Network Processor Traffic Control Using TCAM and 5-Tuple Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High-speed Internet Protocol (IP) traffic measurement, analysis, control, and management are challenged by packet loss due to the need for precise identification of various application services, which is inefficient with existing hardware-based methods using Network Processors, especially when pattern searching functions are repeated, leading to performance reduction and potential packet loss.
Innovation Solution
A traffic control apparatus and method utilizing a network processor with an interface connector, frame generator, and Ternary Content Addressable Memory (TCAM) to identify and classify IP packets by analyzing protocol headers and executing programmable applications, ensuring real-time application identification and classification without packet loss, using a high-speed search function and TCAM for pattern matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern searching function is performed multiple times to identify application services, then identification accuracy is improved, but processing speed deteriorates leading to packet loss
Solution Approach 1:
The patent performs preliminary classification of IP packets using 5-tuple information (source IP, destination IP, protocol, source port, destination port) before detailed pattern matching. This preliminary action filters out packets that can be identified without payload examination, reducing the number of packets requiring multiple pattern searches and thus maintaining high processing speed while ensuring accurate identification when needed.
Solution Approach 2:
The patent segments the packet identification process into multiple stages: first-stage classification using 5-tuple information, second-stage pattern matching on HTTP headers, and third-stage payload analysis. This segmentation allows the system to apply different processing depths to different packets, performing multiple pattern searches only when necessary, thereby resolving the contradiction between identification accuracy and processing speed.
2Device complexity
If fixed-length pattern searching is performed at high speed without TCAM, then device complexity is reduced, but processing time increases causing packet loss
Solution Approach 1:
The patent changes the search parameters by using variable-length pattern matching on HTTP header fields (such as Host, User-Agent, Accept) rather than fixed-length patterns. This allows the system to identify applications based on characteristic header sequences without requiring TCAM hardware, achieving accurate identification with simpler device architecture while maintaining acceptable processing times through efficient string matching algorithms.
3Measurement precision
If payload examination is performed to accurately identify application services, then identification precision is improved, but processing overhead increases
Solution Approach 1:
The patent applies partial action by examining only the necessary portions of packet payloads - specifically HTTP header fields - rather than analyzing entire packet contents. The system extracts and analyzes specific header fields (Host, User-Agent, Accept, etc.) that are sufficient for application identification, avoiding the excessive energy consumption that would result from complete payload examination while maintaining high identification precision.
Data Source
AI summary
A traffic control apparatus is provided which includes an interface connector to transmit/receive an Internet Protocol (IP) packet to/from an external circuit, a frame generator to receive the IP packet through the interface connector and to generate a Media Access Control (MAC) frame, and a network processor to transmit/receive the IP packet to/from the frame generator, to execute at least one programmable application, and to identify and classify the at least one programmable application.