Traffic Identification via Switch-Router Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems face challenges in economically performing packet identification with fine granularity due to the limited number of entries in commercially available routers, which are insufficient to handle the numerous header information patterns used by applications.
Innovation Solution
A traffic identification device and method that involves a first acquisition module for acquiring packet identification information with fine granularity and a second acquisition module for coarser granularity, setting these identifiers in a switch and router respectively, allowing the switch to assign network identifiers and the router to transfer packets accordingly, thereby enhancing granularity without the need for expensive dedicated hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dedicated hardware products such as DPI are used to identify packets at fine application level, then packet identification precision is improved, but device cost increases
Solution Approach 1:
The system segments the packet identification function into two parts: coarse-grained identification (5-tuple filtering) is performed by the router, while fine-grained identification (application-level inspection) is performed by the DPI device. This segmentation allows each component to operate at its optimal capability level, achieving fine-grained packet identification without requiring the entire system to be built with expensive dedicated hardware
Solution Approach 2:
The router acts as an intermediary between the network and the DPI device. It pre-filters packets using 5-tuple information and forwards only relevant packets to the DPI device for detailed inspection. This intermediary role reduces the processing burden on the DPI device and enables fine-grained identification at a lower overall system cost
2Measurement precision
If the number of entries in commercially available router is increased to handle more header information patterns, then packet identification granularity is improved, but device capacity is exceeded
Solution Approach 1:
The identification task is segmented into two levels: the router handles coarse-grained identification with a limited number of 5-tuple entries (source IP, destination IP, source port, destination port, protocol), while the DPI device handles fine-grained identification of application-level patterns. This segmentation allows the router to maintain a manageable entry count while still achieving fine-grained overall identification capability
Solution Approach 2:
The system transitions from a single-dimension identification approach (relying solely on router 5-tuple filtering) to a two-dimension approach by introducing application-level protocol analysis. This adds a new dimension of identification capability that works in conjunction with the router's address-based filtering, enabling fine-grained identification without increasing router entry capacity requirements
3Ease of manufacture
If commercially available router is used for packet identification, then device cost is reduced, but packet identification granularity deteriorates
Solution Approach 1:
The system merges the strengths of two different devices: the cost-effectiveness and address-based filtering capability of commercially available routers, and the fine-grained application-level inspection capability of DPI devices. By combining these two identification mechanisms in series, the system achieves fine-grained packet identification at a lower overall cost than using DPI alone
4Measurement precision
If the number of registered entries in router is increased to control network with finer granularity, then packet identification precision is improved, but router performance deteriorates
Solution Approach 1:
The system extracts the computationally intensive fine-grained packet inspection function from the router and relocates it to the DPI device. The router retains only the lightweight 5-tuple filtering function, which requires minimal processing resources. This extraction preserves router processing performance while still achieving fine-grained identification through the DPI device
Data Source
AI summary
A traffic identification device includes a first acquisition module, a first setting module, a second acquisition module, and a second setting module. The first acquisition module acquires first packet identification information for identifying a packet with a first granularity and a network identifier associated with the first packet identification information. The first setting module sets the first packet identification information and the network identifier to a switch connected to a router for receiving packets from a user base such that the switch assigns the network identifier to a packet matching the first packet identification information. The second acquisition module acquires second packet identification information for identifying a packet transmitted from the user base with a second granularity coarser than the first granularity. The second setting module sets the second packet identification information to the router.