Dual-Layer Packet Filtering for Network Overload Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network nodes face overload issues due to excessive signaling and data traffic, leading to resource exhaustion or packet dropping, which compromises Quality of Service (QoS) and user experience.
Innovation Solution
A dual-layer packet filtering system is implemented, with a first layer operating on packet queues and a second layer operating within the kernel, prioritizing high-priority packets to ensure delivery even during overflow conditions, thereby preventing packet drops and maintaining system stability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If content-specific filtering with deep packet inspection is implemented, then packet classification and QoS management are improved, but processor overload and resource exhaustion occur
Solution Approach 1:
The filtering system is divided into two independent layers: a first layer using packet classification with filters operating in the data plane, and a second layer using deep packet inspection operating in the control plane. This segmentation allows each layer to handle specific tasks independently, preventing processor overload while maintaining classification accuracy.
Solution Approach 2:
A marker insertion mechanism acts as an intermediary between the two filtering layers. The first layer inserts class identifiers into packets, which are then processed by the second layer. This intermediary approach reduces the processing burden on the main processor while maintaining QoS management capabilities.
2Reliability
If all packets are processed through deep packet inspection, then QoS requirements are met, but input queues overflow under traffic bursts
Solution Approach 1:
The first layer filtering performs preliminary classification of packets into different application classes before they reach the second layer. By pre-classifying packets and inserting markers, the system prepares packets for efficient handling, reducing the need for extensive deep packet inspection on all packets and preventing queue overflow during traffic bursts.
Solution Approach 2:
Different filtering depths are applied to different packet classes. High-priority packets requiring strict QoS guarantees undergo full deep packet inspection, while other packets are handled by the faster first layer filtering. This localized quality approach maintains QoS for critical traffic while preserving overall system throughput.
3Power
If packet dropping is used for overload control, then processor load is reduced, but system stability and user experience deteriorate
Solution Approach 1:
The system dynamically adjusts filtering behavior based on load conditions. The two-layer filtering architecture allows the system to flexibly switch between processing modes, applying deep packet inspection only when necessary for QoS-critical packets, while maintaining system stability through adaptive resource allocation rather than simple packet dropping.
4Device complexity
If a single filtering layer is used, then device complexity is low, but resource management under overload conditions is insufficient
Solution Approach 1:
The filtering system is divided into two independent layers: a first layer using packet classification with filters operating in the data plane, and a second layer using deep packet inspection operating in the control plane. This segmentation allows each layer to handle specific tasks independently, preventing processor overload while maintaining classification accuracy.
Data Source
AI summary
An apparatus comprising a processor and interface for receiving and transmitting packets to external units. The interface comprises a first layer filter and first packet queues; the processor comprises a kernel, second layer filter, second packet queues and applications. For a packet received by the unit, the unit delivers parts the packet to the first layer filter; applies first level filtering; performs first sorting and delivers parts of the packet according to first level filtering rules and delivers parts of the packet to one of the first packet queues in dependence on the first sorting; the unit further being adapted for delivering the packet to second layer filter from kernel or from first packet queues; applying second level filtering; performing second sorting of parts of the packet and delivering parts of the packet to one of the applications in dependence on the second sorting.