Network Device Application Identification via Deep Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing routers using policy-based routing struggle to accurately determine applications based on packets, as multiple applications can share the same port number, leading to inaccurate routing decisions.
Innovation Solution
A network device identifies applications by reassembling packets and performing signature matching, fixed pattern matching, regular expression matching, heuristic analysis, or statistical analysis on their content, using a policy-based routing table to determine forwarding destinations based on the identified application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If routers determine applications based on port numbers, then routing decisions can be made quickly, but the accuracy of application identification deteriorates because multiple applications share the same port number
Solution Approach 1:
The router performs preliminary deep packet inspection on initial packets of a flow to identify the application before establishing the flow's application identity. This preliminary action allows subsequent packets in the same flow to be routed quickly using the pre-determined application identity, resolving the contradiction between initial identification accuracy and ongoing routing speed
Solution Approach 2:
The patent introduces an intermediary flow identity mechanism that bridges port-based routing and deep packet inspection. The flow identity serves as a mediator that captures application-specific information from deep packet inspection while enabling fast subsequent routing decisions, thus resolving the speed-accuracy contradiction
2Measurement precision
If routers perform deep packet inspection to identify applications accurately, then application identification accuracy improves, but the complexity and processing time of routing decisions increases
Solution Approach 1:
Deep packet inspection is performed only once as a preliminary action when a flow is first encountered, rather than on every packet. The results are cached and reused for all subsequent packets in the same flow, reducing overall device complexity while maintaining high identification accuracy
Solution Approach 2:
The patent creates a copy of the application identification result from the deep packet inspection and stores it in the flow identity. This copy allows subsequent routing decisions to reference the cached information without repeating the complex inspection process, reducing device complexity while preserving accuracy
3Stability of the object's composition
If all packets in a flow are routed using the same method, then routing consistency is maintained, but the ability to prioritize different applications deteriorates
Solution Approach 1:
The router performs preliminary deep packet inspection on initial packets to identify the application, then uses this identified application information to determine appropriate routing policies for all packets in the flow. This allows consistent application of application-specific routing policies while maintaining overall routing consistency within each flow
Solution Approach 2:
The patent applies different routing qualities to different applications by identifying the application associated with each flow and applying application-specific routing policies. This allows latency-sensitive applications to receive priority treatment while other applications use standard routing, achieving both consistency within flows and adaptability across different applications
Data Source
AI summary
Methods, systems, and apparatus, including computer program products, featuring receiving at a network device a plurality of packets associated with a flow, one or more of the plurality of packets having associated header data and content. Based on the content of one or more first packets in the plurality of packets, the network device identifies an application associated with the flow, where none of the first packets is addressed to the network device. For one or more second packets associated with the flow, the network device determines a forwarding destination for the second packets based on the application associated with the flow and forwards the packet according to the determined forwarding destination.