Split TCP Flow Management for Recycled Port Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The expansion of the Internet has led to issues with packet traffic management, particularly in situations where source port values are recycled, causing asynchronous connection states between control and data flow segments, which can result in invalid connection flow updates and impact load balancing and system reliability.
Innovation Solution
A packet traffic management device employs a split data flow segment and control segment to generate and cache connection flow identifiers, allowing the control segment to validate connection flow updates by comparing received identifiers with cached ones, thereby distinguishing between new and recycled connections and minimizing SYN flood impacts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If source port values are recycled to reuse limited port resources, then port availability is improved, but connection state synchronization between control and data flow segments deteriorates
Solution Approach 1:
The control segment generates and caches connection flow identifiers before connections are fully established. When a connection terminates and its source port is recycled, the cached identifier remains valid for a predetermined time period, allowing the system to pre-validate future connection attempts with the same port before actual connection establishment occurs. This preliminary validation prevents asynchronous state issues from arising in the first place.
Solution Approach 2:
Connection flow identifiers serve as an intermediary mechanism between the control segment and data flow segment. These identifiers uniquely identify connection flows and enable the control segment to validate connection flow updates from the data flow segment without requiring direct state synchronization. The identifier acts as a mediator that resolves the asynchronous communication problem between the two segments.
2Measurement precision
If connection flow updates are validated by comparing identifiers in real-time, then connection state accuracy is improved, but processing time increases
Solution Approach 1:
The control segment generates connection flow identifiers in advance and caches them before connections are fully established or terminated. This preliminary generation and caching eliminates the need for real-time identifier creation during connection validation, significantly reducing processing time while maintaining accurate connection state tracking through the cached identifiers.
3Productivity
If source port recycling time is reduced to improve port reuse efficiency, then port utilization is improved, but connection establishment conflicts increase
Solution Approach 1:
The system implements a predetermined time period after connection termination during which the control segment retains cached identifiers for recycled source ports. This time buffer allows the control segment to validate incoming connection attempts against cached identifiers before allowing the port to be fully reused, preventing conflicts while enabling rapid port recycling. The validation mechanism ensures connection establishment correctness even with aggressive port reuse policies.
Data Source
AI summary
Embodiments are directed towards employing a packet traffic management device that has a split data flow segment (“DFS”) and control segment (“CS”) to determine if a connection flow update provided by the DFS to the CS is valid. The CS may be utilized to establish connection flows at the DFS based on connection flow requests. The CS may generate a connection flow identifier (“CFID”) for a connection flow request. The CS may cache the CFID at the CS. The CS may establish a connection flow at the DFS based at least on the connection flow request and the CFID. After a connection flow is established, a DFS may provide a connection flow update and a corresponding CFID to the CS. The CS may determine that the connection flow update is valid if the corresponding CFID matches the CFID cached at the CS.