438 results about "Packet classification" patented technology

A runtime adaptable search processor is disclosed. The search processor provides high speed content search capability to meet the performance need of network line rates growing to 1 Gbps, 10 Gbps and higher. he search processor provides a unique combination of NFA and DFA based search engines that can process incoming data in parallel to perform the search against the specific rules programmed in the search engines. The processor architecture also provides capabilities to transport and process Internet Protocol (IP) packets from Layer 2 through transport protocol layer and may also provide packet inspection through Layer 7. Further, a runtime adaptable processor is coupled to the protocol processing hardware and may be dynamically adapted to perform hardware tasks as per the needs of the network traffic being sent or received and/or the policies programmed or services or applications being supported. A set of engines may perform pass-through packet classification, policy processing and/or security processing enabling packet streaming through the architecture at nearly the full line rate. A high performance content search and rules processing security processor is disclosed which may be used for application layer and network layer security. scheduler schedules packets to packet processors for processing. An internal memory or local session database cache stores a session information database for a certain number of active sessions. The session information that is not in the internal memory is stored and retrieved to/from an additional memory. An application running on an initiator or target can in certain instantiations register a region of memory, which is made available to its peer(s) for access directly without substantial host intervention through RDMA data transfer. A security system is also disclosed that enables a new way of implementing security capabilities inside enterprise networks in a distributed manner using a protocol processing hardware with appropriate security features.

A runtime adaptable security processor is disclosed. The processor architecture provides capabilities to transport and process Internet Protocol (IP) packets from Layer 2 through transport protocol layer and may also provide packet inspection through Layer 7. Further, a runtime adaptable processor is coupled to the protocol processing hardware and may be dynamically adapted to perform hardware tasks as per the needs of the network traffic being sent or received and/or the policies programmed or services or applications being supported. A set of engines may perform pass-through packet classification, policy processing and/or security processing enabling packet streaming through the architecture at nearly the full line rate. A high performance content search and rules processing security processor is disclosed which may be used for application layer and network layer security. A scheduler schedules packets to packet processors for processing. An internal memory or local session database cache stores a session information database for a certain number of active sessions. The session information that is not in the internal memory is stored and retrieved to/from an additional memory. An application running on an initiator or target can in certain instantiations register a region of memory, which is made available to its peer(s) for access directly without substantial host intervention through RDMA data transfer. A security system is also disclosed that enables a new way of implementing security capabilities inside enterprise networks in a distributed manner using a protocol processing hardware with appropriate security features.

Methods for performing packet classification via prefix pair bit vectors. Unique prefix pairs in an access control list (ACL) are identified, with each prefix pair comprising a unique combination of a source prefix and a destination prefix. Corresponding prefix pair bit vectors (PPBVs) are defined for each unique source prefix and unique destination prefix in the ACL, with each PPBV including a string of bits and each bit position in the string associated with a corresponding prefix pair. A list of transport field value combinations are associated with each prefix pair based on corresponding entries in the ACL. During packet-processing operations, PPBV lookups are made using the source and destination prefix header values, and the PPBVs are logically ANDed to identify applicable prefix pairs. A search is then performed on transport field value combinations corresponding to the prefix pairs and the packet header to identify a highest priority rule.

Packets received at a network appliance are classified according to packet classification rules based on flow state information maintained by the network appliance and evaluated for each packet as it is received at the appliance on the basis of OSI Level 2-Level 4 (L2-L4) information retrieved from the packet. The received packets are acted upon according to outcomes of the classification; and the flow state information is updated according to actions taken on the received packets. The updated flow state information is then made available to modules performing additional processing of one or more of the packets at OSI Layer 7 (L7).

The present invention provides for a reconfigurable packet classifier using CAM. The invention is directed to packet classification for switching/routing systems where the router's system resources are limited and the customer requirements from the router are variable. The invention addresses the CAM constraint (e.g. search key width) problems of CAM-based classification systems, by allowing a reconfigurable selection of packet fields and/or payload bits to be used in the definition of the search key. For any given incoming packet, a subset of that incoming packet may be statically chosen to fit that particular CAM architecture and to create a particular CAM search key. This provides router deployment flexibility within networks and, thus, cuts costs.

A method and system for conveying an arbitrary mixture of high and low latency traffic streams across a common switch fabric implements a multi-dimensional traffic classification scheme, in which multiple orthogonal traffic classification methods are successively implemented for each traffic stream traversing the system. At least two diverse paths are mapped through the switch fabric, each path being optimized to satisfy respective different latency requirements. A latency classifier is adapted to route each traffic stream to a selected path optimized to satisfy latency requirements most closely matching a respective latency requirement of the traffic stream. A prioritization classifier independently prioritizes traffic streams in each path. A fairness classifier at an egress of each path can be used to enforce fairness between responsive and non-responsive traffic streams in each path. This arrangement enables traffic streams having similar latency requirements to traverse the system through a path optimized for those latency requirements.

A packet switching node having a pipelined packet processing architecture processing packets received via an input port associated with the packet switching node is presented. The method performed by the apparatus includes: determining a packet frame type of the packet received; selectively extracting packet header field values specific to a packet frame type, the extracted packet header field value including packet addressing information; ascribing to the packet a preliminary action to be performed in respect of the packet; searching packet switching information tracked by the packet switching node based on extracted packet addressing information; formulating a preliminary switch response for the packet; classifying the packet into one of a plurality of packet flows; modifying the preliminary switch response in accordance with one of the preliminary action, the packet flow into which the packet was classified, and a default port action corresponding to the input port; modifying the packet header in accordance with one of the preliminary action, the packet flow, and the default port action; and processing the packet in accordance with the switch response. Advantages are derived from: pipelined processing of packets which enables short-cutting the rest of the processing for improper packets; a flexible frame type determination which is fast for well know frame types yet flexible in support of new frame types delaying obsolescence of a particular implementation; an early determination of a processing action which is successively refined by subsequent stages; a combined Layer-2 and Layer-3 network addressing search engine operating on short bit length indexed Layer-2 and Layer-3 network addresses reducing network address table storage requirements, requiring a reduced data transfer bandwidth for network address table access, a large external hashed primary network address table, and a small internal secondary network address table; an early determination of a switch response; and packet-classification-based switch response and packet header modification.

The system of the present invention guarantees quality of service with respect to packets transmitted/received between an external network capable of providing differentiated services and a home network. The system includes a packet classifier, a marker, a priority class queue, a scheduler and a token bucket. The packet classifier classifies the packets according to addresses and traffic types. The marker allocates information on priorities to packets transmitted from the home network to the external network. The priority class queue has a plurality of queues classified according to the priorities. The scheduler services packets stored in the priority class queue according to the priorities. The token bucket drops packets, bandwidths of which are above a preset maximum bandwidth, when the packets are generated.

A novel solution for fast packet classification includes a novel data structure to store classifier rules which enables fast packet classification, which structure employs bitmaps for each field of the incoming packet for which classification is desired. A fast packet classification algorithm using the novel data structure allows the matching rule with the highest priority to be quickly obtained. A novel rule update algorithm allows new classifier rules to be added into the data structure incrementally. In one practical implementation of a classification engine employing the structures and algorithms of the present invention, a configurable processor with customized instructions is used to accelerate packet classification.

Certain aspects of a method and system for a power control based on application awareness in a packet network switch are provided. Data communication flow may be monitored in ports in a packet network switch based on packet classification. Ports where data flow is not detected may have at least some functionality disabled to reduce power consumption. In this regard, a power saving mode may be utilized for disabling at least some functionality in a switch port, such as Ethernet ports, for example. A partially disabled port may be fully enabled when monitoring detects active data communication flow in that port. Port functionality may be enabled or disabled sequentially, for example. In some instances, a physical layer portion of the packet network switch may be utilized to adjust power in a port based on the data communication flow.

The novel method and system for classifying packets through the use of filters combines heuristic tree search with the use of filter buckets. This provides high performance and reasonable storage requirement, even when applied to large number of filters (from 4K to 1 million). In addition, the novel method can adapt to the input packet distribution by taking into account the relative filter usage. The capability of employing a large number of filters in a packet classifciation system is useful in providing value-added services, such as security, quality of service (QoS), load balancing, and traffic accounting.

A data packet classifier to classify a plurality of N-bit input tuples, said classifier comprising a hash address, a memory and a comparison unit. The hash address generator generate a plurality of M-bit hash addresses from said plurality of N-bit input tuples, wherein M is significantly smaller than N. The memory has a plurality of memory entries and is addressable by said plurality of M-bit hash addresses, each such address corresponding to a plurality of memory entries, each of said plurality of memory entries capable of storing one of said plurality of N-bit tuples and an associated process flow information. The comparison unit determines if an incoming N-bit tuple can be matched with a stored N-bit tuple. The associated process flow information is output if a match is found and wherein a new entry is created in the memory for the incoming N-bit tuple if a match is not found.

A method and apparatus for two-stage packet classification, the two-stage packet classification scheme including a first stage and a second stage. In the first classification stage, a packet is classified on the basis of the packet's network path. In the second stage of classification, the packet is classified on the basis of one or more transport (or other) fields of the packet. Also disclosed are embodiments of most specific filter matching and transport level sharing, and either one or both of these techniques may be implemented in the two-stage classification method.

Some embodiments provide a method for processing a packet received by a managed forwarding element. The method performs a series of packet classification operations based on header values of the received packet. The packet classifications operations determine a next destination of the received packet. When the series of packet classification operations specifies to send the packet to a network service that performs payload transformations on the packet, the method (1) assigns a service operation identifier to the packet that identifies the service operations for the network service to perform on the packet, (2) sends the packet to the network service with the service operation identifier, and (3) stores a cache entry for processing subsequent packets without the series of packet classification operations. The cache entry includes the assigned service operation identifier. The network service uses the assigned service operation identifier to process packets without performing its own classification operations.

Certain aspects of a method and system for adaptive queue and buffer control based on monitoring in a packet network switch are disclosed. Aspects of one method may include pre-allocating packet buffers from a pool of packet buffers in a network switching device based on anticipation of a type of application data being handled by a particular port of the network switching device according to packet classification and tracking. The buffers may be dynamically allocated and deallocated from the pool of packet buffers for a particular port of the network switching device based on changes to the application data.

A method for preventing or limiting the effects of Denial-of-Service attacks in a communication appliance having a packet-classification rule base which allows all legitimate packets to be forwarded to the communication appliance includes monitoring incoming packets to the communication appliance to determine whether conditions indicating a Denial-of-Service attack are present. If a Denial-of-Service attack is present, a rule base subset of the packet-classification rule base is selected from a plurality of rule base subsets based on a current one of a plurality of operating states of the communication appliance.

A packet classification language (GPCL) is provided to specify protocol hierarchies among data packets in a routing device. The GPCL uses regular expressions to match incoming data packets and a syntax to describe the protocol hierarchy. A GPCL compiler produces an enhanced DFA which incorporates the regular expression for recognizing constituent parts of a data packets and which incorporates the grammar graph defining the relationships among the constituent parts. A hardware implemented DFA is used to scan the input stream which constitutes the data packets.

An architecture for a high performance IPSEC accelerator. The architecture includes components for scanning fields of packets, programming an IPSEC services device according to the scanned fields, and modifying the scanned packet with an output from the IPSEC security services device. Preferably, the architecture is implemented in hardware, and attached to a host machine. Hardware devices, fast in comparison to software processing and network speeds, allows the computationally intensive IPSEC processes to be completed in real-time and reduce or eliminate bottlenecks in the path of a packet being sent or received to/from a network.

Methods and systems for providing IP services in an integrated fashion are provided. According to one embodiment, a system includes a switch fabric and a line interface/network module, multiple virtual routing engines (VREs) and a virtual services engine (VSE) coupled with the switch fabric. The line interface/network module receives packets, steers ingress packets to a selected VRE and transmits egress packets according to their relative priority. VREs determines if a packet associated with a packet flow requires processing by the VSE by performing flow-based packet classification on the packet and evaluating forwarding state information associated with previously stored flow learning results. The VSE includes a central processing unit configured to perform firewall processing, Uniform Resource Locator (URL) filtering and anti-virus processing. If the packet is determined to require processing by the VSE, then the packet is steered to the VSE for firewall, URL filtering and/or anti-virus processing.

A method and apparatus for implementing a very efficient random early detection algorithm in the forwarding path of a network device. Under one embodiment of the method flows are associated with corresponding Weighted Random Early Detection (WRED) drop profile parameters, and a flow queue is allocated to each of multiple flows. Estimated drop probability values are repeatedly generated for the flow queues based on existing flow queue state data in combination with WRED drop profile parameters. In parallel, various packet forwarding operations are performed, including packet classification, which assigns a packet to a flow queue for enqueing. In conjunction with this, a determination is made to whether to enqueue the packet in the flow queue or drop it by comparing the estimated drop probability value for the flow queue with a random number that is generated in the forwarding path.

The present invention provides a method for using Differentiated Services (DiffServ) to implement the IP packet classification and the marking of a Differential Service Code Point (DSCP) for the quality of service (QoS) in the wireless access network of the IP-based universal mobile telecommunication system (UMTS). The present invention makes a classification to the data stream which is outgoing from the Iub interface at the Node B side, data stream which is outgoing from the Iub interface at the RNC side and data stream which is outgoing from the Iur interface at the RNC side according to the direction and the process of the respective data streams, and assigns and adjusts the priority of the data stream classified according to the principles for optimizing QoS and radio resources. When the network is congested, the data stream with a high level will have a higher priority than that with a lower level in queue and source occupancy, and the packet with a lower priority in the same queue is discarded. The DiffServ only contains a limited number of service levels and has little condition information, thus easy to be achieved and expanded.

The present invention allows for processing classification and/or security filtering rules by using bitmaps as representations. In one instance, the packet header involved in the packet classification is divided into sections (fields) such as 16 bit portions. Once, this is performed, a data lookup table is built for each of the packet header fields. In particular, a bitmap is created representing which filter rules match a certain packet header field value. The created data lookup tables, typically one for each packet header field, are merged to form intermediate level data lookup tables. The intermediate level data lookup tables are continuously merged until one final data lookup table is formed. The result of the final data lookup table represents all the possible packets to be classified. Thus, each final data entry has a bitmap representing the filtering rules that matches this entry. The bitmap can be used to selectively provide a desired result of the classification. For instance, a first matching rule is represented by the first bit set in the bitmap; the best matching rule is determined by processing the bitmap and selecting the most appropriate rule; and a complete set of rules that match is represented by the full bits set in the bitmap.