State-based filtering on a packet switch appliance

摘要

A packet switch appliance includes a plurality of ports. One of the plurality of ports is configured to operate as a network port connected to a packet-switching network. Another of the plurality of ports is configured to operate as a first instrument port connected to a network instrument. To filter packets, one or more packets or copies of packets received through the first network port are examined prior to the packets or copies of packets being sent out the first instrument port to determine a current state of a state-based protocol, which includes a plurality of potential states. A filter is created or modified for the first network port or the first instrument port based on the determined current state of the state-based protocol.

主权项

1. A method of configuring a packet switch appliance connected to a packet-switching network, wherein the packet switch appliance includes a plurality of ports, wherein one of the plurality of ports is configured to operate as a first network port for connection to the packet-switching network, wherein another one of the plurality of ports is configured to operate as a first instrument port for connection to a first network monitoring instrument, the method comprising:
examining one or more packets or copies of packets received through the first network port to determine a current state of a state-based protocol prior to the packets or copies of packets being sent out the first instrument port for processing by the first network monitoring instrument, wherein the state-based protocol includes a plurality of potential states; and creating or modifying a filter for the first network port or the first instrument port based on the determined current state of the state-based protocol; wherein the filter created or modified based on the determined current state of the state-based protocol is configured to filter packets or copies of packets for processing by at least the first network monitoring instrument; wherein the state-based protocol involves an attribute value that changes with a state change, and wherein the attribute value comprises a port number that is dynamically negotiated.