Abstract: A method and system for exported flow tracking information is disclosed. The method includes receiving, by a network device, a network traffic flow comprising a data packet, and transmitting, by the network device, a message comprising a network device identifier (NDID), a template set, and an options template set using a traffic analysis protocol. The message is received by a flow collector, and a template record comprising a flow template identifier (FTID) and at least one flow key is extracted from the template set. An options template record comprising a metadata template identifier (MTID) and at least one metadata key is extracted from the options template set. The method includes generating a new repository entry using the NDID, the FTID, the at least one flow key, the MTID, and the at least one metadata key, and storing, by the flow collector, the new repository entry in the Flow Tracking Repository (FTR).

Abstract: A method and system for exported flow tracking information is disclosed. The method includes receiving, by a network device, a network traffic flow comprising a data packet, and transmitting, by the network device, a message comprising a network device identifier (NDID), a template set, and an options template set using a traffic analysis protocol. The message is received by a flow collector, and a template record comprising a flow template identifier (FTID) and at least one flow key is extracted from the template set. An options template record comprising a metadata template identifier (MTID) and at least one metadata key is extracted from the options template set. The method includes generating a new repository entry using the NDID, the FTID, the at least one flow key, the MTID, and the at least one metadata key, and storing, by the flow collector, the new repository entry in the Flow Tracking Repository (FTR).

Abstract: A method and network device for tagging network traffic flows. Specifically, the method and system disclosed herein entail the incorporation of static user-defined tag information, as well as dynamic screener-defined tag information (if appropriate), into flow tracking information exported from flow tracking-capable network devices to one or more flow collectors. Incorporation of the aforementioned tag information enhances the ability of the flow collector(s) to index, as well as retrieve, the flow tracking information. Through enhanced indexing and retrieval, speedier analysis of the flow tracking information, by one or more flow analyzers, may also be possible.

Abstract: A method and network device for tagging network traffic flows. Specifically, the method and system disclosed herein entail the incorporation of static user-defined tag information, as well as dynamic screener-defined tag information (if appropriate), into flow tracking information exported from flow tracking-capable network devices to one or more flow collectors. Incorporation of the aforementioned tag information enhances the ability of the flow collector(s) to index, as well as retrieve, the flow tracking information. Through enhanced indexing and retrieval, speedier analysis of the flow tracking information, by one or more flow analyzers, may also be possible.

Abstract: In one embodiment, line cards of packet switching or other network devices are configured for terminating pseudowires. Typically, this includes multiple line cards being configured for terminating a same pseudowire, which allows the corresponding pseudowire traffic to be received by any one of these multiple line cards. Each of these pseudowire-terminating line cards is typically configured to apply one or more features to a pseudowire packet. Examples of these features include, but are not limited to: Access Control List, Quality of Service, Netflow, and Lawful Intercept. For a received packet to be sent out one of these pseudowires, a two-stage lookup operation can be used to first identify the pseudowire over which to forward the packet; and a second lookup operation based on the pseudowire to identify forwarding information corresponding to a path through a network over which a corresponding pseudowire is configured.

Abstract: In one embodiment, line cards of packet switching or other network devices are configured for terminating pseudowires. Typically, this includes multiple line cards being configured for terminating a same pseudowire, which allows the corresponding pseudowire traffic to be received by any one of these multiple line cards. Each of these pseudowire-terminating line cards is typically configured to apply one or more features to a pseudowire packet. Examples of these features include, but are not limited to: Access Control List, Quality of Service, Netflow, and Lawful Intercept. For a received packet to be sent out one of these pseudowires, a two-stage lookup operation can be used to first identify the pseudowire over which to forward the packet; and a second lookup operation based on the pseudowire to identify forwarding information corresponding to a path through a network over which a corresponding pseudowire is configured.