Network Traffic Identification via Packet Sampling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network appliances, such as DPI devices, struggle to achieve high throughput due to their limited capacity compared to core switches, leading to inefficiencies in traffic identification and management, especially with encrypted traffic and long-lived streams, which results in inadequate network monitoring and management capabilities.
Innovation Solution
A network device that filters out identifying packets and samples a predetermined proportion of packets at line-rate speeds, using a programmable ASIC to send only essential packets to a DPI appliance for analysis, allowing for efficient traffic identification and management without sacrificing throughput.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network appliances perform deep packet inspection on all traffic, then traffic identification accuracy is improved, but throughput performance deteriorates
Solution Approach 1:
The system performs deep packet inspection on only a sampled portion of traffic (e.g., 10% of packets) rather than all traffic. This partial inspection approach maintains adequate traffic identification accuracy while dramatically improving throughput performance, allowing the DPI appliance to operate at line rate speeds.
Solution Approach 2:
The system segments traffic processing into two paths: a sampled inspection path for DPI analysis and a bypass path for the majority of traffic. This segmentation allows the DPI appliance to focus resources on analyzing representative samples while the core network infrastructure handles the bulk traffic flow, resolving the throughput-accuracy tradeoff.
2Adaptability or versatility
If network appliances are deployed across the entire network, then network monitoring coverage is improved, but device complexity and cost increase
Solution Approach 1:
The system enables a single DPI appliance to effectively monitor entire network segments by using sampled traffic analysis. The sampled packets provide representative information about overall network traffic patterns, allowing one appliance to perform the function that would otherwise require multiple appliances distributed across the network.
Solution Approach 2:
The system introduces a sampling mechanism as an intermediary between the network traffic and the DPI appliance. This sampling layer selectively extracts representative packets for analysis, enabling comprehensive network monitoring coverage without requiring direct inspection of all traffic by multiple appliances throughout the network infrastructure.
3Measurement precision
If packet sampling rate is increased, then traffic analysis accuracy is improved, but processing load on DPI appliance increases
Solution Approach 1:
The system dynamically adjusts the sampling rate parameter based on network conditions and analysis requirements. By optimizing this parameter, the system achieves adequate traffic analysis accuracy while keeping the processing load on the DPI appliance within acceptable limits, allowing operation at or near line rate speeds.
Data Source
AI summary
A network traffic device comprising: at least one network device adapted to receive network data packets; wherein said at least one network device filters network data packets to locate at least one identifying packet, and samples said network data packets to select at least one sample packet. The at least one network device may transfer said at least one identifying packet and said at least one sample packet to an analyser. A predetermined sample rate may determine the number of sample packets selected by said at least one network device.