Systems and methods for generating network flow information

Abstract

A packet forwarding network may include switches that forward network packets between end hosts. A monitoring network may be coupled to the forwarding network. A controller may control switches in the monitoring network to forward network packets tapped from the forwarding network to network flow information generation circuitry. The controller may provide configuration information such as record description information to the network flow information generation circuitry. Based on the configuration information, the network flow information generation circuitry may dynamically generate instructions that generate network flow information records. A set of network flow information records may be stored in a repository at the network flow information generation circuitry. The repository may include hash values associated with each of the stored network flow information records. By dynamically generating instructions to populate network flow information records, extraneous generalized instructions may be omitted and network flow information may be more efficiently generated.

What is claimed is: 
     
         1 . A method of operating network flow information generation circuitry coupled to a network, the method comprising:
 receiving a network traffic monitoring parameter associated with a flow record template;   after receiving the network traffic monitoring parameter, generating a set of instructions at the network flow information generation circuitry based on the network traffic monitoring parameter;   receiving network traffic from the network; and   generating a flow record that corresponds to the flow record template by executing the set of instructions based on the network traffic.   
     
     
         2 . The method defined in  claim 1 , wherein generating the set of instructions at the network flow information generation circuitry based on the network traffic monitoring parameter comprises generating the set of instructions in real-time at the network flow information generation circuitry based on the network traffic monitoring parameter. 
     
     
         3 . The method defined in  claim 1 , wherein the network traffic monitoring parameter comprises a record description for the flow record template, the set of instructions being specific to the record description. 
     
     
         4 . The method defined in  claim 3 , wherein the record description defines a key field and the set of instructions includes an instruction to generate a hash value based on the key field. 
     
     
         5 . The method defined in  claim 4  further comprising:
 performing a lookup operation in a database of flow records at the network flow information generation circuitry using the hash value. 
 
     
     
         6 . The method defined in  claim 1  further comprising:
 reconciling the flow record with a database of active flow records; and 
 exporting a portion of the database of active flow records through the network. 
 
     
     
         7 . The method defined in  claim 6  further comprising:
 exporting the network traffic monitoring parameter through the network. 
 
     
     
         8 . The method defined in  claim 6 , wherein flow records in the database of active flow records are consistent with at least a consolidation protocol selected from the group consisting of IP flow information export protocol and NetFlow protocol. 
     
     
         9 . The method defined in  claim 1 , wherein generating the flow record comprises generating a candidate flow record. 
     
     
         10 . The method defined in  claim 9  further comprising:
 determining whether an active flow record related to the candidate flow record exists in a database of flow records at the network flow information generation circuitry. 
 
     
     
         11 . The method defined in  claim 10  further comprising:
 in response to determining that the related active flow record exists in the database of flow records, merging the candidate flow record with the related active flow record. 
 
     
     
         12 . The method defined in  claim 11 , wherein merging the candidate flow record with the related active flow record comprises updating a packet count field in the related active flow record. 
     
     
         13 . The method defined in  claim 10  further comprising:
 in response to determining that the related active flow record does not exist in the database of flow records, finalizing the candidate flow record and storing the finalized candidate flow record as an additional flow record in the database of flow records. 
 
     
     
         14 . The method defined in  claim 1 , wherein generating the flow record comprises populating a source address field in the flow record based on a network packet in the network and populating a destination address field in the flow record based on the network packet. 
     
     
         15 . The method defined in  claim 14  further comprising:
 generating a hash value for the flow record using at least one of the source address field or the destination address field in the flow record as a key input. 
 
     
     
         16 . The method defined in  claim 15  further comprising:
 performing a lookup operation using the hash value for the flow record to determine whether a related flow record is stored in a database of flow records in the network flow information generation circuitry. 
 
     
     
         17 . Network flow information generation circuitry comprising:
 processing circuitry configured to:
 receive configuration information indicative of a flow record description, 
 generate a set of instructions based on the configuration information, and 
 generate a candidate flow record associated with the flow record description based on the set of instructions; and 
   memory circuitry configured to store a database of active flow records, wherein the processing circuitry is further configured to reconcile the candidate flow record with the database of active flow records.   
     
     
         18 . The network flow information generation circuitry defined in  claim 17 , wherein the processing circuitry is configured to reconcile the candidate flow record with the database of active flow records by performing a lookup operation to determine whether an active flow record related to the candidate flow record exists in the database of active flow records. 
     
     
         19 . A method of operating a controller that controls a network coupled to network flow information generation circuitry, the method comprising:
 providing a network traffic monitoring parameter to the network flow information generation circuitry;   controlling one or more switches in the network to forward network traffic to the network flow information generation circuitry;   controlling the network flow information generation circuitry to generate, based on the network traffic monitoring parameter, a set of instructions indicative of actions to be performed on the network traffic to generate a flow record; and   controlling the network flow information generation circuitry to generate the flow record based on the network traffic and the set of instructions.   
     
     
         20 . The method defined in  claim 19 , wherein the flow record is reconciled with a depository of finalized flow records, the method further comprising:
 controlling one or more switches in the network to forward at least a portion of the depository of finalized flow records and the network traffic monitoring parameter to an end host coupled to the network.