Network Connection Tracking via Priority-Based Eviction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices face memory capacity limitations in their connection-tracking tables, leading to hindered communications when the table is full, as they cannot remove existing entries and block new network connections without a method to prioritize and manage data packet output effectively.
Innovation Solution
A method where a network device stores connection-tracking data and determines the priority level of new network connections based on data packets, deciding whether to output data packets based on the current tracked-connection count and priority level, allowing for the management of new connections by updating the connection count and potentially removing lower-priority entries to accommodate higher-priority ones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the network device stores all connection-tracking entries in the Conntrack table, then the tracking accuracy is improved, but the memory capacity is exceeded and new connections are blocked
Solution Approach 1:
The patent applies local quality by assigning different priority levels to different connection-tracking entries based on their importance. High-priority entries (such as those from critical services or authenticated users) are retained in the Conntrack table with guaranteed tracking, while low-priority entries are subject to removal when memory is full. This differential treatment resolves the contradiction by ensuring accurate tracking for important connections while managing overall memory usage.
Solution Approach 2:
The patent changes the parameter of connection priority by introducing a priority field in the Conntrack table structure. Each connection entry is assigned a priority value that determines its retention behavior. When the table is full, the system selectively removes low-priority entries rather than uniformly evicting any entry, thus maintaining tracking accuracy for high-priority connections while making room for new connections.
2Adaptability or versatility
If the network device removes existing entries from the Conntrack table to accommodate new connections, then the adaptability is improved, but the connection tracking stability deteriorates
Solution Approach 1:
The patent ensures stability by differentiating between high-priority and low-priority entries. High-priority entries are protected from removal, maintaining stable tracking for critical connections. Low-priority entries are the ones subject to removal when memory is full, allowing the system to adapt to new connections without compromising the stability of important tracked connections.
Solution Approach 2:
The patent introduces dynamic priority-based eviction policies that adapt to system conditions. The LRU (Least Recently Used) eviction strategy is modified to consider priority levels, creating a dynamic balance between maintaining stable tracking of important connections and adapting to new connection requests. This dynamic approach allows the system to respond flexibly while preserving stability for critical functions.
3Device complexity
If the network device unconditionally blocks data packets from new connections when the Conntrack table is full, then the device complexity is reduced, but the communication reliability deteriorates
Solution Approach 1:
The patent improves communication reliability by applying local quality to packet handling decisions. Instead of uniformly blocking all packets from new connections, the system evaluates the priority of individual connection requests and selectively accepts or rejects them. High-priority new connections are accepted even when the table is full (after removing low-priority entries), while low-priority requests may be blocked, thus maintaining reliable communication for important services.
Solution Approach 2:
The patent introduces dynamic packet acceptance behavior based on current system state and connection priority. The packet management policy transitions from static unconditional blocking to dynamic selective acceptance, where the decision to accept or block a packet depends on the priority level of the connection and the current memory state of the Conntrack table.
Data Source
AI summary
A method for managing network connections includes steps of: in response to receipt of a request for establishing a new network connection, storing in a connection-tracking (Conntrack) table an entry of tracked connection data that is related to the new network connection to be established, and updating a current tracked-connection count by adding one thereto; determining a priority level of the new network connection according to a data packet transmitted through the new network connection; and determining whether to output data packets that are received through the new network connection based at least on the current tracked-connection count and the priority level of the new network connection.