DPI Result Dissemination via Header Extension Fields
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep packet inspection (DPI) services in networks face delays due to the need for each network element to identify and process data packets, leading to increased latency and maintenance costs.
Innovation Solution
A method and device for spreading DPI results by inserting identification results into the header extension fields of data packets, allowing downstream devices to acquire identification information without performing packet inspection, thus reducing the need for repeated identification across the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If DPI identification is performed on each network element, then identification accuracy is improved, but network latency increases
Solution Approach 1:
The identification function network element performs DPI identification in advance and caches the identification results in a local flow table. When subsequent packets match the cached flow entries, downstream network elements can directly use the pre-cached identification results without performing repeated DPI identification, thus reducing network latency while maintaining identification accuracy.
Solution Approach 2:
The identification result is copied from the identification function network element's flow table to the packet header extension field. This allows downstream network elements to obtain identification information through simple header field extraction rather than performing complex DPI identification themselves, significantly reducing processing time and latency.
2Adaptability or versatility
If DPI function is deployed on each network element, then identification capability is improved, but device complexity increases
Solution Approach 1:
The DPI identification function is extracted from individual network elements and centralized in a dedicated identification function network element. This specialization allows the identification function to be optimized independently while other network elements focus on their core forwarding functions, reducing overall system complexity while maintaining comprehensive identification capability.
Solution Approach 2:
The packet header extension field serves as an intermediary carrier that transports identification results from the identification function network element to downstream network elements. This intermediary mechanism enables information sharing across the network without requiring each element to possess full DPI capabilities, simplifying the architecture while preserving identification functionality.
3Reliability
If repeated packet inspection is performed across network elements, then identification reliability is improved, but processing overhead increases
Solution Approach 1:
The identification result is cached in advance in the flow table and inserted into the packet header extension field during the initial packet processing. Subsequent packets in the same flow can directly utilize this pre-inserted identification result without requiring repeated inspection, thereby reducing processing overhead while ensuring reliable identification through the cached result.
Solution Approach 2:
The identification result is inserted into the packet header extension field and then discarded by the identification function network element after insertion. Downstream network elements recover this identification information from the header field, eliminating the need for repeated identification processing while maintaining result reliability.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
Embodiments of the present invention disclose a method for spreading a deep packet inspection result. Embodiments of the present invention further disclose an identification function network element and a spread network element. The method includes: receiving, by an identification function network element, a data packet in IP network traffic; identifying the data packet; if the identification succeeds, save a first identification result obtained through identification in a local flow table of the identification function network element, and insert the first identification result in an extension field of the header of the data packet; if the identification fails, insert a second identification result in the header extension field of the data packet, where the second identification result is an initialization identification result when the identification function network element creates the local flow table; when it is determined according to a service configuration that the data packet does not need to be discarded, send the data packet carrying the first identification result or the second identification result to a first downstream device. By means of the present invention, DPI service identification does not need to be performed on all network elements, thereby reducing a delay in executing a DPI service in an entire network and lowering a maintenance cost.