Abstract: At least one technique for distributing traffic from a visibility node to a network tool is disclosed. In certain embodiments, the visibility node has a tool port through which to receive a plurality of packets which each include a compressed header. The visibility node determines, for each packet, whether a given network tool has received the compressed header in decompressed format based on a header-to-tool mapping structure. The structure includes information indicative of which packet headers each of the plurality of network tools have received in decompressed format. If the visibility node determines that the tool previously received the decompressed header, the visibility node transmits the packet to the network tool in compressed format. If the visibility node determines that the tool has not previously received the decompressed header, the visibility node decompresses the compressed header prior to transmitting the packet to the given network tool.

Abstract: At least one technique for distributing traffic from a visibility node to a network tool is disclosed. In certain embodiments, the visibility node has a tool port through which to receive a plurality of packets which each include a compressed header. The visibility node determines, for each packet, whether a given network tool has received the compressed header in decompressed format based on a header-to-tool mapping structure. The structure includes information indicative of which packet headers each of the plurality of network tools have received in decompressed format. If the visibility node determines that the tool previously received the decompressed header, the visibility node transmits the packet to the network tool in compressed format.

Abstract: A method of operating a network visibility node is disclosed. In certain embodiments, the network visibility node has a plurality of network ports through which to communicate data with a plurality of network hosts and has a plurality of tool ports through which to communicate data with a plurality of network tools. The network visibility node accesses a port group map associated with a plurality of tool port groups of the network visibility node, where each of the tool port groups includes one or more tool ports of the network visibility node, and where the port group map contains a separate tool alias for each tool port group of the plurality of tool port groups. Each tool alias can correspond to a different type of network traffic. The network visibility node uses the port group map to ascertain a tool port group through which to communicate the plurality of packets with a particular network tool.

Abstract: A method performed by a network device that taps to a network having a routing device, includes: receiving a first packet tapped from the network; determining a first information regarding an input interface of the routing device based on a destination address of the first packet; receiving a second packet tapped from the network; determining a second information regarding an output interface of the routing device based on a source address of the second packet; determining a first CRC for the first packet; determining a second CRC for the second packet; and comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

Abstract: A method for sampling packets for a network flow, includes: receiving a packet at a network port of a network switch appliance, the network switch appliance comprising an instrument port for communication with a network monitoring instrument; determining whether the packet belongs to a network flow that is desired to be monitored, wherein the act of determining is performed based at least in part on one or more information in a control plane using a processing unit; and passing the packet to the instrument port if the packet belongs to the network flow.

Abstract: A network device includes: one or more ports for tapping to a network; and a processing unit configured for receiving a first packet tapped from the network, wherein the first packet is received at a first network port of the network device; determining a first identity of a first network equipment associated with the first packet based on a discovery protocol; and associating the first identity of the first network equipment with a first identity of the first network port of the network device at which the first packet is received; and a non-transitory medium for storing the first identity of the first network equipment and the first identity of the first network port in association with each other.

Abstract: A method performed by a network device that taps to a network having a routing device, includes: receiving a first packet tapped from the network; determining a first information regarding an input interface of the routing device based on a destination address of the first packet; receiving a second packet tapped from the network; determining a second information regarding an output interface of the routing device based on a source address of the second packet; determining a first CRC for the first packet; determining a second CRC for the second packet; and comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

Abstract: A method performed by a network device that taps to a network having a routing device, includes: receiving a first packet tapped from the network; determining a first information regarding an input interface of the routing device based on a destination address of the first packet; receiving a second packet tapped from the network; determining a second information regarding an output interface of the routing device based on a source address of the second packet; determining a first CRC for the first packet; determining a second CRC for the second packet; and comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

Abstract: A method performed by a network device that taps to a network having a routing device, includes: determining a first information regarding an input interface of the routing device for a packet; determining a second information regarding an output interface of the routing device for the packet; determining whether the packet belongs to a user-defined category based on one or more mapping formation defined at the network device; and storing the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category in a non-transitory medium in association with each other.

Abstract: A method performed by a network device that taps to a network having a routing device, includes: receiving a first packet tapped from the network; determining a first information regarding an input interface of the routing device based on a destination address of the first packet; receiving a second packet tapped from the network; determining a second information regarding an output interface of the routing device based on a source address of the second packet; determining a first CRC for the first packet; determining a second CRC for the second packet; and comparing the first CRC with the second CRC at the network device to determine whether the first packet and the second packet are the same.

Abstract: A method performed by a network device that taps to a network having a routing device, includes: determining a first information regarding an input interface of the routing device for a packet; determining a second information regarding an output interface of the routing device for the packet; determining whether the packet belongs to a user-defined category based on one or more mapping formation defined at the network device; and storing the packet, the first information regarding the input interface of the routing device, the second information regarding the output interface of the routing device, and information regarding the user-defined category in a non-transitory medium in association with each other.

Abstract: A network device includes: one or more ports for tapping to a network; and a processing unit configured for receiving a first packet tapped from the network, wherein the first packet is received at a first network port of the network device; determining a first identity of a first network equipment associated with the first packet based on a discovery protocol; and associating the first identity of the first network equipment with a first identity of the first network port of the network device at which the first packet is received; and a non-transitory medium for storing the first identity of the first network equipment and the first identity of the first network port in association with each other.

Abstract: A packet switch system includes a packet switch appliance having a first network port configured to receive packets, and a first instrument port configured to communicate with a network monitoring tool, a storage system for storing the packets, and an integrated circuit configured to retrieve the packets from the storage system, and retroactively transmit the packets to the first instrument port in a play-back configuration in response to a user's command.

Abstract: A method for sampling packets for a network flow, includes: receiving a packet at a network port of a network switch appliance, the network switch appliance comprising an instrument port for communication with a network monitoring instrument; determining whether the packet belongs to a network flow that is desired to be monitored, wherein the act of determining is performed based at least in part on one or more information in a control plane using a processing unit; and passing the packet to the instrument port if the packet belongs to the network flow.

Abstract: A packet switch system includes a packet switch appliance having a first network port configured to receive packets, and a first instrument port configured to communicate with a network monitoring tool, a storage system for storing the packets, and an integrated circuit configured to retrieve the packets from the storage system, and retroactively transmit the packets to the first instrument port in a play-back configuration in response to a user's command.

Abstract: An analyzer for a wireless network is configured for surfing a plurality of channels, each for an individually selectable period of time, for monitoring each channel to obtain packet information for analysis, to detect any defects in communication over each respective channel.

Abstract: A system, method and computer program product are provided for analyzing a network. Initially, network traffic information relating to network traffic is collected. Next, the network traffic information is encrypted. In use, the network traffic information is capable of being analyzed by a network analyzer adapted for decrypting the network traffic information.