with extremely sensitive information can be substantially eliminated. Therefore, low-level IT personnel can perform their work, and the company does not have to worry about unauthorized users obtaining confidential information.

Figure 4 shows a simple flow chart of a method for calculating the usage rate in an embodiment of the present invention. Fig. 4 will be explained with reference to Figs. 3A and 3B in order to provide an explanation of the manner in which these steps are performed. A case such as a valid data packet has been received by port 302 will be considered.

In the first step 402, a logic configuration can detect the valid data time period on an RX_DV signal. In one example, the FPGA 312 can analyze the RX_DV signal 352 to determine the rising edge 356 that can indicate the valid data time period 354. As mentioned above, only one data packet is received during each valid data time period. Therefore, the counter 314 can increase the count by one to indicate a new valid data time period.

In the next step 404, the logic configuration can count the number of rising edges and falling edges on an RX_CLK signal. In order to determine which part of the RX_CLK signal to count, the FPGA 312 can correlate the RX_CLK signal 350 with the RX_DV signal 352 to determine the number of rising edges and falling edges. In one example, during the valid data time period 354, seven bytes are collected based on the rising and falling edges (360, 362, 364, 366, 368, 370, and 372) of the RX_CLK signal 350.

In the next step 406, the number of bytes is converted to the number of bits. Once the FPGA 312 determines the number of bytes to be collected, the FPGA 312 can forward the data to the microprocessor 322. Because the network device is a billion-bit Ethernet device, the microprocessor 322 can first convert the number of bytes to the number of bits. Those who are familiar with this technology should understand: each byte has 8 bits. Therefore, the number of valid bits in the valid data time period 354 can be 56 bits (for example, 7 bytes x 8 bits).

In the next step 408, the usage rate can be calculated. Before calculating the usage rate, the microprocessor 322 can normalize the data first. In one example, 56 bits have been transmitted in every 1/10 of a second. However, a collection cycle can occur every second. Therefore, in every second, 560 bits can be transmitted.

Once the data is normalized, the logic configuration can calculate the utilization rate. The actual number of bits per second can be divided by the number of bits per second that a line can carry to calculate the utilization rate. In this example, because the network device is a billion-bit Ethernet device, the microprocessor can divide the normalized number by one billion bits to determine the utilization rate.

As can be understood from the previous description, the same procedure described in Figure 4 can also be applied to such as Gigabit Media Independent Interface (GMII), etc. It can also have functions such as RX_DV and RX_CLK that can be used to calculate the utilization rate. Other bus lines for control signals.

FIG. 5 shows an example of a network device with a visual performance display configuration in an embodiment of the present invention. A network device 500 may include a plurality of ports. In this example, the network device 500 may include two network ports (502 and 504) and two monitoring ports (506 and 508). From the above description, it can be understood that the network device can be any device that can direct Ethernet traffic. Therefore, the network device 500 can be a router, a switch, a network splitter, and the like.

A visual display configuration 510 can also be coupled to the network device 500. In an example, the visual display configuration may be a liquid crystal display (Liquid Crystal Display; LCD for short) screen. It can be understood from the foregoing description that the size of the visual display configuration may depend on the configuration preference of the manufacturer. In one example, the size of the LCD screen may depend on the size of the network device.

It can be understood from the above description that the network parameters that can be displayed on the visual display configuration can be data that can assist IT personnel in performing their maintenance and monitoring of the company's network. Although the usage rate has been used as an example of implementing a network device with a visual performance display configuration, other network data parameters can also be shown. Examples of the types of displayed technology and diagnostic data may include (but are not limited to) the real-time usage of each path of a network link, the size and time of the maximum traffic spike, and the simple network of system/link/power Data types such as management protocol (SNMP) traps, average usage percentage of network capacity, total packet count, and total bytes.

In one embodiment, the network data can be updated periodically to visually display real-time data. In another embodiment, the displayed network parameters can be cycled. In other words, the amount of data parameters that can be viewed can be limited to the visual display configuration. In order to be able to view different data parameters, different methods can be used to determine when to cycle network data. In one example, data parameters can be displayed during a preset time period. In another example, a control component such as a button or a scroll wheel can be used to enable IT personnel to select required data parameters.

It can be understood from the previous description that the mode of displaying data parameters can be changed. In one example, the network data can be displayed in the form of text. In another example, the network data can be displayed in a graph (for example, a graph such as a chart, a bar graph, etc.).

It can be understood from the foregoing description that one or more embodiments of the present invention provide a method and device for displaying network parameters on a network device. By displaying these network parameters, IT personnel can obtain real-time network data parameters on the network device. Therefore, by visually obtaining network data parameters, efficiency can be improved and costs can be reduced.

In an interconnected environment such as an enterprise network or the Internet, a large number of data packets are exchanged every day. In order to facilitate the exchange of data packets via a network, a network device such as a layer 2 or layer 3 network switch can be used. The network switch is usually a high-density device capable of directing extremely large network traffic. Because a large amount of network traffic may flow through a single network switch, the ability to monitor network traffic can be used to manage network health (for example, to ensure reliable performance, perform fault detection, and detect unauthorized A tool of activity) is provided to managers.

A configuration implemented in order to be able to perform monitoring includes the use of a mirror port. In the description of this manual, a mirror port refers to a port that has been configured to receive a copy of network traffic from multiple source ports. To facilitate the description, Figure 6 shows a simple block diagram of a switching device with mirroring function. A network switch 600 may include a plurality of source ports (606, 608, 610, 612, 614, 616, 618, 620). The plurality of source ports are configured to receive data packets, determine the destination, and forward the Wait for data packets. In one example, the source port 606 can receive a data packet. An exchange chip 604 analyzes the data packet and can determine that the data packet will be forwarded to its destination via an uplink port (for example, an uplink port of 630, 632, etc.).

The network switch 600 may also include a mirror port 622 that can be connected to a monitoring tool 624 such as a computer system. In one example, the data packet received by the switching chip 604 can be copied and forwarded to the monitoring tool 624 via the mirror port 622. Because data traffic from multiple source ports flows into a single mirror port (622), network traffic congestion may occur. In order to reduce the network traffic congestion of the mirror port 622, the switching chip 604 may have a built-in filtering function.

In one example, the source port 606 can receive data packets of one billion bytes. However, a data packet of approximately 300 million bytes may contain errors. Before copying the data packet, the switching chip 604 can filter the data packet first, and remove parts of the data packet that may contain errors. Therefore, only a part of the data packet is forwarded to the mirror port 622. Therefore, the data packets visible to the monitoring tool 624 are limited to the network traffic that is copied and forwarded through the mirror port 622. Because the error part of the data packet has been filtered out, the error part will not be used for analysis.

However, even if the wrong part of the data packet is filtered out, network traffic congestion may continue to be a problem. Therefore, the switching chip 604 may have to discard additional data packets in order to minimize and/or prevent network traffic congestion. Therefore, the ability of the monitoring tool 624 to perform its monitoring depends on the network switch.

In order for the exchange wafer 604 to perform the mirroring function, a lot of processing may be required. In some cases, the exchange chip 604 can use 20-30% of the processing power of a central processing unit (CPU) 602 to perform mirroring functions. Because the mirroring function is regarded as a non-critical function of the network switch 600, when the CPU 602 is overloaded, the mirroring function may be the first function that can be turned off so that the network switch 600 can perform its network traffic routing The main function. Therefore, the loss of the mirroring function prevents the administrator from monitoring the network traffic, because a copy of the network traffic is not forwarded to the monitoring tool 624 via the mirror port 622.

Especially when the network switch does not have a mirroring function, an alternative prior art solution for monitoring network traffic is to connect an external network splitter as a side-by-side device to a network switch. Figure 7 shows a simple block diagram of a network switch with an external side-by-side shunt configuration. A network switch 700 may include a plurality of source ports (source ports of 702, 704, 706, etc.) which are configured to receive data packets, determine the destination, and forward the data packets. In one example, network traffic can flow into a source port 702 and flow out of an uplink port (708, 710).

In order to monitor the traffic, an external side-by-side splitter such as a splitter 716 can be connected to the uplink port 708 in order to monitor the data flow from the uplink port 708 to a router 722 such as a router. The splitter 716 may include two network ports (718 and 720) configured to receive and forward network traffic. In one example, the network port 718 is configured to receive data packets from the uplink port 708 and transmit the data packets to the uplink port 708. Similarly, the network port 720 is configured to automatically receive/transmit data packets from/into the router 722. The network traffic flowing through the splitter 716 is copied and forwarded to a set of monitoring tools 728 via a monitoring port (724 or 726). In one example, the source port 702 receives network traffic. The network traffic is forwarded to a switching chip (not shown in the figure). In this network switching configuration, the switching chip may not have a mirroring function. Therefore, the network traffic received by the switching chip is finally transmitted through one of the uplink ports.

The network traffic flowing through the splitter 716 is bidirectional. In other words, the splitter 716 can receive the network splitter from the network switch 700 and the router 722. Therefore, when data is copied and transferred to the monitoring ports, the amount of data flowing through the splitter 716 may cause traffic congestion. Due to traffic congestion, some data packets can be discarded until the traffic congestion is alleviated.

It can be understood from Figure 7 that a network switch with an external side-by-side shunt configuration needs to interconnect multiple network devices. Because these network devices may have different brands and models, the network setup and maintenance may become quite complicated. In addition, in order to accommodate a network switch with an external partial stream configuration, more physical space will be required.

The prior art monitoring configuration for network switching devices has several disadvantages. For a network switch with a mirrored port, users have little or no control over the types of data packets they can see. Instead, the network switch may have built-in logic to define rules for discarding data packets. In addition, the mirroring function requires a lot of resources and may overload the CPU of the network switch. Because the mirroring function is a primary function of the network switch, the mirroring function may be turned off in order to retain the main function of the network switch (directing network traffic), thus terminating the traffic to the monitoring device.

In the second monitoring configuration, the network switch with an external side-by-side splitter provides a monitoring configuration that will not be affected and shut down when the processor of the network switch is overloaded. However, this tap monitoring configuration may still have data loss due to network traffic congestion. In addition, the splitter monitoring configuration requires more physical space, because the splitter monitoring configuration may require more network devices to perform the same monitoring function as the network switch with mirroring function. In addition, this external side-by-side shunt configuration may result in higher power consumption. Considering that this configuration is a separate solution, the external flow configuration may require more resources.

According to an embodiment of the present invention, an integrated switch distribution configuration capable of monitoring network traffic in a single device is provided. The embodiment of the present invention includes: integrating a shunt module into the switching device to perform monitoring functions. The shunt module can be configured to intercept data flow to a set of uplink ports. The intercepted data can be copied and forwarded to a set of monitoring ports.

In an embodiment of the present invention, the shunt module may include filtering logic. Different from the prior art, the user can configure the filtering logic, thus allowing the user to determine the types of data packets that can be monitored. Additionally or alternatively, the filtering logic can also allow the user to define the types of data packets that a monitoring tool can receive.

In one embodiment, the integrated switch splitter configuration may include two CPUs. The main CPU is used to perform functions normally associated with traditional network switches. The primary CPU can be reserved for performing tasks executable by the shunt module, for example, executing the filtering logic. When a primary CPU is installed, the possibility of losing visibility of network traffic will be substantially eliminated, because the monitoring and filtering functions have been separated from the routing functions.

In another embodiment, the integrated switch shunt configuration may include a buffer component. Because network traffic is bidirectional (in and out of each uplink port), the network traffic that can be forwarded to a group of monitoring ports can be greater than the amount that the group of monitoring ports can handle. In order to deal with the potential network traffic congestion of the group of monitoring ports, a buffer component can be set between the shunt module and the group of monitoring ports, so that the buffer component can buffer the network when network traffic congestion may occur. flow. Therefore, when a buffer component is provided, the risk of discarded data packets can be substantially reduced and/or minimized.

The features and advantages of the present invention can be better understood by referring to the drawings and the description below.

Figure 8 shows a simple overall view of a network switch with an integrated shunt configuration in an embodiment of the present invention. An integrated switch shunt device 800 may include a plurality of network ports (806, 808, 810, 812, 814, 816, 818, 820, 822, 824, 826, and 828). Each of these network ports is configured to be bidirectional, so each port can have an input network port for receiving incoming traffic and an output network for forwarding out traffic port. After receiving a data packet, the input network port can forward the data packet to a switching chip 804. After analyzing and determining the destination of the data packet, the switching chip 804 can forward the data packet to one of the uplink ports (836 and 838).

In one embodiment, in order to facilitate monitoring of the network traffic flowing through the integrated switch shunt device 800, a shunt module 830 may be included as a built-in component. The shunt module 830 can be configured to intercept data traffic and copy the data traffic so as to forward the data traffic to one of the monitoring ports such as the monitoring ports 840 and 842. In an embodiment, the shunt module 830 may include a filtering function. Different from the prior art solutions of switching devices with mirroring function, the user can configure the filtering function built into the shunt 830.

In one example, a user may be interested in network traffic that can flow through a network device through a specific source port, regardless of whether the data packet contains errors. However, in the prior art, the switching chip with mirroring function may be configured to filter out any errors that may occur in the network traffic; therefore, the user may not have the opportunity to analyze the errors that may occur. Different from the prior art, the shunt module 830 includes a user-configurable filtering function, thus allowing the user to define the types of data packets that they may want to monitor or may want to discard. Therefore, instead of being restricted by the settings of the switching device, the user can now control the type of data packets that can be sent to a monitoring tool for analysis.

In one embodiment, the shunt module 830 may include a processor, so that the shunt module 830 can perform processing without using the main processor (CPU 802) of the integrated switch shunt device 800. Since the monitoring and filtering functions are not performed by the switching chip 804 but by the shunt module 830, the risk of overloading the CPU 802 is minimized because the CPU 802 does not need to process additional functions such as mirroring functions. Even if the CPU 802 is overloaded and other secondary functions are turned off in order to retain the main functions of the network switch, the shunt module 830 can continue to perform its monitoring and filtering functions, because the shunt module 830 has its own independent processor .

In one embodiment, the shunt module 830 may be disposed between the exchange chip 804 and one or more uplink ports (836 and 838). By arranging the shunt module 830 between the switch chip and the set of uplink ports, the shunt module 830 can intercept the network traffic transmitted between the switch chip 804 and the uplink ports. In one embodiment, an integrated switch shunt device 800 may include a plurality of shunt modules. In one example, for each uplink port, a shunt module can be associated with the uplink port. For example, in one embodiment, a shunt module can be associated with a first winding port, and a second shunt module can be associated with a second winding port (not shown in the figure).

In another embodiment, a single shunt module can be used to monitor network traffic flowing into more than one uplink port. In one example, a single shunt module can be configured to process network traffic flowing into the uplink port 836 and the uplink port 838 at the same time. In this configuration, in one embodiment, the offloading module may first use an aggregator to aggregate the network traffic flowing in from the paths 832 and 834, and then copy and filter the network traffic. In one example, the data packet ABCD is received from the path 832, and the data packet GHIJ is received from the path 834. The aggregator can combine the network traffic from the two paths before copying the data packets. Once the data packets are copied, the offloading module can apply filtering to determine which data packets to keep and the destination of each data packet. For example, the user may have created a filtering rule that requires a monitoring tool connected to the monitoring port 842 to process all emails (for example, data packets A and H). Therefore, the data packet AH is sent to the monitoring tool through the monitoring port 842, and the data packet BCDGIJ is sent to another set of monitoring tools through the monitoring port 840.

Since the offloading module 830 can simultaneously process incoming and outgoing traffic (that is, data packets from the source ports and the uplink ports respectively), network traffic congestion may occur. In one embodiment, the integrated switch offloading device 800 may include a buffer component, so that the offloading module 830 can handle potential network traffic congestion flowing to the monitoring ports (840 and 842). In one example, the amount of data packets flowing to the monitoring port 840 may exceed the capacity that the monitoring port 840 can handle. In order to minimize network traffic congestion, a buffer component can be configured to buffer data traffic, thereby managing the data traffic flowing to the monitoring ports. By implementing a buffering component, it is now possible to buffer data packets that may be inadvertently discarded due to network traffic congestion in the prior art until the monitoring port is ready to receive the data packets.

In an embodiment, the integrated switch shunt device 800 may include a switch chip with a mirroring function. In other words, if the user wants to apply the filter function of the exchange chip, the user can choose to enable the mirroring function. By providing users with the option of selecting the mirroring function, some additional monitoring functions can be supported. However, even if the CPU 802 is overloaded and the mirroring function is disabled, the user will not lose visibility to the network traffic. This is because the network traffic is still copied by the offloading module 830 and therefore does not depend on the CPU 802.

In another embodiment, if one of the uplink ports is not associated with a shunt module, an external shunt can be configured to monitor the network traffic flowing through the uplink port. In one example, a third uplink port (not shown in the figure) is not associated with the shunt module 830. If the user wants to monitor the network traffic flowing through the third uplink port, the user can choose to connect an external side-by-side shunt configuration to the third uplink port.

It can be understood from Figure 8 that an integrated switch shunt device enables network devices to integrate shunt and switching functions into a single device. The integrated switch shunt device 800 as a single device occupies less physical space and/or consumes less power than a network switch with an external side-by-side shunt configuration. In addition, as a single device, the management of the network device is simpler than the management of multiple network devices. In one example, when a single management port 844 is provided, the administrator can configure and maintain the switching and distribution functions. In the prior art, managers may have the challenge of trying to integrate switching devices and shunt devices that may have different brands and models. However, when these two functions are included in a single device, the administrator no longer needs to perform complicated configurations in order to match the two functions with each other.

Figure 9 shows a simple flow chart of the steps used to enable monitoring in an integrated switch shunt device in an embodiment of the present invention. To facilitate the description, FIG. 9 will now be described with reference to FIG. 8.

In the first step 902, a shunt module receives a group of data packets. Consider a situation such as that the switch chip 804 is receiving network traffic via the network port 808. After analyzing the data, the exchange chip can forward the set of data to the uplink port such as the uplink port 838. In an embodiment, the shunt module 830 can intercept the set of data packets.

In the next step 904, the group of data packets is processed. In one example, the shunt module 830 can copy the data after receiving the data.

Once the set of data packets is copied, in the next step 906, the set of data packets can be forwarded to an uplink port.

In the next step 908, the group of data packets are forwarded to the next destination. In one example, the group of data packets can be forwarded to a router.

Returning to step 904, once the data is copied, in the next step 910, the set of data packets can be filtered. In one example, the group of monitoring tools connected to the monitoring port 840 are only interested in email packets. Therefore, in step 912, the offloading module 830 does not send all the network traffic to the monitoring port 840, but can filter out these email packets, monitor the email packets on the port 840, and send all the email packets to the monitoring port 840 at the same time. Other data packets are directed to the monitoring port 842. In one embodiment, if network traffic congestion occurs on a monitoring port, a buffer component can be used to temporarily store data packets.

Once the data packets flow to their respective monitoring ports, in the next step 914, the data packets are output to the monitoring tool of the designated group.

As can be understood from one or more embodiments of the present invention, an integrated switch shunt configuration provides a user-configurable monitoring environment. When a user-configurable shunt module is provided, the network administrator can control the type of data packets to be monitored. By implementing switching and shunting functions in a single network device, routing and monitoring network traffic can exist at the same time, without sacrificing the monitoring function in order to retain the routing function, because each function is controlled by a different processor. In addition, by integrating these functions into a single device, it will save costs due to less physical space to store hardware.

In one aspect of the present invention, the inventor understands that it is generally difficult for managers and/or technicians to obtain statistical data collected by these monitoring tools related to high-density network devices such as network switches. For example, in order to access the collected statistical data, the administrator may have to come to a computer system, and must log in to the system before being able to determine the health status of the network device. In order to facilitate monitoring, a quick and convenient method for capturing statistics such as the usage rate of each network port can substantially reduce the time that IT personnel may spend in supporting a network.

The inventor hereby understands that the above-mentioned visual performance display configuration of a low-density network device such as a port aggregator can also be applied to a high-density network device (for example, network switches, routers, etc.) Device). According to an embodiment of the present invention, a high-density network device with a visual performance display configuration is provided.

FIG. 10 shows a partial schematic diagram of a visual performance display configuration of a high-density network device such as an integrated switch shunt device in an embodiment of the present invention.

In order to facilitate the monitoring of each network port on a network device 1002, a port indicator can be used to display the status of a network port. In one example, the network device 1002 may include 32 network ports. Each of the network ports can be associated with a light emitting diode (LED) port indicator (as shown in the cluster of port indicators 1026 in the figure). In one embodiment, the light color of the LED port indicator can provide a quick status of each network port. According to the color icon 1018, the red LED indicator represents a network port that may require immediate attention. However, the yellow LED indicator can represent a network port that may be worthy of attention. However, the green LED indicator can indicate a network port that behaves as expected. For example, except for network port 19, all network ports have green LED indicators. Unlike previous technologies, IT personnel can quickly obtain the health status of a network port, and can immediately deal with abnormal conditions.

In an embodiment of the present invention, a network device 1002 with a visual performance display configuration 1004 can be provided to display various extremely important network parameters (for example, real-time usage rate, average usage rate, highest peak of traffic spikes, Network parameters such as traffic type and fault conditions). The visual performance display configuration 1004 may be a non-opaque viewing screen such as a liquid crystal display (LCD) screen.

In one embodiment, the network parameters of each network port can be displayed. In one embodiment, the incoming port and outgoing port of a network port can be displayed. The network parameters can be displayed in text and/or graphics.

In one embodiment, statistical data related to a network port is updated periodically. Therefore, the data that can be displayed can reflect real-time numbers. In one example, for network port 1 (1006), the incoming real-time usage rate is 52.250% (1008), and the outgoing real-time usage rate is 46.122% (1010).

In another embodiment, the statistics of the highest peak value of each network port can also be displayed. In one example, the highest peak value of the incoming port of network port 1 is 53.500%, and the highest peak value of the outgoing port is 47.252%. Since this information can be easily obtained, IT personnel can quickly determine the health status of the network port. With a visual performance display configuration, the work of monitoring the network health status will be more efficient. This is because the network parameters can be obtained visually without the need to use a computer to retrieve statistics related to the network port.

Due to physical limitations, the size of the visual performance display configuration 1004 may only be able to visually display a limited amount of data. In one embodiment, the statistics that can be displayed can be cycled. In other words, in order to be able to display statistics related to each network port, different methods can be used to determine when the network data can be recycled. In one example, statistical data can be displayed according to a predetermined time period. In another example, a control component such as a set of buttons 1012 can be used to enable IT personnel to quickly retrieve required data parameters. It can be understood from the foregoing description that other entity embodiments such as a scroll wheel can be used to scroll the statistical data.

As can be understood from one or more embodiments of the present invention, the visual display configuration of a high-density network device provides a rapid status of each port of the network device. With a visual display configuration, IT personnel can maintain and monitor the health of the network. Therefore, IT personnel can be more efficient in monitoring the network and have more time to try to resolve abnormal conditions that may require attention.

Although the present invention has been described with reference to several preferred embodiments, there may be changes, modifications, and equivalents within the scope of the present invention. Although this specification provides various examples, these examples are intended to be illustrations and not to limit the present invention.

In addition, the title and content of the invention are provided for convenience, and the title and content of the invention should not be used to interpret the scope of the patent application of the present invention. In addition, the abstract of the invention is written in a very concise form, and this invention is provided for convenience. Therefore, the abstract should not be used to interpret or limit the entire invention stated in the scope of the patent application. If the term "group" is used in this specification, the term will have its commonly understood mathematical meaning, and encompass zero, one, or more than one member. Please note that there are many alternative ways of implementing the methods and devices of the present invention. Therefore, the final patent application scope will be interpreted as including all such changes, alterations, and equivalents within the true spirit and scope of the present invention.

<p>100. . . Network configuration</p><p>102. . . Ethernet switch</p><p>104. . . Ethernet router</p><p>106,200,300. . . Network splitter</p><p>108,114,218,222,324,832,834. . . path</p><p>110,112,116,120,206,208,210,212,302,304. . . port</p><p>118,122. . . Monitoring device</p><p>202,306. . . Physical interface chip</p><p>214,230,232. . . line</p><p>216. . . Media access control</p><p>220,224. . . Bus line</p><p>226. . . Passive circuit</p><p>308. . . Simplified Gigabit Media Independent Interface Bus</p><p>350. . . RX_CLK signal</p><p>352. . . RX_DV signal</p><p>312. . . Field programmable gate array</p><p>314,316,318,320. . . counter</p><p>358,360,364,368,372. . . Falling edge</p><p>356,362,366,370. . . Rising edge</p><p>354. . . Valid data time period</p><p>322. . . microprocessor</p><p>326. . . Visual display</p><p>500,1002. . . Network device</p><p>502,504,718,720,806,808,810,812,814,816,818,820,822,824,826,828. . . Network port</p><p>506,508,724,726,840,842. . . Monitor port</p><p>510. . . Visual display configuration</p><p>600,700. . . Network switch</p><p>606,608,610,612,614,616,618,620,702,704,706. . . Source port</p><p>604,804. . . Swap chip</p><p>630,632,708,710,836,838. . . On the chain port</p><p>622. . . Mirror port</p><p>624,728. . . Monitoring tools</p><p>602,802. . . Central processing unit</p><p>716. . . Shunt</p><p>722. . . router</p><p>800. . . Integrated switch shunt device</p><p>830. . . Shunt module</p><p>844. . . Management port</p><p>1026. . . Port indicator</p><p>1018. . . Color icon</p><p>1004. . . Visual performance display configuration</p><p>1012. . . Button</p>

The present invention has been described by way of example, but not limitation, with reference to the drawings, and in the drawings, similar code numbers refer to similar elements, in which:

Figure 1 shows a simple network diagram with a network splitter.

Figure 2 shows a schematic diagram of a network splitter.

FIG. 3A shows a simple block diagram of a network tap with a visual performance display configuration in an embodiment of the present invention.

Figure 3B shows a schematic diagram of an RX_CLK and an RX_DV signal in an embodiment of the present invention.

Figure 4 shows a simple flow chart of a method for calculating the usage rate in an embodiment of the present invention.

FIG. 5 shows an example of a network device with a visual performance display configuration in an embodiment of the present invention.

Figure 6 shows a simple block diagram of a switching device with mirroring function.

Figure 7 shows a simple block diagram of a network switch with an external side-by-side shunt configuration.

Figure 8 shows a simple overall view of a network switch with an integrated shunt configuration in an embodiment of the present invention.

Figure 9 shows a simple flow chart of the steps used to enable monitoring in an integrated switch shunt device in an embodiment of the present invention.

FIG. 10 shows a partial schematic diagram of a visual performance display configuration of a high-density network device such as an integrated switch shunt device in an embodiment of the present invention.