A network traffic device comprising: at least one network device adapted to receive network data packets; wherein said at least one network device filters network data packets to locate at least one identifying packet, and samples said network data packets to select at least one sample packet. The at least one network device may transfer said at least one identifying packet and said at least one sample packet to an analyser. A predetermined sample rate may determine the number of sample packets selected by said at least one network device.

A network traffic device comprising: at least one network device adapted to receive network data packets; wherein said at least one network device filters network data packets to locate at least one identifying packet, and samples said network data packets to select at least one sample packet. The at least one network device may transfer said at least one identifying packet and said at least one sample packet to an analyser. A predetermined sample rate may determine the number of sample packets selected by said at least one network device.

A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.

Novel tools and techniques are provided for implementing routing of network traffic across one or more network nodes or utilization of the one or more network nodes based on one or more demand classifications and/or based on detection of a trigger event associated with the one or more demand classifications. In some embodiment, a computing system might monitor network traffic across one or more network nodes or utilization of the one or more network nodes, the network traffic being routed based on a first demand classification. The computing system might determine whether at least one trigger event associated with a second demand classification has occurred. If so, the computing system might adjust the routing of the network traffic across the one or more network nodes or adjust the utilization of the one or more network nodes, based at least in part on the second demand classification.

Novel tools and techniques are provided for implementing routing of network traffic across one or more network nodes or utilization of the one or more network nodes based on one or more demand classifications and/or based on detection of a trigger event associated with the one or more demand classifications. In some embodiment, a computing system might monitor network traffic across one or more network nodes or utilization of the one or more network nodes, the network traffic being routed based on a first demand classification. The computing system might determine whether at least one trigger event associated with a second demand classification has occurred. If so, the computing system might adjust the routing of the network traffic across the one or more network nodes or adjust the utilization of the one or more network nodes, based at least in part on the second demand classification.

A conversion device (10) includes a separation unit (11) that separates an inputted encapsulated packet into flow information and sampled headers including outer headers and inner headers, a decapsulation unit (12) that separates the outer headers from the sampled headers, and a conversion unit (13) that obtains statistics about the inner headers on the basis of the sampled headers separated from the outer headers, generates an xFlow packet including at least statistical information indicating the statistics about the inner headers, and outputs the generated xFlow packet to an external device.

A conversion device (10) includes a separation unit (11) that separates an inputted encapsulated packet into flow information and sampled headers including outer headers and inner headers, a decapsulation unit (12) that separates the outer headers from the sampled headers, and a conversion unit (13) that obtains statistics about the inner headers on the basis of the sampled headers separated from the outer headers, generates an xFlow packet including at least statistical information indicating the statistics about the inner headers, and outputs the generated xFlow packet to an external device.

This application provides a network performance monitoring method, a network device, and a storage medium, and belongs to the field of network technologies. In this application, a forwarding plane samples network performance data based on a fine-grained time periodicity, and records a quantity of network performance exceptions; and a control plane generates, based on a coarse-grained time periodicity, an alarm when the quantity of network performance exceptions recorded by the forwarding plane is greater than a threshold. On a basis of meeting a fine-grained requirement on network performance monitoring, because the control plane does not need to report all the collected network performance data, a volume of data that needs to be reported by the control plane is greatly reduced. This resolves a problem of overload of a main control CPU that is caused by massive data reporting, and reduces dependency of the network performance monitoring on performance of the main control CPU of a device. This further resolves a problem that a large quantity of bandwidth resources are occupied due to the massive data reporting, reduces dependency of the network performance monitoring on the bandwidth resources, and helps meet a requirement for deploying a large quantity of performance monitoring nodes in a live network.

This application provides a network performance monitoring method, a network device, and a storage medium, and belongs to the field of network technologies. In this application, a forwarding plane samples network performance data based on a fine-grained time periodicity, and records a quantity of network performance exceptions; and a control plane generates, based on a coarse-grained time periodicity, an alarm when the quantity of network performance exceptions recorded by the forwarding plane is greater than a threshold. On a basis of meeting a fine-grained requirement on network performance monitoring, because the control plane does not need to report all the collected network performance data, a volume of data that needs to be reported by the control plane is greatly reduced. This resolves a problem of overload of a main control CPU that is caused by massive data reporting, and reduces dependency of the network performance monitoring on performance of the main control CPU of a device. This further resolves a problem that a large quantity of bandwidth resources are occupied due to the massive data reporting, reduces dependency of the network performance monitoring on the bandwidth resources, and helps meet a requirement for deploying a large quantity of performance monitoring nodes in a live network.

Systems and methods include detecting whether a monitored network has a unique configuration; responsive to the unique configuration, determining an ingress point for flow samples; and utilizing the determined ingress point for the flow samples to generate a traffic report for the monitored network. The unique configuration is an inter-Autonomous System (AS) option-C Virtual Private Network (VPN) network where control and data planes are asymmetric. The approach provides traffic projection based on the flow samples with the asymmetric flows.