Silicon Switch Packet Classification and Pattern Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current silicon switches can only examine one frame at a time and lack memory, limiting their ability to perform actions based on multiple packets or historical data, making them ineffective for complex traffic management and security monitoring.
Innovation Solution
A silicon switch equipped with a processor that selects packets based on classification rules, compares them to patterns, and generates commands for actions, using a scripting language to execute these commands and modify rules or drop packets, allowing for state-based traffic management and security responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a silicon switch examines only one frame at a time with no memory, then the device complexity is low and processing speed is high, but the ability to perform actions based on multiple packets or historical data is limited
Solution Approach 1:
The system segments packet processing into two distinct parts: a high-speed silicon switch fabric that performs initial packet classification and forwarding decisions, and a separate processor that performs complex multi-packet analysis. This segmentation allows the switch fabric to maintain high processing speed while the processor provides advanced traffic management capabilities.
Solution Approach 2:
A processor acts as an intermediary between the silicon switch fabric and the control system. The processor receives packet information from the switch fabric, performs complex analysis based on multiple packets and historical data, generates processor commands, and sends them back to the switch fabric for execution. This intermediary enables sophisticated traffic management without compromising the speed of the switch fabric.
2Device complexity
If a silicon switch has no memory, then the device complexity is low, but the ability to store and analyze historical packet data is limited
Solution Approach 1:
The system performs preliminary actions by having the silicon switch fabric classify and forward packets in real-time, while simultaneously providing packet information to the processor. The processor then performs preliminary analysis on accumulated packet data before generating commands, ensuring that historical data is captured and analyzed without adding complexity to the switch fabric structure.
Solution Approach 2:
The solution adds a temporal dimension to packet processing by enabling the processor to analyze sequences of packets over time. While the silicon switch fabric processes packets in real-time at line rate, the processor accumulates and analyzes historical packet data, creating a time-based analysis layer that provides contextual information for traffic management decisions.
3Loss of time
If actions are based only on a single frame, then the processing time is short, but the accuracy of traffic management decisions is limited
Solution Approach 1:
The system implements periodic action by having the processor analyze accumulated packet data at regular intervals and generate periodic processor commands. The silicon switch fabric continuously classifies packets in real-time, while the processor periodically reviews accumulated data, performs pattern recognition, and updates traffic management rules. This periodic analysis maintains low latency while improving decision accuracy through historical context.
Data Source
AI summary
A network device including a classifier and a processor. The classifier is configured to select a plurality of packets according to a rule. The rule describes a characteristic associated with the plurality of packets selected by the classifier. The processor is configured to, during runtime, execute a program to compare a portion of the plurality of packets to one or more predetermined patterns. During the runtime, one or more additional predetermined patterns can be added to the program for comparison with a portion of one or more of the plurality of packets selected by the classifier without having to reboot the network device.