Incast drop cause telemetry

Abstract

Aspects of the subject disclosure relate to ways to capture packet metadata following an incast event. In some implementations, a method of the subject technology can include steps for receiving a plurality of data packets at a network device, storing each of the plurality of packets in a buffer, and detecting a packet drop event for one or more incoming packets, wherein the one or more incoming packets are not stored in the queue. In some aspects, the method can further include steps for indicating a marked packet from among the received data packets, dequeuing each of the plurality of packets in the buffer, capturing metadata for each dequeued packet until the marked packet is dequeued.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 receiving a plurality of data packets at a network device;   storing, by the network device, each of the plurality of packets in a buffer;   detecting, by the network device, a packet drop event for one or more incoming packets, wherein the one or more incoming packets are not stored in the buffer;   indicating a marked packet from among the plurality of received data packets, wherein the marked packet indicates a last packet enqueued prior to the packet drop event;   dequeuing each of the plurality of packets in the buffer; and   capturing metadata for each dequeued packet until the marked packet is dequeued.   
     
     
         2 . The computer-implemented method of  claim 1 , further comprising:
 determining a cause of an incast event at the network device based on the metadata.   
     
     
         3 . The computer-implemented method of  claim 1 , further comprising:
 sending the captured metadata for one or more of the dequeued packets to one or more remote collectors for further processing.   
     
     
         4 . The computer-implemented method of  claim 1 , further comprising:
 identifying one or more applications associated with one or more of the plurality of packets in the buffer prior to the drop event.   
     
     
         5 . The computer-implemented method of  claim 1 , wherein the packet drop event corresponds with an incast event at the network device. 
     
     
         6 . The computer-implemented method of  claim 1 , wherein identifying the marked packet further comprises:
 modifying, by the network device, packet header information associated with the marked packet.   
     
     
         7 . The computer-implemented method of  claim 1 , wherein the metadata for each dequeued packet comprises one or more of the following: a destination address, an origination address, a tenant network identifier, a protocol type, or a virtual local area network (VLAN) identification. 
     
     
         8 . The computer-implemented method of  claim 1 , wherein indicating the marked packet from among the plurality of received data packets, further comprises:
 modifying packet header information of the marked packet.   
     
     
         9 . A system for capturing metadata information after an incast event, the system comprising:
 a memory; and   one or more processors coupled to the memory, wherein the one or more processors are configured to perform operations comprising:
 receiving a plurality of data packets at a network device; 
 storing, by the network device, each of the plurality of packets in a buffer; 
 detecting, by the network device, a packet drop event for one or more incoming packets, wherein the one or more incoming packets are not stored in the buffer; 
 indicating a marked packet from among the plurality of received data packets, wherein the marked packet indicates a last packet enqueued prior to the packet drop event; 
 dequeuing each of the plurality of packets in the buffer; and 
 capturing metadata for each dequeued packet until the marked packet is dequeued. 
   
     
     
         10 . The system of  claim 9 , wherein the one or more processors are further configured to perform operations comprising:
 determining a cause of an incast event at the network device based on the metadata.   
     
     
         11 . The system of  claim 9 , wherein the one or more processors are further configured to perform operations comprising:
 sending the captured metadata for one or more of the dequeued packets to one or more remote collectors for further processing.   
     
     
         12 . The system of  claim 9 , wherein the one or more processors are further configured to perform operations comprising:
 identifying one or more applications associated with one or more of the plurality of packets in the buffer prior to the drop event.   
     
     
         13 . The system of  claim 9 , wherein the packet drop event corresponds with an incast event at the network device. 
     
     
         14 . The system of  claim 9 , wherein identifying the marked packet further comprises:
 modifying, by the network device, packet header information associated with the marked packet.   
     
     
         15 . The system of  claim 9 , wherein the metadata for each dequeued packet comprises one or more of the following: a destination address, an origination address, a tenant network identifier, a protocol type, or a virtual local area network (VLAN) identification. 
     
     
         16 . The system of  claim 9 , wherein indicating the marked packet from among the plurality of received data packets, further comprises:
 modifying packet header information of the marked packet.   
     
     
         17 . A non-transitory computer-readable storage medium comprising instructions stored therein, which when executed by one or more processors, cause the processors to perform operations comprising:
 receiving a plurality of data packets at a network device;   storing, by the network device, each of the plurality of packets in a buffer;   detecting, by the network device, a packet drop event for one or more incoming packets, wherein the one or more incoming packets are not stored in the buffer;   indicating a marked packet from among the plurality of received data packets, wherein the marked packet indicates a last packet enqueued prior to the packet drop event;   dequeuing each of the plurality of packets in the buffer; and   capturing metadata for each dequeued packet until the marked packet is dequeued.   
     
     
         18 . The non-transitory computer-readable storage medium of  claim 17 , wherein the processors are further configured to perform operations comprising:
 determining a cause of an incast event at the network device based on the metadata.   
     
     
         19 . The non-transitory computer-readable storage medium of  claim 17 , wherein the one or more processors are further configured to perform operations comprising:
 sending the captured metadata for one or more of the dequeued packets to one or more remote collectors for further processing.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 17 , wherein the processors are further configured to perform operations comprising:
 identifying one or more applications associated with one or more of the plurality of packets in the buffer prior to the drop event.   
     
     
         21 . The non-transitory computer-readable storage medium of  claim 17 , wherein the packet drop event corresponds with an incast event at the network device. 
     
     
         22 . The non-transitory computer-readable storage medium of  claim 17 , wherein identifying the marked packet further comprises:
 modifying, by the network device, packet header information associated with the marked packet.   
     
     
         23 . The non-transitory computer-readable storage medium of  claim 17 , wherein the metadata for each dequeued packet comprises one or more of the following: a destination address, an origination address, a tenant network identifier, a protocol type, or virtual local area network (VLAN) identification.