Methods and systems for dynamic path selection and data flow forwarding

• US 10,142,164 B2
• Filed: 09/16/2015
• Issued: 11/27/2018
• Est. Priority Date: 09/16/2014
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Cloudgenix, Inc. (Palo Alto Networks Incorporated)
• Inventors: Ramachandran, Kumar, Anand, Venkataraman, Yadav, Navneet, Ramasamy, Arivu, Edwards, Aaron, Reddy, Gopal
• Primary Examiner(s): Musa, Abdelnabi O
• Application Number:
  US14/856,328
• Publication Number:
  US 20160080251A1
• Time in Patent Office: 1,168 Days
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/125 : based on throughput or bandwidth
• CPC Class Codes: H04L 45/22 : Alternate routing
• CPC Class Codes: H04L 45/28 : using route fault recovery
• CPC Class Codes: H04L 45/302 : Route determination based on requested QoS
• CPC Class Codes: H04L 45/306 : Route determination based on the nature of the carried application
• CPC Class Codes: H04L 45/38 : Flow based routing
• CPC Class Codes: H04L 47/125 : by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/22 : Traffic shaping
• CPC Class Codes: H04L 47/24 : Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/32 : by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 47/781 : Centralised allocation of resources
• CPC Class Codes: H04L 47/825 : Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 61/2503 : Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/4511 : using domain name system [DNS]
• CPC Class Codes: H04L 61/4523 : using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/52 : specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks

Abstract

A method includes detecting a data flow and an associated originating interface on a network, determining a first link over which to forward the data flow, transmitting the data flow over the determined link, receiving a return data flow and moving a forward direction of the return data flow to a new path if the return data flow arrived via a link other than the first link, wherein all packets following a first packet on the flow are forwarded on the same path as the first packet.

Claims

1. A method comprising:

designating, by a networked branch device on a network, a plurality of network data flows as belonging to a selected application if a network data flow is to or from a traffic source that initially accesses the selected application via an anchor domain of the selected application and if the network data flow occurs within a predetermined time period from an identified corresponding time of the initial access by that traffic source;

monitoring, by the networked branch device, any subsequent designated network data flows of the selected application and an associated originating interface and associated destination;

determining for each monitored network data flow of the selected application, by the networked branch device, a corresponding first path over which to forward the monitored network data flow to the associated destination, irrespective of a previous path of the monitored network data flow to the associated destination;

transmitting for each monitored network data flow of the selected application, by the networked branch device, the monitored network data flow over the determined corresponding first path;

receiving for each monitored network data flow of the selected application, by the networked branch device, a corresponding return data flow from the associated destination to the networked branch device;

determining for each monitored network data flow of the selected application, a corresponding second path on which the return data flow is received from the associated destination; and

moving for each monitored network data flow of the selected application, by the networked branch device, a forward direction of the network data flow, wherein the forward direction of the network data flow is from the associated originating interface to the associated destination, to a new path corresponding to the second path if the determined corresponding second path is different than the first path;

wherein for each monitored network data flow of the selected application, all packets following an initial packet of the network data flow in the forward direction on the corresponding second path are forwarded on the same second path as that initial packet in order to prevent flow asymmetry between the forward and the return network data flows.

2. The method of claim 1, further comprising storing the determined first paths at Layer 4(L4) level in a flow table.

3. The method of claim 1, wherein a network data flow is detected via one of a synchronized packet (SYN) and a detected unknown server-client user datagram protocol (UDP) session.

4. The method of claim 1, wherein determining a first path comprises applying time-based application domain classification.

5. The method of claim 1, wherein determining a first path and a second path comprises network mapping.

6. The method of claim 1, further comprising modeling an application session.

7. The method of claim 1, further comprising predicting bandwidth requirements for the network.

8. The method of claim 1, wherein the network data flows are employed via synchronized packet (SYN).

9. The method of claim 1, further comprising storing a detected anomalous flow at a configurable device.

10. A networked branch device configured to:

designate a plurality of network data flows as belonging to a selected application if a network data flow is to or from a traffic source that initially accesses the selected application via an anchor domain of the selected application and if the network data flow occurs within a predetermined time period from an identified corresponding time of the initial access by that traffic source;

monitor any subsequent designated data flow of the selected application and an associated originating interface and associated destination on a network via a processor having a memory storing instructions for performing actions;

determine, using the processor, for each monitored network data flow of the selected application, a corresponding first path over which to forward the monitored network data flow to the associated destination irrespective of a previous path of the monitored network data flow to the associated destination;

transmit for each monitored network data flow of the selected application, the monitored data flow over the determined corresponding first path;

receive for each monitored network data flow of the selected application, a corresponding return data flow from the associated destination to the networked branch device;

determine for each monitored network data flow of the selected application, using the processor, a corresponding second path on which a return data flow is received from the associated destination; and

move for each monitored network data flow of the selected application, a forward direction of the network data flow, wherein the forward direction of the network data flow is from the associated originating interface to the associated destination, to a new path corresponding to the second path if the determined corresponding second path is different than the first path;

wherein for each monitored network data flow of the selected application, all packets following an initial packet of the data flow in the forward direction on the corresponding second path are forwarded on the same second path as that initial packet in order to prevent flow asymmetry between the forward and the return network data flows.

11. The networked branch device of claim 10 further configured to store the determined first paths at Layer 4(L4) level in a flow table.

12. The networked branch device of claim 10, wherein a network data flow is detected via one of a synchronized packet (SYN) and a detected unknown server-client user datagram protocol (UDP).

13. The networked branch device of claim 10, wherein determining the first path comprises applying time-based application domain classification.

14. The networked branch device of claim 10, wherein determining the first path and the second path comprises network mapping.

15. The networked branch device of claim 10, further configured to model an application session.

16. The networked branch device of claim 10, further configured to predict a bandwidth requirement for the network.

17. The networked branch device of claim 10, wherein the data flows are employed via synchronized packet (SYN).

18. The networked branch device of claim 10, further configured to store a detected anomalous flow at a configurable device.