Application-Based Network Packet Forwarding via Deep Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems cannot differentially forward packets based on the application they are associated with, leading to inefficiencies in bandwidth allocation and quality of service, especially under heavy network loads, as they typically rely on Layer 2/3 addressing and only allow blocking or rate-limiting of sessions after they have been established.
Innovation Solution
A network device that receives an initial IP packet, determines the associated application, and applies a forwarding rule to differentially forward both the initial and subsequent packets based on the identified application, using techniques such as deep packet inspection and fully qualified domain name analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional Layer 2/3 forwarding is used, then forwarding speed is fast, but packets cannot be differentially forwarded based on application type leading to poor quality of service under heavy loads
Solution Approach 1:
The system performs preliminary application identification on the initial packet of a flow before forwarding decisions are made. By determining the application type (e.g., video conferencing, file transfer, web browsing) in advance using deep packet inspection or signature matching, the system can pre-assign appropriate forwarding rules and quality of service policies, ensuring critical applications receive adequate bandwidth before traffic congestion occurs.
Solution Approach 2:
The patent segments the packet forwarding process into distinct phases: initial packet inspection, application identification, rule selection, and subsequent packet forwarding. The initial packet is analyzed to determine application type, and this information is cached to guide forwarding of subsequent packets in the same flow, enabling differentiated treatment without inspecting every packet in detail.
2Measurement precision
If complete data packet analysis is performed, then accurate application identification is achieved, but network delay increases which is unacceptable for critical applications
Solution Approach 1:
The system extracts only the necessary identifying features from packets for application classification, such as protocol headers, port numbers, packet size patterns, and flow characteristics. Rather than analyzing the complete packet content, the system focuses on key signature elements that are sufficient to identify the application type, significantly reducing processing time while maintaining identification accuracy.
Solution Approach 2:
The patent applies partial packet inspection by examining only the initial packet or initial bytes of each flow in detail, while subsequent packets in the same flow are forwarded based on the cached application identification. This partial action approach achieves sufficient application identification accuracy without the excessive time cost of analyzing every packet completely.
3Reliability
If firewall screening and filtering is implemented, then security is improved, but bandwidth for critical traffic may still not be available under heavy loads
Solution Approach 1:
The system dynamically adjusts forwarding behavior based on real-time application identification. Different application types receive different forwarding treatments: critical applications like video conferencing receive priority routing and guaranteed bandwidth, while non-critical applications like file transfers receive standard or limited bandwidth. This dynamic resource allocation ensures security screening is maintained while guaranteeing bandwidth availability for critical traffic even under heavy loads.
Solution Approach 2:
The patent applies different quality levels of service to different applications locally. Instead of uniform treatment of all traffic, the system identifies specific application types and applies customized forwarding rules, bandwidth allocations, and quality of service parameters to each application category, ensuring critical applications receive the necessary resources while less important applications receive appropriate but limited service.
Data Source
AI summary
Methods and systems for detecting an application associated with a given IP flow and differentially forwarding packets based on determined application are provided. According to one embodiment, an initial Internet Protocol (IP) packet of an IP flow is received by a network device. An application with which the initial IP packet is associated is determined by the network device. Based on the determined application, a forwarding rule to be applied to the initial IP packet is identified by the network device. Thereafter, the initial IP packet and subsequent IP packets associated with the IP flow are forwarded by the network device based on the identified forwarding rule.