Generation of informative MAC headers for analysis of ATM routed LAN frames

[0002] ATM or asynchronous transfer mode is a data communications standard for allowing the delivery of data packets or frames to and from different network elements. An ATM network allows for the use and transfer of multiple types of data, e.g. constant bit rate, variable bit rate such as packets, video data, voice data, etc.

[0003] ATM transfers two types of Ethernet data. One type is bridged data or bridged frames. ATM bridged frames retain both the source and destination MAC address (Media Access Control), which may be a hardware address of a NIC (Network Interface Card) card in a PC. Thus, with bridged data, the source unit and destination unit are known. The other type of data is routed data or routed frames. Bridged data is used when a physical network is extended to include a larger number of network elements. Bridged data is viewed by all of the elements attached to the network. Routed data is used when a physical network is segmented, e.g. segmented geographically. The segmentation allows the data to be intelligently routed, i.e. routed to a specific device. The routed data is only viewed by the elements attached to the segment and not the entire network, if the routing is properly performed. Thus, system bandwidth is used more efficiently with routed data. A router selects a path based upon specific protocols and the destination address, and attempts to select the best or shortest path. Thus, the routers may strip the MAC headers off of the frames, and insert their own specific routing codes. Routers may be attached to an ATM network for the transmission of data. ATM uses a VPI (Virtual Path Identifier), and VCI (Virtual Channel Identifier), which together, make up a destination address, VP.VC.

[0004] The stripped headers cause problems during network analysis, particularly when the network analyzer software is designed to work with frames that have MAC headers. The exact source and destination MAC address of the routed frame may not be determined as the source information has been stripped out.

[0005] One prior art solution is to not reformat the data and just analyze the stripped frames. However, this approach results in a large reduction in the amount of LAN or WAN analysis that can be performed, particularly the lower layer analysis, as the source and destination of the data is not known. Thus, the MAC address layer would be lost, and the physical source and destination units could not be examined. Note that the lower layers would include physical and datalink layers, and the upper layers include network up through application layers. Since the data carried within the routed frame may include upper level addressing, e.g. TCP port or application address, then upper level analysis may take place.

[0006] Therefore, there is a need in the art for mechanism which allow network analysis software to operate on ATM systems using routed frames with MAC headers which have been stripped out, with the benefit of being able to tie upper layer analysis back to the lower layer ATM traffic carrying the data.

[0007] These and other objects, features and technical advantages are achieved by a system and method which allows routed frames to be analyzed by software that expects a MAC layer header.

[0008] The inventive mechanism is an interface which generates imitation MAC addresses and places the imitation addresses in the proper location, which is before the data portion of the frame. Thus, the software may perform analysis of the ATM network protocol layer and higher layers.

[0009] The imitation address is formed from useful information which will enhance the troubleshooting process of the analyzer software. The information would allow for upper layer protocol problems to be mapped down to lower layer ATM problems. The information must fill two addresses in order to create the imitation header which will be placed at the front of a routed frame, the source and the destination. Since ATM is destination based, the ATM destination address is encoded into the destination address of the imitation header. The port address upon which the data frame is captured is used as the source address of the imitation header. While this will not precisely identify the exact source of the frame, it will provide some intelligence as to its identity.

[0010] This invention will allow the use of existing software to do protocol analysis of routed ATM frames, and provide a link back to the ATM cells that carried the data. If for instance, the upper layer protocol analysis indicates a re-transmission at one of the upper layers, the encoded information would allow inspection of the cell layer and examination of data on the specific VP.VC to determine if the re-transmissions were the result of problems at the ATM layer, i.e. HEC errors.

[0011] Therefore, it is a technical advantage of the invention to allow network analyzer software which expects MAC protocols to operate with ATM routed frames.

[0012] It is a further technical advantage of the invention to generate imitation MAC headers from useful information which will improve the troubleshooting process of the network analyzer software.

[0013] The foregoing has outlined rather broadly the features and technical advantages of the present invention in order that the detailed description of the invention that follows may be better understood. Additional features and advantages of the invention will be described hereinafter which form the subject of the claims of the invention. It should be appreciated by those skilled in the art that the conception and the specific embodiment disclosed may be readily utilized as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. It should also be realized by those skilled in the art that such equivalent constructions do not depart from the spirit and scope of the invention as set forth in the appended claims.

[0014] For a more complete understanding of the present invention, and the advantages thereof, reference is now made to the following descriptions taken in conjunction with the accompanying drawings, in which:

[0015] FIG. 1 depicts the inventive interface mechanism coupled to an ATM network;

[0016] FIG. 2 depicts an example of an Ethernet frame with a MAC header;

[0017] FIG. 3 depicts an example of a routed frame relay frame with the MAC header stripped off using a NLPID; and

[0018] FIG. 4 depicts an example of a routed frame relay frame with the MAC header stripped off and including a SNAP header.

[0019] FIG. 1 depicts the inventive interface mechanism 11 coupled ATM network 12 and network analyzer 13. The analyzer 13 is connected to the network 12 via two ports 16. Note that the analyzer could have more than two ports, and the interface 11 could reside outside of the analyzer 13, i.e. between the network 12 and the analyzer 13. Router 15 is connected to the ATM network 12. The network analyzer 13 includes protocol analysis application 14. An example of such an application is the Off-Net Sniffer® software for Ethernet from Network General Corporation. Typically, analysis applications can capture network data in one format, i.e. frame data which includes a MAC header because the router sends the frame to a particular location, whereas, a bridge would send the frame to all locations on the link. However, router 15 would send a frame without the MAC header. For example, the RFC 1483 routed frame 30 as shown in FIG. 3, wherein the MAC header has been stripped off by the router 15.

[0020] The inventive interface 11 places a MAC header 21 into the routed frame, and forms an ethernet frame 20 as shown in FIG. 2. The MAC header will allow the application to process the data in the routed frame. Generating a place holder, which provides no useful information, will allow the processing of the frame. However, the analyzer will only be able to perform analysis from the network layer on up, and will not be able to map the data frame down to the ATM address layer. The MAC header includes destination address 22, source address 23, and ethertype 24. These are depicted in FIG. 2 as being 6, 6, and 2 octets in size, respectively. The remainder of the frame 20 includes data 25 and FCS 26 or frame check sequence which is for error detection.

[0021] Instead using a place holder, the interface 11 inserts useful information about the source and destination of the data frame into the MAC header. Thus, the analyzer can associate the LAN data in the frame down to the ATM layer or headers. The interface generates the two addresses, source and destination, that form a MAC header along with a proper ethertype, and places the generated header at the front of a routed frame. Note that in some instances the ethertype 41 is present in the routed frame, as shown in FIG. 4, and in other instances the ethertype may have been stripped out along with the MAC addresses, as shown in FIG. 3. The inventive interface 11 will either locate the ethertype 41 in the routed frame, or will fabricate the ethertype from data within the routed frame, e.g. the network level protocol ID (NLPID) 31. The inventive interface 11 will then place the ethertype in the proper location of the MAC header, as shown in FIG. 2.

[0022] Since ATM is destination based, the ATM destination address is encoded into the destination address of the generated MAC header. The generated destination address is 48 bits, which corresponds to a MAC header address. The ATM addressing use to generate the MAC address is either UNI having 24 bits or NNI having 28 bits, both of which describe the VP.VC identifiers. Thus, the remaining portion of the 48 bits may be filled in with other data. Such data can include codes which indicate that the address is a generated address, and not an actual address. The following is an example of the encoding for a generated destination address. The first 3 bytes, or 24 bits, are encoded with the HP company prefix, 0×80, 0×00, 0×09. This could be used to identify that the source is a generated addresses. The next byte, or 8 bits, is encoded with the 8 bit UNI Virtual Path Identifier (VP) from the ATM destination address. The next 2 bytes, or 16 bits, are encoded with the 16 bit UNI Virtual Channel Identifier (VC). Thus, the analyzer 13 would be able to determine which VP.VC the frame data was destined for on the ATM network. For example, the analyzer would be able to detect the amount of traffic destined to a particular address in the network, as identified by the VP.VC.

[0023] As stated earlier, ATM is destination based, and thus, does not transmit source data. Thus, the interface 11 generates a source address from other information. The generated source address is 48 bits, which corresponds to a MAC source address. The interface uses the 8 bit address of the port upon which the analyzer 13 has capture the frame data. Thus, the remaining portion of the 48 bits must be filled in with other data. Such data can include codes which indicate that the address is a generated address, and not an actual address. The following is an example of the encoding for a generated source address. The last 8 bits of the source address comprise the analyzer port upon which the frame data was captured, e.g. port 0 or 1. The first 3 bytes or 24 bits are encoded with the HP company prefix, 0×80, 0×00, 0×09. This could be used to identify that the source is a generated addresses. In the next two bytes, or 16 bits, the hex values of the word FAB are encoded, which are 0×0F, 0×AB. This also indicates that the source address is generated of fabricated.

[0024] Note that the generated source address does not specify the source of the frame. However, it does provide some intelligence back to the ATM layer that was carrying the data. The knowledge of the port would provide an indication as to which portion of the ATM network was carrying the data. This would be of assistance in determining the root cause of ATM level errors. For instance, a fiber or wire could be followed back to the transmitting port. Thus, the transmitting port could then be tested to determine if the hardware on the port is functioning properly. Note that there are two ports shown in FIG. 1, however, the inventive mechanism can encode more than two ports as the point of capture of the data frame.

[0025] The inventive interface mechanism 11 will also operate with WAN data, known as ATM Frame Relay data. For example, the RFC 1490 relay frame 40 as shown in FIG. 4, wherein the MAC header has been stripped off by the router 15. Note that the frame of FIG. 4 also includes a sub-network access protocol (SNAP) header. WAN frame relay is another layer of protocol, which resides on top of ATM protocol. Frame relay has its own identifier, DLCI, for Data Link Channel Identifier. The inventive interface encodes this identifier into the generated MAC header. Thus, the frame data could be mapped back to the frame relay addressing protocol layer, as well the ATM addressing protocol layer.

[0026] Frame relay is also destination based, and thus, DLCI would be encoded into the generated destination address. The following is an example of an encoding for a generated destination address of frame relay data. The first 3 bytes or 24 bits of the generated address are encoded with the DLCI identifier. The next byte, or 8 bits, is encoded with the 8 bit UNI Virtual Path Identifier (VP) from the ATM destination address. The next 2 bytes, or 16 bits, are encoded with the 16 bit UNI Virtual Channel Identifier (VC). The source address could be encoded as follows. The first 3 bytes or 24 bits are encoded with the HP company ID or prefix, 0×80, 0×00, 0×09. The next two bytes, or 16 bits, are encoded with the hex values of 0×D1C1, which would indicate that the address includes frame relay DLCI (note the similar appearance to the encoded D1C1). The last 8 bits of the source address comprise the analyzer port upon which the frame data was captured, e.g. port 0 or 1.

[0027] Thus, the analyzer 13 would be able to determine which VP.VC the frame data was destined for on the ATM network and the frame relay channel that carried the data. Thus, upper layer data can be mapped back down to the ATM protocol layer, or to a particular DLCI on the frame relay layer.

[0028] Although the present invention and its advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the invention as defined by the appended claims.