Monitoring Tunneled IP Traffic via Payload Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IP traffic monitoring systems struggle to process high-bandwidth IP traffic in real time, especially when packets are tunneled, as they rely on outer IP addresses and port information for segregation, which is not usable when all packets have the same headers, leading to processor overload.
Innovation Solution
The system generates a copy of tunneled IP packets, reads the tunneled protocol address information from the payload, and distributes them to processors for classification and monitoring, allowing for finer segregation based on application, presentation, and session layer information, even when outer headers are identical.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If IP traffic monitoring systems rely on outer IP addresses and port information for packet segregation, then packet distribution among processors is achieved, but this approach becomes ineffective when packets are tunneled with identical headers, leading to processor overload
Solution Approach 1:
The patent extracts the tunneling protocol address information from the payload portion of the IP packet, separating it from the outer IP header. This extracted information is then used for packet distribution, allowing the system to bypass the limitation of identical outer headers in tunneled packets and achieve effective segregation even when outer IP addresses and ports are the same.
Solution Approach 2:
The patent introduces tunneling protocol address information as an intermediary element for packet distribution. Instead of directly using outer IP header information, the system uses the extracted tunneling protocol addresses as a mediating key to distribute packets among processors, enabling effective load distribution for tunneled traffic.
2Device complexity
If all tunneled packets with identical outer headers are directed to a single processor, then packet distribution is simplified, but the processor becomes overwhelmed and real-time monitoring is compromised
Solution Approach 1:
The patent segments the packet distribution task by extracting tunneling protocol address information from each packet's payload and using this information to distribute packets to different processors. This segmentation allows the system to handle tunneled packets with identical outer headers by creating distribution paths based on the inner tunneling protocol addresses, thereby preventing any single processor from being overwhelmed.
3Speed
If outer IP header information is used for traffic segregation, then packet classification is efficient, but finer granularity segmentation based on application layer information is not achieved
Solution Approach 1:
The patent extracts tunneling protocol address information from the payload portion of IP packets, enabling distribution based on finer-grained information than outer IP headers. This extracted information provides intermediate-level segmentation that bridges the gap between coarse outer header-based distribution and fine application layer-based classification.
Solution Approach 2:
The patent adds another dimension to packet distribution by utilizing tunneling protocol address information from the payload, rather than relying solely on the traditional network and transport layer header information. This creates an additional layer of segmentation granularity that enables more precise traffic classification while maintaining distribution efficiency.
Data Source
AI summary
Methods, systems, and computer program products for monitoring tunneled Internet protocol (IP) traffic on a high bandwidth IP network are disclosed. According to one method, a copy of a tunneled IP packet traversing an IP communications network is generated. The packet may include a payload having tunneled protocol address information. The tunneled protocol address information and the payload portion of the copied IP packet is read. The packet is distributed, using the tunneled protocol address information, to a function for providing at least one of packet classification and network monitoring service for the packet.