Method for application identification and path selection, wireless access point and storage medium

Abstract

The invention discloses a method for application identification and path selection, a wireless access point and a storage medium. The wireless access point comprises a memory; and one or more processors operably coupled to the memory, the one or more processors configured to: receive a first packet for an application; configuring an initial packet flow for the application, the initial packet flow including a first forwarding action to send traffic for the application via the tunnel path; learning applications of the first group; generating an entry specifying an address of the application server and a second forwarding action in an application server address cache based on the policy of the application to send traffic for the application via a local grooming path; receiving a second packet for the application; and in response to determining that the destination address of the second packet matches the entry in the application server address cache, configuring a subsequent packet flow for the application, the subsequent packet flow including a second forwarding action to send traffic for the application via the local grooming path.

Description

[0001] This application is a divisional application of the Chinese application with application number 202011486107.3, application date December 16, 2020, and invention name “Method, wireless access point and storage medium for application identification and path selection”, and all its contents are incorporated herein for reference. Technical Field

[0002] The present disclosure relates to computer networks, and more particularly, to access points for computer networks. Background Art

[0003] A computer network is a collection of interconnected computing devices that can exchange data and share resources. In a packet-based network (such as an Ethernet network), computing devices communicate data by dividing the data into variable-length blocks called packets, which are individually routed from a source device to a destination device. Intermediate network devices (such as access points, gateways, firewalls, switches, and routers) are used to transmit packets between source and destination devices. The destination device extracts the data from the packets and assembles the data into its original form.

[0004] In some instances, a source device (such as a wireless device) connects to an access point (otherwise referred to as a "wireless access point") to connect to a wired computer network (such as an enterprise network, a branch network, a service provider network, a home network, a virtual private network (VPN), a local area network (LAN), a virtual LAN (VLAN), etc.). For example, the access point can receive application traffic from the source device and tunnel the application traffic (e.g., using Generic Routing Encapsulation (GRE)) to a gateway device of the enterprise network, which in turn sends the application traffic to a destination device (such as an application server). Summary of the invention

[0005] The present disclosure describes techniques for application identification and application-based path selection at a wireless access point. For example, when an access point receives traffic for an application hosted on an application server, without tunneling all application traffic from the access point to a gateway device, the access point is configured to send the traffic on a local breakout path or tunnel based on an identification of a source application from which the traffic originates.

[0006] According to the described technology, a wireless access point includes a cache that stores one or more application server addresses and one or more forwarding actions for application traffic. The cache is referred to herein as an "application server address cache." The wireless access point uses the application server address cache to configure subsequent packet flows for the application and configure the wireless access point to send the subsequent packet flows to the application server via a local grooming path or a tunnel path.

[0007] As an example, the wireless access point receives an initial packet for an application and configures a first packet flow for the application (also referred to herein as an "initial packet flow" or a "learning flow"), for example, by generating a flow entry for the first packet flow in a flow table. The flow entry may include one or more values ​​for identifying packet headers (e.g., source address, destination address, source port, destination port, protocol, etc.) of subsequent packets associated with the first packet flow. The flow entry for the initial packet flow also includes a forwarding action to send the initial packet flow to the application server via a tunnel, because the initial packet flow is tunneled by default to a gateway device that has established a communication session with the application server.

[0008] The wireless access point learns the application associated with the packet, for example, by sending the packet to a deep packet inspection (DPI) engine (e.g., internal or external to the wireless access point) and receiving classification information for the application (e.g., application name, application identifier, and / or application group / type). When the wireless access point receives the classification information for the application from the DPI engine, the wireless access point determines whether the wireless access point is configured with a policy for the application, and configures an entry in the application server address cache based on the policy for the application, the entry including the application server address and a forwarding action (e.g., a local grooming path) through which the wireless access point sends application traffic. For example, the wireless access point may receive classification information for a video streaming application, and based on a policy that specifies a forwarding action for the video streaming application traffic to send traffic on a local grooming path, configure an entry in the application server address cache including a server address of the video streaming application (determined from a destination address of the packet) and a forwarding action.

[0009] The wireless access point uses the application server address cache to configure a subsequent packet flow for the application and configures the wireless access point to send the subsequent packet flow to the application server via a specified forwarding action. For example, the wireless access point may receive a subsequent packet for the application and, instead of sending the subsequent packet to the DPI engine, perform a lookup of the application server address cache to determine whether the destination address of the subsequent packet matches the application server address stored in the application server address cache. If the destination address of the subsequent packet matches the application server address in the application server address cache, the wireless access point configures a second packet flow (also referred to herein as a "subsequent packet flow" or "grooming flow"), for example, by generating a flow entry for the subsequent packet flow in a flow table. The flow entry for the subsequent packet flow includes a forwarding action to send application traffic associated with the subsequent packet flow to the application server via a local grooming path or a tunnel path. For example, the application server address cache may store the address of a video streaming application server and a forwarding action to send traffic for the video streaming application via a local grooming path. If the destination address of the subsequent packet matches the address of the video streaming application server in the application server address cache, the wireless access point configures a subsequent packet flow with a forwarding action to send the video streaming application traffic via the local grooming path.

[0010] In this way, if the wireless access point receives application traffic associated with an initial packet flow (i.e., matches the matching criteria of the flow entry for the initial packet flow), the wireless access point determines from the forwarding action of the initial packet flow that the wireless access point sends the application traffic associated with the initial packet flow to the application server via the tunnel. If the wireless access point receives application traffic associated with a subsequent packet flow (i.e., matches the matching criteria of the flow entry for the subsequent packet flow), the wireless access point determines from the forwarding action of the subsequent packet flow that the wireless access point sends the application traffic associated with the subsequent packet flow to the application server via the local grooming path.

[0011] The techniques described in the present disclosure may provide one or more technical advantages for implementing at least one practical application. For example, by configuring a wireless access point to send certain application traffic (e.g., bandwidth-intensive applications) via a local grooming path, the wireless access point does not tunnel all application traffic to a gateway device of an enterprise network, which may reduce the load on the enterprise network. In addition, an application address server including one or more addresses of an application server and one or more forwarding actions enables the wireless access point to select a path based on an application rather than by protocol or port. In addition, by configuring a wireless access point to send application traffic associated with an initial packet flow to a gateway device via a tunnel that may have an existing communication session (e.g., a Transmission Control Protocol (TCP) session) with an application server, the wireless access point avoids the need to establish a new communication session between the wireless access point and the application server.

[0012] In one example, the present disclosure describes a method, which includes: receiving, by a wireless access point, a first packet for an application provided by an application server; configuring, by the wireless access point, an initial packet flow for the application, the initial packet flow including a first forwarding action to send traffic for the application to the application server via a tunnel path; learning, by the wireless access point, the application of the first packet; generating, by the wireless access point, based on a policy of the application, an entry in an application server address cache specifying an address of the application server and a second forwarding action, the second forwarding action being used to send traffic for the application to the application server via a local grooming path; receiving, by the wireless access point, a second packet for the application; and configuring, by the wireless access point, in response to determining that a destination address of the second packet matches an entry in the application server address cache, a subsequent packet flow for the application, the subsequent packet flow including a second forwarding action to send traffic for the application to the application server via a local grooming path.

[0013] In another example, the present disclosure describes a wireless access point, which includes: a memory; one or more processors operably coupled to the memory, wherein the one or more processors are configured to: receive a first packet for an application provided by an application server; configure an initial packet flow for the application, the initial packet flow including a first forwarding action to send traffic for the application to the application server via a tunnel path; learn the application of the first packet; based on a policy of the application, generate an entry in an application server address cache specifying an address of the application server and a second forwarding action, the second forwarding action being used to send traffic for the application to the application server via a local grooming path; receive a second packet for the application; and in response to determining that the destination address of the second packet matches the entry in the application server address cache, configure a subsequent packet flow for the application, the subsequent packet flow including a second forwarding action to send traffic for the application to the application server via a local grooming path.

[0014] In another example, the present disclosure describes a non-transitory computer-readable storage medium storing instructions that, when executed, cause one or more programmable processors of a wireless access point to: receive a first packet for an application provided by an application server; configure an initial packet flow for the application, the initial packet flow including a first forwarding action to send traffic for the application to the application server via a tunnel path; learn the application of the first packet; based on a policy of the application, generate an entry in an application server address cache specifying an address of the application server and a second forwarding action, the second forwarding action being used to send traffic for the application to the application server via a local grooming path; receive a second packet for the application; and in response to determining that a destination address of the second packet matches an entry in the application server address cache, configure a subsequent packet flow for the application, the subsequent packet flow including a second forwarding action to send traffic for the application to the application server via a local grooming path.

[0015] The details of one or more examples are set forth in the accompanying drawings and the description below. Other features, objects, and advantages will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a block diagram illustrating an example network that provides application identification and application-based path selection at a wireless access point in accordance with techniques described in this disclosure.

[0017] Figure 2 is a block diagram illustrating in further detail an example implementation of a wireless access point in accordance with techniques described in this disclosure.

[0018] Figure 3 is a conceptual diagram illustrating an example implementation of an application server address cache in accordance with techniques described in this disclosure.

[0019] FIG. 4A to FIG. 4B is a flow diagram illustrating example operations for application-based path selection at a wireless access point in accordance with the techniques described in this disclosure. DETAILED DESCRIPTION

[0020] Figure 1 is a block diagram illustrating an example network system 2 that provides application identification and application-based path selection at one or more wireless access points 8 according to the techniques described in this disclosure. Specifically, Figure 1 An example implementation of a network system 2 is shown that includes a network 6 that provides client devices 4A-4D (collectively referred to as “client devices 4”) with access to an application server 12 via wireless access points 8A and 8B (collectively referred to as “wireless access points 8”) and / or a gateway device 10.

[0021] exist Figure 1 In the example of , network 6 can represent a public network (such as the Internet), a private network (such as those owned and operated by an enterprise or service provider), or a combination of both public and private networks that provide packet-based network services to client device 4. Therefore, network 6 may alternatively be referred to as a service provider (SP) network in this article. Network 6 may include one or more wide area networks (WANs), local area networks (LANs), enterprise LANs, virtual local area networks (VLANs), virtual private networks (VPNs), and / or another type of network. Network system 2 may, for example, include a software-defined wide area network (SDWAN) managed by one or more software-defined network (SDN) controllers. Further example details of SD WAN networks are described in U.S. application Ser. No. 16 / 946,997, entitled “Dynamic Prediction and Management of Application Service Level Agreements,” filed on July 14, 2020, the entire contents of which are incorporated herein by reference.

[0022] In some examples, client devices 4 may connect to gateway device 10 via network 6 to receive connectivity for applications hosted by application server 12. For example, client device 4 may be a personal or laptop computer with, for example, a wireless card, a wireless netbook, a mobile phone, a video gaming device, a smart phone, a tablet computer, an Internet of Things (IoT) device, or other type of device that accesses applications hosted by application server 12. Each of client devices 4 may run a variety of software applications, such as word processing and other office support software, web browsing software, software that supports voice calls, video games, video conferencing, video streaming, and email, among others.

[0023] The gateway device 10 may be a router, a firewall, or other network device to provide access to the client device 4 via the network 6 for services for applications hosted on the application server 12. The gateway device 10 redirects traffic flows to and from the application server 12 that provides the services. For example, the gateway device 10 may establish a communication session, such as a TCP session, with the application server 12. Figure 1 In the example, the gateway device 10 may be located in an enterprise network that is far away from the wireless access point 8.

[0024] In some examples, client device 4 may connect to wireless access point 8 to reach gateway device 10, which in turn accesses applications hosted by application server 12. Wireless access point 8 may connect wireless network devices (e.g., client device 4) to a wired network (e.g., an enterprise network) by tunneling traffic to gateway device 10. Figure 1 In an example, client device 4 can connect to a remote corporate server of an enterprise network via wireless access point 8 and gateway device 10. In some examples, wireless access point 8 can be configured with a forwarding state for a specified tunnel interface for tunneling application traffic between wireless access point 8 and gateway device 10 through network 6 using a tunnel such as an Internet Protocol (IP) or Generic Routing Encapsulation (GRE) tunnel, network virtualization using GRE (NVGRE), or by using a virtual local area network (VLAN), virtual extensible LAN (VXLAN), multi-protocol label switching (MPLS) technology, etc. Figure 1 In the example of , wireless access point 8A may tunnel application traffic to gateway device 10 via tunnel 11A, and wireless access point 8B may tunnel application traffic to gateway device 10 via tunnel 11B.

[0025] In some instances, certain applications (such as video streaming or video conferencing applications) are bandwidth intensive, while other applications (such as email applications) are less bandwidth intensive. Tunneling all bandwidth intensive application traffic to a gateway device of a remote enterprise network may increase the load on the enterprise network. In some instances, although wireless access points may be configured with policies to send traffic over local grooming paths, these policies are typically based on protocols and / or ports and cannot distinguish between certain application traffic (e.g., distinguishing email application traffic from video streaming application traffic).

[0026] In some instances, the wireless access point 8 may send traffic to a deep packet inspection (DPI) engine (e.g., DPI engine 14) to identify the type of application originating from a given packet flow. The DPI engine 14 is shown external to the wireless access point, but may alternatively be within the wireless access point. The DPI engine 14 may need to process multiple packets before determining the application associated with the packet. In some instances, the wireless access point may initially tunnel the packet to a gateway device before the DPI engine determines the application of the traffic, and switch to a local grooming path after determining the application of the packet flow. In these instances, the gateway device establishes a communication session (e.g., a TCP session) with an application server. By switching to a local grooming path for the packet flow, the application server will not accept the packet flow from the wireless access point without establishing a new communication session between the wireless access point and the application server. Further example details of the DPI engine and application identification are described in U.S. Patent No. 8,112,800, entitled “Multi-Layered Application Classification and Decoding,” filed on November 8, 2007; U.S. Patent No. 8,612,612, entitled “Dynamic Policy Control for Application Flow Processing in a Network Device,” filed on September 28, 2011; U.S. Patent No. 9,083,740, entitled “Network Traffic Pattern Matching Using Adaptive Deterministic Finite Automata,” filed on September 28, 2009; U.S. Patent No. 9,398,043, entitled “Applying Fine-Grain Policy Action to Encapsulated Network Attacks,” filed on March 24, 2009; and U.S. Patent No. 10,063,451, entitled “Providing Application Metadata Using Export Protocols in Computer Networks,” filed on September 28, 2015, the contents of each of which are incorporated herein by reference.

[0027] According to the techniques described in the present disclosure, the wireless access point 8 can provide application identification for packet flows from the client device 4, and based on the identification of each packet flow, provide application-based path selection to send application traffic to the application server 12. For example, the wireless access point 8 can include application server address caches 9A and 9B (collectively referred to as "application server address caches 9"), respectively, which store one or more application server addresses and one or more forwarding actions (such as local grooming paths and tunnel paths). The wireless access point 8 can use the application server address cache 9 to configure subsequent packet flows for the application and configure the wireless access point to send the subsequent packet flows to the application server via the local grooming path or the tunnel path.

[0028] As an example, wireless access point 8A receives initial packet 18A for an application hosted on application server 12, e.g., from client device 4A, and configures a first packet flow for the application (otherwise referred to herein as an "initial packet flow" or "learned flow"). The terms "packet flow," "traffic flow," or simply "flow" refer to a group of packets that originate from a particular source device (e.g., client device 4A) and are sent to a particular destination device (e.g., application server 12). A single packet flow in either the upstream (originating from one of client devices 4) or downstream (destination to one of client devices 4) direction can be identified by the values ​​used in the headers of the packets (e.g., source address, destination address, source port, destination port, protocol, source MAC address, destination MAC address, source interface, destination interface, etc.).

[0029] Wireless access point 8A may configure the initial packet flow, for example, by generating a flow entry in a flow table.The flow entry for the initial packet flow may include one or more values ​​for identifying packet headers of subsequent packets associated with the initial packet flow.

[0030] Wireless access point 8A may learn the application associated with packet 18A, for example, by sending the packet to a deep packet inspection (DPI) engine 14 and receiving classification information for the application from DPI engine 14. In some instances, DPI engine 14 may be able to classify the application after processing multiple packets for a given application. Because DPI engine 14 is unable to classify the application for the initial packet of the initial packet flow, wireless access point 8A is configured to tunnel the application traffic associated with the initial packet flow to gateway device 10, which establishes a communication session (e.g., a TCP session) with application server 12.

[0031] As an example, packet 18A may represent a packet for a video streaming application hosted on application server 12. In this example, wireless access point 8A may initially receive packet 18A and configure a flow entry with a forwarding action for the initial packet flow to send subsequent video streaming application traffic associated with the initial packet flow to application server 12 via tunnel 11A.

[0032] If wireless access point 8A receives subsequent application traffic associated with the initial packet flow (e.g., packet 18B), wireless access point 8A may tunnel packet 18B to gateway device 10 via tunnel 11A. For example, wireless access point 8A may determine that packet 18B matches a matching criterion stored in a flow entry for the initial packet flow (e.g., a value from the header of initial packet 18A). In response, wireless access point 8A sends packet 18B according to the forwarding action of the flow entry for the initial packet flow (e.g., by tunneling packet 18B to gateway device 10 via tunnel 11A). In this way, wireless access point 8A may send application traffic associated with the initial packet flow (e.g., packets 18A and 18B) to application server 12 via tunnel 11A.

[0033] After the DPI engine 14 determines the application, the DPI engine 14 returns classification information of the application to the wireless access point 8A. For example, the DPI engine 14 may return an application name, an application identifier, and / or other details (e.g., metadata) of the application, such as application group / type (e.g., social network, video streaming, etc.). In response to receiving the application classification information from the DPI engine 14, the wireless access point 8A determines whether the wireless access point 8A is configured with a policy for the application. As further described below, the policy for the application may include an application name, an application identifier, and a forwarding action (e.g., sending application traffic on a local grooming path or a tunnel path).

[0034] As an example, wireless access point 8A may receive classification information associated with a video streaming application and determine whether the classification information of the video streaming application matches a policy. In this example, application server 12 may be configured with a policy including a forwarding action to send video streaming application traffic via local grooming path 16A. In response to receiving the classification information associated with the video streaming application, wireless access point 8A may determine that the classification information matches the policy and generate an entry in application server address cache 9A having an address of application server 12 (e.g., determined from a destination address of a packet) and an associated forwarding action of the policy to send video streaming application traffic via local grooming path 16A.

[0035] When the wireless access point 8A receives a subsequent packet (e.g., packet 18C) for a video streaming application hosted by the application server 12, the wireless access point 8A performs a lookup of the application server address cache 9A, instead of sending the packet to the DPI engine 14, to determine whether the destination address of the packet 18C matches the application server address stored in the application server address cache 9A. If the destination address of the packet 18C matches the application server address in the application server address cache 9A, the wireless access point 8A configures a second packet flow for the application (otherwise referred to herein as a "subsequent packet flow" or a "grooming flow"). For example, the wireless access point 8A configures a flow entry for the subsequent packet flow and a forwarding action based on the application server address cache 9A to send the subsequent packet flow to the application server 12 via the local grooming path 16A.

[0036] When wireless access point 8A receives a subsequent packet (e.g., packet 18D) associated with the subsequent packet flow, wireless access point 8A determines from the flow entry for the subsequent packet flow that the forwarding action is to send packet 18D to application server 12 via local grooming path 16A. For example, in response to determining that packet 18D matches the matching criteria stored in the flow entry for the subsequent packet flow (e.g., the value of the initial packet 18C header), wireless access point 8A sends packet 18D to application server 12 via local grooming path 16A.

[0037] Figure 2 2 is a block diagram illustrating an example implementation of a wireless access point according to the techniques described in the present disclosure in further detail. Figure 1 8A, but it may represent any wireless access point according to the techniques described in this disclosure. Figure 2 In the example of , the wireless access point 200 includes a flow manager 202, a flow table 204, a policy configuration database 206, and an application server address cache 208. Figure 2 In the example of , the wireless access point 200 may include a DPI engine 210. Although Figure 2 The wireless access point 200 in the embodiment includes the DPI engine 210 , but the DPI engine 210 may be external to the wireless access point 200 .

[0038] Flow manager 202 may configure packet flows for incoming packets 212 and 214 to send the packets to an application server via a tunnel (e.g., tunnel path 220) or a local breakout path (e.g., egress path 222), respectively, based on the application associated with the packet. Packet 212 may represent Figure 1 The packets 18A and 18B, and the packet 214 may represent Figure 1 Groups 18C and 18D.

[0039] exist Figure 2 In an example, flow manager 202 may receive an initial packet for an application (e.g., one of packets 212). Flow manager 202 configures a flow entry (e.g., flow entry 205A) in flow table 204 for the initial packet flow. For example, flow manager 202 stores one or more values ​​used in the header of the packet (i.e., source address, destination address, source port, destination port, protocol, source MAC address, destination MAC address, source interface, destination interface, etc.). Flow manager 202 may also include a forwarding action for flow entry 205A to send the initial packet flow to an application server via tunnel path 220. For example, flow entry 205A may include a forwarding action to send traffic destined for the application server out of the outgoing interface configured for the tunnel.

[0040] Flow manager 202 learns the application of a packet by sending the packet to DPI engine 210 and receiving classification information of the application from DPI engine 210. For example, DPI engine 210 may determine the application (after processing multiple packets for the application) and return classification information of the application (such as an application name, an application identifier, and / or other information such as application group / type).

[0041] In response to receiving the application classification information, the flow manager 202 can determine whether there is a policy for the application. For example, the flow manager 202 can perform a search for a policy configuration database 206, which stores one or more policies for the application. The policy may include an application name, an application identifier, and a forwarding action. A user can configure the policy through an interface (not shown) of the wireless access point (such as a command line interface, a graphical user interface, etc.). In some instances, the wireless access point 200 can receive one or more policies from a controller. The policy may include an application name, an application identifier, and a forwarding action, such as shown in the following example policy:

[0042] typedef struct app_policy_t {

[0043] charapp_name

[64] ;

[0044] uint32_t app_id;

[0045] uint8_t.policy_action_path; );

[0047] Item 1:

[0048] .app_name="Video Streaming Application";

[0049] .app_id=53;

[0050] .policy_action_path=LOCAL_BREAKOUT;

[0051] .creation_time=2020001011100

[0052] Entry 2:

[0053] .app_name="Email Application";

[0054] .app_id=34;

[0055] .policy_action_path=TUNNEL;

[0056] .creation_time=2020001011200

[0057] In the above example, the first policy entry includes the application name "Video Streaming Application", the application identifier "53", and the forwarding action specified as "LOCAL_BREAKOUT". The second policy entry includes the application name "Email Application", the application identifier "34", and the forwarding action specified as "TUNNEL". In some examples, each of the policies may include other information (such as application type or other application identification information, creation time of the entry, etc.).

[0058] If a policy for the application (or application type) exists, the flow manager 202 may generate an entry in the application server address cache 208 that specifies the address of the application server hosting the application in the application server address cache 208 and the forwarding action of the corresponding policy. For example, the flow manager 202 may receive classification information including an application name of "video streaming application" and / or an application identifier of 53. The flow manager 202 determines whether a policy entry including the application name of "video streaming application" and / or the application identifier of 53 exists in the policy configuration database 206. In this example, the first policy entry matches the application name and / or the application identifier returned from the DPI engine 210. In response to determining that the first policy entry matches the application name and / or the application identifier returned from the DPI engine 210, the flow manager 202 generates an entry in the application server address cache 208 that specifies the address of the application server hosting the video streaming application (e.g., identified from the destination IP address of the packet) and the forwarding action specified in the first policy entry (e.g., local breakout path). Similar is true if flow manager 202 receives classification information that includes an application name of “email application” and / or an application identifier of 34. Flow manager 202 determines that a second policy entry that includes an application name of “email application” and / or an application identifier of 34 exists in policy configuration database 206. In response to determining that the second policy entry matches the application name and / or application identifier returned from DPI engine 210, flow manager 202 generates an entry in application server address cache 208 that specifies the address of the application server hosting the email application (e.g., identified from the destination IP address of the packet) and the forwarding action specified in the second policy entry (e.g., a tunnel path).

[0059] The application server address cache 208 may be located in the kernel memory of the wireless access point 200. Figure 3 As further described, the application server address cache 208 may be implemented as a trie or other similar format.

[0060] When flow manager 202 receives a packet associated with a subsequent packet flow (e.g., one of packets 214), flow manager 202 may perform a lookup of application server address cache 208. If flow manager 202 determines, for example, that packet 214 has a destination address that matches an entry in application server address cache 208, flow manager 202 configures a flow entry (e.g., flow entry 205B) for the subsequent packet flow that includes a forwarding action to send packet 214 associated with the subsequent packet flow to the application server via local grooming path 222. For example, flow entry 205B may include a forwarding action to send traffic destined for the application server out the outgoing interface configured for the local grooming path.

[0061] In this manner, if the wireless access point 200 receives a subsequent packet associated with the initial packet flow (e.g., one of the packets 212), the flow manager 202 can determine from the flow entry 205A for the initial packet flow that the packet 212 is to be sent to the application server via the tunnel path 220. This enables the wireless access point 200 to continue to send application traffic for the initial packet flow via the tunnel to a gateway device that has already established a communication session with the application server without establishing a new communication session between the wireless access point and the application server, which avoids communication session issues that occur when switching to local grooming. Alternatively or additionally, if the wireless access point 200 receives a subsequent packet of the subsequent packet flow (e.g., one of the packets 214), the flow manager 202 can determine from the flow entry 205B for the subsequent packet flow that the packet 214 is to be sent to the application server via the local grooming path 222. In some instances, the wireless access point 200 performs source network address translation (NAT) 224 to map the return packets from the application server to the client device, and selects a default bridge interface to send traffic to the intermediate network (e.g., Figure 1 6). Packets received at the wireless access point 200 may be returned to the client device using the source NAT 224, and the wireless access point 200 may determine the appropriate interface (eg, a WLAN interface) to forward the packet back to the client device.

[0062] Figure 3 is a conceptual diagram illustrating an example implementation of an application server address cache according to the techniques described in this disclosure. Application server address cache 300 may represent Figure 1 Application server address cache 9 and Figure 2 An example implementation of the application server address cache 208 is shown.

[0063] exist Figure 3 In the example of , application server address cache 300 can be represented as a word search tree data structure. In this example, application server address cache 300 can store the addresses of one or more application servers (e.g., application server address 302). In this example, the wireless access point can learn three application server addresses. The first application server address is 216.58.197.46 and can represent a first application server (e.g., a video streaming server). The second application server address is 216.58.197.51 and can represent a different second video application server. The third application server address is 216.17.172.47 and can represent a third application server (e.g., an email server).

[0064] exist Figure 3In the example of , application server address cache 300 can be in the form of a word search tree data structure and identify corresponding policies for application server addresses (e.g., policies 304A-304C (collectively referred to as "policies 304")). For example, policy 304A will be applied to packet flows with a destination address of 216.58.197.51. Similarly, policy 304B will be applied to packet flows with a destination address of 216.58.197.46. Similarly, policy 304C will be applied to packet flows with a destination address of 216.17.172.47. Policy 304 can be a forwarding action, such as causing traffic to be forwarded over a local diversion path (e.g., Figure 2 local grooming path 222) or cause traffic to be routed over a tunnel (e.g., Figure 2 In this example, policy 304A and policy 304B may include a forwarding action that causes traffic for a first application (e.g., a video streaming application) to be sent over the local grooming path, and policy 304C may include a forwarding action that causes traffic for a second application (e.g., an email application) to be sent over the tunnel path.

[0065] In this example, a wireless access point (eg, via Figure 2 202) can receive a packet including a destination address of 216.58.197.51 and perform a lookup of the application server address cache 300. The wireless access point can determine, in response to the lookup of the application server address cache 300, that policy 304A is to be applied to packets with a destination of 216.58.197.51. As described above, policy 304A can include a forwarding action to perform local grooming. In this way, the wireless access point can generate a flow entry in a flow table that includes a value of a header of the packet (e.g., source address, destination address, source port, destination port, protocol, etc.) and a forwarding action to perform local grooming. Similarly, the wireless access point can receive a packet including a destination address of 216.58.197.46 and perform a lookup of the application server address cache 300. The wireless access point can determine, in response to the lookup of the application server address cache 300, that policy 304B is to be applied to packets with a destination of 216.58.197.46. As described above, policy 304B may include a forwarding action to perform local grooming. In this way, the wireless access point may generate a flow entry in the flow table that includes the value of the packet header (e.g., source address, destination address, source port, destination port, protocol, etc.) and a forwarding action to perform local grooming. In this way, if the wireless access point receives traffic destined for 216.58.197.46 or 216.58.197.51 (i.e., video stream traffic destined for a video stream application server), the wireless access point may send the traffic to the application server via the local grooming path.

[0066] Alternatively or additionally, the wireless access point may receive a packet including a destination address of 216.17.172.47 and perform a lookup of the application server address cache 300. The wireless access point may determine, in response to the lookup of the application server address cache 300, that policy 304C is to be applied to packets destined for 216.17.172.47. As described above, policy 304C may include a forwarding action to tunnel the traffic. In this way, the application server may generate a flow entry in the flow table that includes the value of the packet's header (e.g., source address, destination address, source port, destination port, protocol, etc.) and a forwarding action to tunnel the traffic. In this manner, if the wireless access point receives traffic destined for 216.17.172.47 (i.e., email traffic destined for an email application server), the wireless access point may send the traffic to the application server via a tunnel path.

[0067] Figure 4A and Figure 4B is a flow chart illustrating example operations of application-based path selection at a wireless access point. Figure 1 Wireless Access Point 8A and Figure 2 Description of Wireless Access Point 200 Figure 4A and Figure 4B , but the Figure 4A and Figure 4B Can represent the operation of any wireless access point.

[0068] exist Figure 4A In the example of FIG. 4 , wireless access point 8A may receive an initial packet (“first packet”) (402) from a client device, such as packet 18A from client device 4A. Flow manager 202 of wireless access point 8A configures an initial packet flow for the application, the initial packet flow including a first forwarding action to send traffic for the application to an application server via a tunnel path (404). For example, flow manager 202 generates a flow entry 205A in flow table 204 that includes one or more values ​​of a header of the packet (e.g., source address, destination address, source port, destination port, protocol, source MAC address, destination MAC address, source interface, destination interface, etc.) and the first forwarding action, and sends traffic for the application to the application server via tunnel path 220.

[0069] The wireless access point 8A then learns the classification information of the application 406. For example, the flow manager 202 of the wireless access point 8A sends the packet to the DPI engine to determine the application of the packet, and receives the classification information of the application (such as the application name, application identifier and / or other information about the application (such as application group / type)) from the DPI engine.

[0070] In response to receiving the classification information for the application, the flow manager 202 of the wireless access point 8A generates an entry in the application server address cache 208 based on the policy for the application (408). For example, the wireless access point 8A may be configured with a policy for a video streaming application, the policy having a forwarding action to send traffic for the video streaming application via the local grooming path 222. In response to receiving the classification information for the video streaming application, the flow manager 202 of the wireless access point 8A may perform a lookup of the policy configuration database 206 to determine whether the wireless access point 8A is configured with a policy for the video streaming application. For example, the flow manager 202 determines whether the application name, application identifier, and / or other application information of the classification information returned from the DPI engine matches a policy in the policy configuration database 206.

[0071] If the wireless access point 8A determines that a policy exists for the video streaming application, the wireless access point 8A may generate an entry in the application server address cache 208 that specifies the address of the video streaming application server, which is determined from the destination address of the packet. The flow manager 202 of the wireless access point 8A may also configure the entry in the application server address cache 208 to specify the forwarding action from the policy (e.g., sending the video streaming application traffic on the local grooming path 222).

[0072] The wireless access point 8A uses the application server address cache 208 to configure a subsequent packet flow for the application and configure the wireless access point to send the subsequent packet flow to the application server via the local grooming path or the tunnel path. For example, the wireless access point 8A receives a subsequent packet for the application ("second packet") (410). The flow manager 202 of the wireless access point 8A determines whether the destination address of the subsequent packet matches an entry in the application server address cache 208, and if there is a match, the flow manager 202 configures a subsequent packet flow for the application, which includes a forwarding action to send traffic for the application to the application server via the local grooming path 222 (412). As an example, the flow manager 202 may determine that the address of the video stream application server matches the address stored in the application server address cache 208. The flow manager 202 of the wireless access point 8A may also determine from the application server address cache 208 an associated forwarding action for the application server address (e.g., send the video stream application server via the local grooming path 222). Using the application server address cache 208, the flow manager 202 of the wireless access point 8A generates a flow entry 205B in the flow table 204 that includes one or more values ​​of the header of the second packet and the forwarding action ("second forwarding action") identified from the application server address cache 208. In this way, the wireless access point 8A can send packets associated with the initial packet flow on the tunnel path 220 and send packets associated with subsequent packet flows (such as the local grooming path 222) on the local grooming path 222. Figure 4B ).

[0073] For example, wireless access point 8A may receive a third packet for an application (414). Flow manager 202 of wireless access point 8A determines whether the packet is associated with an initial packet flow or a subsequent packet flow (416). If the third packet is associated with the initial packet flow, flow manager 202 of wireless access point 8A sends the third packet to the application server via tunnel path 220 (418). If the third packet is associated with a subsequent packet flow, flow manager 202 of wireless access point 8A sends the third packet to the application server via local grooming path 222 (420). In some instances, flow manager 202 of wireless access point 8A performs source network address translation (NAT) to map the returned packet to the client device and selects a default bridge interface to send the traffic to an intermediate network (e.g., Figure 1 6). Packets received at wireless access point 8A may be returned to the client device using source NAT, and wireless access point 8A may determine the appropriate interface (eg, WLAN interface) to forward the packets back to the client device.

[0074] The techniques described herein may be implemented in hardware, software, firmware, or any combination thereof. The different features described as modules, units, or components may be implemented together in an integrated logic device or separately as discrete but interoperable logic devices or other hardware devices. In some cases, various features of an electronic circuit may be implemented as one or more integrated circuit devices (such as an integrated circuit chip or chipset).

[0075] If implemented in hardware, the present disclosure may be directed to an apparatus, such as a processor or an integrated circuit device, such as an integrated circuit chip or chipset. Alternatively or in addition, if implemented in software or firmware, the techniques may be implemented at least in part by a computer-readable data storage medium comprising instructions that, when executed, cause a processor to perform one or more of the methods described above. For example, a computer-readable data storage medium may store such instructions for execution by a processor.

[0076] The computer-readable medium may form part of a computer program product, which may include packaging materials. The computer-readable medium may include computer data storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile random access memory (NVRAM), electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic or optical data storage media, etc. In some examples, an article of manufacture may include one or more computer-readable storage media.

[0077] In some instances, computer-readable storage media may include non-transitory media. The term "non-transitory" may indicate that the storage media is not embodied in a carrier wave or propagating signal. In some instances, non-transitory storage media may store data that may change over time (e.g., in RAM or cache).

[0078] The code or instructions may be software and / or firmware executed by a processing circuit that includes one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Thus, the term "processor" as used herein may refer to any of the aforementioned structures or any other structures suitable for implementation of the techniques described herein. Furthermore, in some aspects, the functionality described in the present disclosure may be provided within a software module or a hardware module.

Claims

1. A network method comprising: receiving, by a wireless access point, a first packet for an application; generating, by the wireless access point, based on the application of the first group, an entry in an application server address cache that specifies: an address of an application server for hosting the application; and a forwarding action to send traffic for the application to the application server via a local grooming path instead of sending the traffic via a tunnel to a gateway connected to the application server; receiving, by the wireless access point, a second packet for the application; configuring, by the wireless access point, in response to determining that the second packet matches the entry in the application server address cache, a packet flow for the application to include the forwarding action to send traffic associated with the packet flow to the application server via the local breakout path instead of sending the traffic via a tunnel to the gateway connected to the application server; and The wireless access point sends, based on the forwarding action, subsequent packets subsequent to the second packet and associated with the packet flow to the application server via the local grooming path.

2. The method according to claim 1, wherein: Generating the entry specifying the address of the application server in the application server address cache comprises: The address of the application server is determined according to the destination address of the first packet.

3. The method according to claim 1, wherein: Generating the entry in the application server address cache that specifies the address of the application server is based on a policy of the application, wherein the policy of the application includes: At least one of an application name and an application identifier; and The forwarding action is to send traffic associated with the packet flow for the application to the application server via the local grooming path.

4. The method according to any one of claims 1 to 3, further comprising: In response to receiving the first packet for the application, an initial packet flow for the application is configured, by the wireless access point, to include a forwarding action to send traffic associated with the initial packet flow to the application server via a tunnel path.

5. The method according to claim 4, wherein: The subsequent grouping includes a first subsequent grouping, and the method further includes: receiving, by the wireless access point, a second subsequent packet following the second packet for the application; determining, by the wireless access point, that the second subsequent packet is associated with the initial packet flow; and In response to determining that the second subsequent packet is associated with the initial packet flow, the wireless access point sends the second subsequent packet for the application to the application server via the tunnel path based on the forwarding action to send traffic associated with the initial packet flow to the application server via the tunnel path.

6. The method according to any one of claims 1 to 3, wherein: Sending the subsequent packets associated with the packet flow to the application server via the local breakout path further comprises: receiving, by the wireless access point, the subsequent packet for the application; determining, by the wireless access point, that the subsequent packet is associated with the packet flow; and In response to determining that the subsequent packet is associated with the packet flow, the wireless access point sends the subsequent packet to the application server via the local grooming path based on the forwarding action to send traffic associated with the packet flow to the application server via the local grooming path.

7. The method according to any one of claims 1 to 3, further comprising: In response to receiving the first group for the application, learning the application of the first group, wherein learning the application of the first group includes: sending, by the wireless access point, the first packet to a deep packet inspection engine; and Classification information of the application is received by the wireless access point from the deep packet inspection engine.

8. A wireless access point, comprising: Memory; as well as One or more processors operably coupled to the memory, wherein the one or more processors are configured to: receiving a first packet for an application; generating, based on the application of the first packet, an entry in an application server address cache specifying: an address of an application server for hosting the application; and a forwarding action to send traffic for the application to the application server via a local breakout path instead of sending the traffic via a tunnel to a gateway connected to the application server; receiving a second packet for the application; in response to determining that the second packet matches the entry in the application server address cache, configuring the packet flow for the application to include the forwarding action to send traffic associated with the packet flow for the application to the application server via the local breakout path instead of sending the traffic via a tunnel to a gateway connected to the application server; and Based on the forwarding action, a subsequent packet after the second packet is sent to the application server via the local grooming path.

9. The wireless access point according to claim 8, wherein: To generate the entry specifying the address of the application server in the application server address cache, the one or more processors are further configured to: The address of the application server is determined according to the destination address of the first packet.

10. The wireless access point according to claim 8, wherein: To generate the entry in the application server address cache that specifies the address of the application server, the one or more processors are configured to generate the entry in the application server address cache based on a policy of the application, wherein the policy of the application comprises: At least one of an application name and an application identifier; and The forwarding action is to send traffic associated with the packet flow to the application server via the local breakout path.

11. The wireless access point according to any one of claims 8 to 10, wherein: The one or more processors are further configured to: In response to receiving the first packet for the application, an initial packet flow for the application is configured to include a forwarding action to send traffic associated with the initial packet flow for the application to the application server via a tunnel path.

12. The wireless access point of claim 11, wherein the subsequent packet comprises a first subsequent packet, wherein: The one or more processors are further configured to: receiving a second subsequent packet after the second packet for the application; determining that the second subsequent packet is associated with the initial packet flow; and In response to determining that the second subsequent packet is associated with the initial packet flow, based on the forwarding action to send traffic associated with the initial packet flow to the application server via the tunnel path, the second subsequent packet for the application is sent to the application server via the tunnel path.

13. The wireless access point according to any one of claims 8 to 10, wherein: To send the subsequent packets associated with the packet flow to the application server via the local breakout path, the one or more processors are further configured to: receiving the subsequent packet for the application; determining that the subsequent packet is associated with the packet flow; and In response to determining that the subsequent packet is associated with the packet flow, based on the forwarding action to send traffic associated with the packet flow to the application server via the local breakout path, the subsequent packet is sent to the application server via the local breakout path.

14. The wireless access point according to any one of claims 8 to 10, wherein: The one or more processors are further configured to: In response to receiving the first packet for the application, learning the application of the first packet, wherein, to learn the application of the first packet, the one or more processors are further configured to: sending the first packet to a deep packet inspection engine; and Classification information for the application is received from the deep packet inspection engine.

15. The wireless access point of claim 14, wherein: To generate the entry specifying the forwarding action in the application server address cache, the one or more processors are further configured to: The forwarding action is determined according to the policy of the application.

16. A computer-readable storage medium encoded with instructions for causing one or more programmable processors to be configured to perform the method according to any one of claims 1 to 7 or to be configured to function as a wireless access point according to any one of claims 8 to 15.

Images