WHY PACKET DEDUPLICATION?
It is common that a single packet capturing device (such as a passive probe, or any other passive tool analyzing the network performances) to receive multiple copies of the same data within a network.
This often occurs when customers use SPAN (also known as Port Mirroring) technology to collect traffic from multiple VLANs or ports on a switch/router and direct it to a single packet capturing device. In such cases, the packet capturing tool might see identical IP packets multiple times, even when network performance is not compromised.
Consider the following example: PC-A in VLAN 1 sends IP packets to PC-C in VLAN 2, routed through a multi-layer switch. At the switch’s mirror port, both ingress and egress copies of each packet from this stream are captured, creating duplicate packets. Monitoring only the ingress traffic would prevent this duplication, but then packets from PC-B to PC-A or PC-C would not be captured.
Fig.1: Simple port mirroring scheme
When all this traffic is directed to the same packet capturing tool, the device may interpret the duplicates as retransmissions, leading to an overestimation of data volume. This misinterpretation impairs effective network monitoring by skewing statistical accuracy and inflating perceived traffic levels or network errors.
MICROTEL INNOVATION SOLUTION
Removing duplicate packets at the monitoring tool level is not the solution. These tools are already burdened with handling and processing network traffic and typically lack the processing power to efficiently manage an additional, resource-intensive task like deduplication.
Microtel Innovation offers an effective solution with its product: A-XFE-DEDUP, a high-performance Network Packet Broker with 20 x 40/100 Gb/s input/output ports.
Its key features include:
- Advanced Network Packet Broker with high-performance packet deduplication capabilities
- Configurable packet fields for duplicate detection, with intervals ranging from 66 ms to 1 second
- GTP Balancer with session-based GTP filtering
This device ensures efficient network monitoring by eliminating duplicate packets before they reach the monitoring tool, thereby maintaining data accuracy and reducing the load on monitoring systems.
