Dynamic Flow Capture Service Card Timeout Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for managing timeouts in high-volume network traffic monitoring require significant computing overhead due to the large number of timers needed, leading to delays and inefficiencies in capturing and analyzing network flows.
Innovation Solution
The implementation of dynamic flow capture (DFC) service cards that utilize a timeout data structure outside the operating system, such as a circular array, to manage timeouts efficiently, allowing for real-time intercept and relaying of network communications with minimal operating system involvement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional timer management methods are used in the operating system kernel, then timeout functionality is provided, but computing overhead and CPU power consumption increase significantly
Solution Approach 1:
The patent extracts the timer management functionality from the operating system kernel and relocates it to user space. A timeout array data structure is implemented in the application layer, allowing the program to independently manage timeouts without repeatedly invoking operating system timer functions. This extraction eliminates the overhead of kernel-space timer operations while maintaining reliable timeout functionality.
Solution Approach 2:
The program implements its own timeout management mechanism using a timeout array that it maintains and updates independently. Instead of relying on the operating system's timer services, the application self-manages timeout tracking by storing timeout values directly in the timeout array and periodically checking for expired timeouts, thereby serving its own timing needs without external intervention.
2Productivity
If a large number of timers are created to monitor high-volume network flows, then flow capture capability is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent merges multiple timer management functions into a single timeout array data structure. Instead of creating individual timer objects for each network flow, the system uses a unified array where each element represents a timeout slot. This consolidation reduces system complexity by eliminating the need to manage numerous separate timer entities while maintaining the capability to monitor high-volume network flows.
Solution Approach 2:
The timeout array serves multiple functions simultaneously: it stores timeout values for numerous network flows, tracks expiration times, and provides a mechanism for periodic timeout checking. This multi-functional data structure eliminates the need for separate timer infrastructure, reducing overall system complexity while supporting high-capacity flow monitoring.
3Reliability
If timeouts are managed within the operating system kernel, then timer functionality is available, but repeated system calls create delays and computational overhead
Solution Approach 1:
The system performs preliminary action by pre-allocating and maintaining the timeout array in user space before timer operations are needed. Timeout values are stored directly in the array elements, and the array is periodically scanned for expired timeouts. This preliminary setup eliminates the need for repeated system calls during timeout management, reducing delays while maintaining reliable timer functionality.
Data Source
AI summary
A network device comprises a service card (e.g., a dynamic flow capture (DFC) service card) executing a communication protocol to receive, from one or more control sources, flow capture information specifying at least one destination and criteria for matching one or more packet flows. The network device includes a network interface card to receive a packet from a network, a packet replication module to replicate the packet, and a control unit to provide the replicated packet from the interface card to the DFC service card. The network device includes a filter cache that caches flow capture information recently received from the control sources. The network device may provide real-time intercept and relaying of specified network-based communications. Moreover, the techniques described herein allow control sources to tap packet flows with little delay after specifying flow capture information, e.g., within 50 milliseconds, even under high-volume networks.


