Hash based per subscriber DNS based traffic classification

• US 10,326,700 B1
• Filed: 03/29/2017
• Issued: 06/18/2019
• Est. Priority Date: 03/29/2016
• Status: Active Grant

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Koenning, Christian Josef
• Primary Examiner(s): Nowlin, Eric
• Application Number:
  US15/472,969
• Time in Patent Office: 811 Days
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 45/7453 using hashing
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Embodiments are directed towards managing name service communications using traffic management computers (TMCs). TMCs may extract values from a name service reply received from one or more name service computers. TMCs may provide a name service key based on the values extracted from the name service reply. Accordingly, if a new flow may be detected further actions may be performed, including: TMCs may extract values from a network packet associated with the new flow; TMCs may provide a flow key based on one or more values from one or more fields of a network packet associated with the new flow; TMCs may compare the flow key to one or more name service keys; and if the comparison may be affirmative, TMCs may apply one or more traffic management policies associated with the affirmative comparison.

Claims

1. A method for managing communication over a network with one or more traffic management computers (TMCs) that include one or more processors, wherein the one or more processors execute the method to perform actions, comprising:

receive, by the one or more processors on the one or more TMCs, one or more name service replies from one or more name service computers;

extract, by the one or more processors on the one or more TMCs, one or more tuple values from each name service reply received from one or more name service computers;

provide, by the one or more processors on the one or more TMCs, a name service key for each received name service reply based on the one or more tuple values extracted from each received name service reply, wherein each name service key is stored in a subscriber table managed by the one or more TMCs, wherein the subscriber table associates each stored name service key with subscriber information;

detect, by the one or more processors on the one or more TMCs, a new flow based on one or more characteristics of the new flow;

provide, by the one or more processors on the one or more TMCs, a flow key that is based on one or more tuple values extracted from a network packet included with the new flow, wherein the flow key is stored in a connection table managed by the one or more TMCs;

compare, by the one or more processors on the one or more TMCs, the flow key to each stored name service key;

employ, by the one or more processors of the one or more TMCs, one or more affirmative results of the comparison to provide subscriber information associated with the new flow, wherein one or more traffic management policies that are associated with the subscriber information is applied to the new flow;

receive, by the one or more processors on the one or more TMCs, a name service query from a computer;

extract, by the one or more processors on the one or more TMCs, one or more values from the name service query;

provide, by the one or more processors on the one or more TMCs, the name service key based on the one or more values extracted from the name service query; and

store, by the one or more processor on the one or more TMCs, the name service key in the subscriber table.

2. The method of claim 1, wherein the one or more processors on the one or more TMCs are a single processor.

3. The method of claim 1, wherein a subset of the one or more processors are within a single TMC.

4. The method of claim 1, wherein providing the name service key further comprises:

providing a time bucket value based on a timestamp that is associated with the name service reply; and

ignoring the one or more affirmative results of the comparison for network packets that have a timestamp that is outside of the time bucket value.

5. The method of claim 1, wherein providing the name service key, further comprises:

extracting a source address from the name service reply;

extracting a destination address from the name service reply;

providing a time bucket value from a time stamp associated with the name service reply; and

generating a hash value that is a function of the source address, the destination address, and the time bucket value.

6. The method of claim 1, further comprising, provide, by the one or more processors of the one or more TMCs, the one or more affirmative results based on a match of the new flow key and one stored name service key.

7. One or more traffic management computers (TMCs) comprising:

memory comprising programmed instructions stored in the memory; and

one or more processors configured to be capable of executing the programmed instructions stored in the memory to perform operations, comprising;

perform the operations to receive one or more name service replies from one or more name service computers;

perform the operations to extract one or more tuple values from each name service reply received from the one or more name service computers;

perform the operations to provide a name service key for each received name service reply based on the one or more tuple values extracted from each received name service reply, wherein each name service key is stored in a subscriber table managed by the one or more TMCs, wherein the subscriber table associates each stored name service key with subscriber information;

perform the operations to detect a new flow based on one or more characteristics of the new flow;

perform the operations to extract one or more values from a network packet that is associated with the new flow;

perform the operations to provide, a flow key that is based on one or more tuple values extracted from a network packet included with the new flow, wherein the flow key is stored in a connection table managed by the one or more TMCs;

perform the operations to compare the flow key to each stored name service key;

perform the operations to employ one or more affirmative results of the comparison to provide subscriber information associated with the new flow, wherein one or more traffic management policies that are associated with the subscriber information is applied to the new flow;

perform the operations to receive a name service query from a computer;

perform the operations to extract one or more values from the name service query;

perform the operations to provide the name service key based on the one or more values extracted from the name service query; and

perform the operations to store the name service key in the subscriber table.

8. The one or more TMCs of claim 7, wherein the one or more processors are a single processor.

9. The one or more TMCs of claim 7, wherein a subset of the one or more processors are within a single TMC.

10. The one or more TMCs of claim 7, wherein performing operations to provide the name service key further comprises:

providing a time bucket value based on a timestamp that is associated with the name service reply; and

ignoring the one or more affirmative results of the comparison for network packets that have a timestamp that is outside of the time bucket value.

11. The one or more TMCs of claim 7, wherein performing operations to provide the name service key, further comprises:

extracting a source address from the name service reply;

extracting a destination address from the name service reply;

providing a time bucket value from a time stamp associated with the name service reply; and

generating a hash value that is a function of the source address, the destination address, and the time bucket value.

12. The one or more TMCs of claim 7, further comprising, perform operations to provide the one or more affirmative results based on a match of the new flow key and one stored name service key.

13. A processor readable non-transitory storage media that includes instructions for managing communication over a network, wherein executions of the instructions by one or more processors on a traffic management computer (TMC) perform operations, comprising:

receiving one or more name service replies from one or more name service computers;

extracting one or more tuple values from each name service reply received from the one or more name service computers;

providing a name service key for each received name service reply based on the one or more tuple values extracted from each received name service reply, wherein each name service key is stored in a subscriber table managed by the one or more TMCs, wherein the subscriber table associates each stored name service key with subscriber information;

detecting a new flow based on one or more characteristics of the new flow;

extracting one or more values from a network packet that is associated with the new flow;

providing a flow key that is based on one or more tuple values extracted from a network packet included with the new flow, wherein the flow key is stored in a connection table managed by the one or more TMCs;

comparing the flow key to each stored name service key;

employing one or more affirmative results of the comparison to provide subscriber information associated with the new flow, wherein one or more traffic management policies that are associated with the subscriber information is applied to the new flow

receiving a name service query from a computer;

extracting one or more values from the name service query;

providing the name service key based on the one or more values extracted from the name service query; and

storing the name service key in the subscriber table.

14. The processor readable non-transitory storage media of claim 13, wherein the one or more processors are a single processor.

15. The processor readable non-transitory storage media of claim 13, wherein a subset of the one or more processors are within a single TMC.

16. The processor readable non-transitory storage media of claim 13, wherein providing the name service key further comprises:

providing a time bucket value based on a timestamp that is associated with the name service reply; and

ignoring the one or more affirmative results of the comparison for network packets that have a timestamp that is outside of the time bucket value.

17. The processor readable non-transitory storage media of claim 13, wherein providing the name service key, further comprises:

extracting a source address from the name service reply;

extracting a destination address from the name service reply;

providing a time bucket value from a time stamp associated with the name service reply; and

generating a hash value that is a function of the source address, the destination address, and the time bucket value.

18. The processor readable non-transitory storage media of claim 13, further comprising, providing the one or more affirmative results based on a match of the new flow key and one stored name service key.