Fragmented Data Flow Tracking via Dual Table Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices face challenges in tracking and managing fragmented data flows due to the lack of layer 4 information in subsequent packets, which prevents simple flow mapping systems from functioning effectively.
Innovation Solution
A method and device architecture that utilize a flow table and a separate fragment table to store and correlate information about fragmented data units, using flow identifiers and fragment keys to match and correlate fragments with their associated data flows, even when layer 4 information is only present in the first packet.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a simple flow mapping system using layer 3 and layer 4 information is used to track data flows, then the system is simple and easy to operate, but it cannot effectively track fragmented data flows because layer 4 information is only carried in the first packet
Solution Approach 1:
The patent divides the tracking system into two separate tables: a flow table that stores layer 3 and layer 4 information for complete data units, and a fragment table that stores only layer 3 information for fragmented packets. This segmentation allows each table to handle specific types of packets appropriately, enabling reliable tracking of both complete and fragmented flows while maintaining system simplicity.
Solution Approach 2:
The patent introduces a fragment table as an intermediary structure between the flow table and fragmented packets. The fragment table acts as a mediator that temporarily stores fragment information and links it to the flow table through flow identifiers, enabling subsequent fragments to be correlated with their parent flow even without layer 4 information.
2Measurement precision
If layer 4 information is required for every packet to identify data flows, then flow identification is accurate and complete, but subsequent fragmented packets cannot be tracked because they lack layer 4 information
Solution Approach 1:
The patent segments the flow identification process into two paths: one for complete data units that use both layer 3 and layer 4 information (maintaining high precision), and another for fragmented packets that use layer 3 information stored in the fragment table (enabling versatility). This allows the system to maintain accurate flow identification for complete packets while adapting to handle fragmented packets without layer 4 information.
Solution Approach 2:
The patent applies different quality requirements to different packet types: complete data units require full layer 3 and layer 4 information for precise flow identification, while fragmented packets use a simplified approach with layer 3 information in the fragment table. This local differentiation allows the system to maintain high precision where needed while achieving versatility in handling various packet types.
3Device complexity
If a single flow table is used to store all flow information, then the data structure is simple, but it cannot store both complete flow information and fragment information separately
Solution Approach 1:
The patent divides the data storage structure into two separate tables: a flow table for complete data unit information and a fragment table for fragmented packet information. This segmentation allows each table to be optimized for its specific purpose while maintaining overall system manageability, enabling the system to handle both complete and fragmented packets effectively.
Solution Approach 2:
The patent adds a dimensional separation to the data structure by creating two distinct storage dimensions (flow table and fragment table) instead of using a single flat structure. This dimensional change allows the system to organize information by packet type, providing both simplicity within each table and versatility across different packet types.
Data Source
AI summary
A device may receive a fragment of a fragmented data unit, determine a flow identifier that identifies a data flow with which the fragment is associated, and create a flow entry, based on the flow identifier, to store information associated with the data flow. The device may also determine a fragment key associated with the fragment, store a pointer to the flow entry based on the fragment key, correlate the fragment and another fragment, associated with the data flow, based on the fragment key and the pointer to the flow entry, and accumulate statistics associated with the fragment and the other fragment after correlating the fragment and the other fragment.