TCP-splitter: reliable packet monitoring methods and apparatus for high speed networks

• US 20030177253A1
• Filed: 08/15/2002
• Published: 09/18/2003
• Est. Priority Date: 08/15/2002
• Status: Active Grant

• Current Assignee: Washington University In St Louis
• Original Assignee: Washington University In St Louis
• Inventors: Lockwood, John W., Schuehler, David V.
• Granted Patent: US 7,711,844 B2
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A method for obtaining data while facilitating keeping a minimum amount of state is provided. The method includes receiving at a first device an Internet Protocol (IP) frame sent from a second device to a third device wherein the first device is in a flow path between the second and third devices, the first device including at least one of an Application Specific Integrated Circuit (ASIC) and a Field Programmable Gate Array FPGA. The method also includes removing an embedded stream-oriented protocol frame including a header and a data packet from the received IP frame with at least one of the ASIC and the FPGA, and determining a validity of a checksum of the removed steam-oriented protocol header. The method also includes dropping the IP frame when the checksum is invalid, supplying a client application with data from the removed protocol frame when the checksum is valid, and sending an IP frame including the removed stream-oriented protocol frame to the third device from the first device when the checksum is valid.

Claims

1. A method for obtaining data while facilitating keeping a minimum amount of state, said method comprising:

receiving at a first device an Internet Protocol (IP) frame sent from a second device to a third device wherein the first device is in a flow path between the second and third devices, the first device including at least one logic device;

removing an embedded stream-oriented protocol frame including a header and a data packet from the received IP frame with the logic device;

determining a validity of a checksum of the removed steam-oriented protocol header;

dropping the IP frame when the checksum is invalid;

actively dropping IP frames such that the first device always has an accumulated in order content stream before the third device accumulates the in order stream;

supplying a client application with data from the removed protocol frame when the checksum is valid; and

sending an IP frame including the removed stream-oriented protocol frame to the third device from the first device when the checksum is valid.

2. A method in accordance with claim 1 wherein sending an IP frame including the removed protocol frame comprises:

classifying the removed protocol frame as at least one of a sequence number greater than expected classification, a sequence number equal to expected classification, and a sequence number less than expected classification;

sending an IP frame including the removed protocol frame to the third device from the first device when the classification is one of the sequence number less than expected classification and the sequence number equal to expected classification; and

dropping an IP frame including the removed protocol frame when the classification is the sequence number greater than expected classification.

3. A method in accordance with claim 1 wherein removing an embedded stream-oriented protocol frame from the received IP frame with the logic device comprises removing a Transmission Control Protocol (TCP) frame from the received IP frame with the logic device

4. A method in accordance with claim 1 further comprising classifying the removed embedded stream-oriented protocol frame as at least one of a sequence number greater than expected classification, a sequence number less than expected classification, an invalid Transmission Control Protocol (TCP) checksum classification, a non-TCP classification, a TCP synchronization (TCP SYN) classification, and an else classification.

5. A method in accordance with claim 4 wherein supplying a client application with data from the removed protocol frame comprises supplying a client application with data from the removed protocol frame only when the classification is else.

6. A method in accordance with claim 5 wherein sending an IP frame including the removed protocol frame to the third device from the first device comprises sending an IP frame including the removed protocol header to the third device from the first device only when the classification is at least one of non-TCP, TCP SYN, sequence number less than expected, and else.

7. A method in accordance with claim 6 further comprising dropping the received IP frame when the classification is at least one of invalid TCP checksum and sequence number greater than expected.

8. A method in accordance with claim 1 wherein supplying a client application with data from the removed protocol frame comprises supplying a client application with data from the removed protocol frame such that content of a Transmission Control Protocol (TCP) stream is provided to a client application in order.

9. A method in accordance with claim 1 wherein sending an IP frame including the removed protocol frame to the third device from the first device comprises sending the IP frame received by the first device from the first device to the third device.

10. A method in accordance with claim 1 wherein supplying a client application with data from the removed protocol frame comprises supplying a client application that counts bits with data from the removed protocol frame.

11. A method in accordance with claim 1 wherein supplying a client application with data from the removed protocol frame comprises supplying a client application with data from the removed protocol frame wherein the client application compares the supplied data with reference data to perform content matching.

12. A method in accordance with claim 1 wherein supplying a client application with data from the removed protocol frame when the checksum is valid comprises supplying a client application with data from the removed protocol frame comprising FPGA programming data.

13. An apparatus for facilitating keeping a minimum amount of state, said apparatus comprising:

at least one input port;

at least one output port; and

at least one logic device operationally coupled to said input port and said output port, said logic device configured to;

receive an Internet Protocol (IP) frame sent from a first device addressed to a second device;

remove an embedded stream-oriented protocol frame including a header and data packet from the received IP frame;

classify the removed protocol frame as at least one of a sequence number greater than expected classification, a sequence number equal to expected classification, and a sequence number less than expected classification;

send an IP frame including the removed protocol frame to the second device when the classification is one of the sequence number less than expected classification and the sequence number equal to expected classification;

drop the received IP frame including the removed protocol frame when the classification is the sequence number greater than expected classification; and

actively drop IP frames such that said apparatus always has an accumulated in order content stream before the second device accumulates the in order stream.

14. An apparatus in accordance with claim 13 wherein said logic device further configured to:

remove a Transmission Control Protocol (TCP) frame from the received IP frame;

determine a validity of a TCP checksum of the removed TCP frame;

drop the IP frame when the TCP checksum is invalid; and

send an IP frame including the removed TCP frame to the second device when the TCP checksum is valid.

15. An apparatus in accordance with claim 13 wherein said logic device further configured to classify the removed protocol frame as at least one of a sequence number greater than expected classification, a sequence number less than expected classification, an invalid TCP checksum classification, a non-TCP classification, a TCP synchronization (TCP SYN) classification, and an else classification.

16. An apparatus in accordance with claim 15 wherein said logic device further configured to supply a client application with data from the removed protocol frame only when the classification is the else classification.

17. An apparatus in accordance with claim 15 wherein said logic device further configured to send an IP frame including the removed protocol frame to the second device only when the classification is at least one of the non-TCP classification, the TCP SYN classification, the sequence number less than expected classification, and the else classification.

18. An apparatus in accordance with claim 15 wherein said logic device further configured to drop the received IP frame when the classification is at least one of the invalid TCP checksum classification and the sequence number greater than expected classification.

19. An apparatus in accordance with claim 13 wherein said logic device further configured to supply a client application with data from the removed protocol frame such that content of a Transmission Control Protocol (TCP) stream is provided to a client application in order.

20. An apparatus in accordance with claim 13 wherein said logic device further configured to send to the second device an IP frame comprising the IP frame received by said IC.

21. An apparatus in accordance with claim 13 wherein said logic device further configured to supply a client application that counts bits with data from the removed protocol frame.

22. An apparatus in accordance with claim 13 wherein said logic device further configured to supply a client application with data from the removed protocol frame wherein the client application compares the supplied data with reference data to perform content matching.

23. An apparatus in accordance with claim 13 further comprising a Field Programmable Gate Array (FPGA) operationally coupled to said logic device, said logic device configured to reprogram said FPGA.

24. An apparatus in accordance with claim 23 wherein said FPGA operationally coupled to said input port and said output port.

25. An apparatus comprising:

at least one input port;

at least one output port; and

at least one reprogrammable device;

at least one logic device operationally coupled to said input port, said output port, and said reprogrammable device, said logic device configured to;

receive an Internet Protocol (IP) frame sent from a first device addressed to a second device;

remove an embedded stream-oriented protocol frame including a header and a data packet from the received IP frame;

determine if the removed protocol frame includes programming data;

reprogram said reprogrammable device when the removed protocol frame contains programming data; and

send an IP frame including the removed protocol frame to the second device.

26. An apparatus comprising:

at least one input port;

at least one output port; and

at least one logic device operationally coupled to said input port and said output port, said logic device configured to;

receive an Internet Protocol (IP) frame sent from a first device addressed to a second device;

remove an embedded stream-oriented protocol frame including a header and a data packet from the received IP frame;

determine if the removed protocol frame includes data representing at least part of a quality of service (QoS) algorithm;

supply a client application with data from the removed protocol frame when the removed protocol includes data representing at least part of a QoS algorithm; and

send an IP frame including the removed protocol frame to the second device.

27. An apparatus in accordance with claim 26 wherein said logic device further configured to reconfigure at least one QoS policy in accordance with the QoS data supplied to the client application.

28. A network comprising a plurality of switching devices operationally coupled to each other, at least some of said switching devices comprising at least one logic device configured to:

monitor stream-oriented network traffic for Field Programmable Gate Array (FPGA) programming data;

reprogram at least one of itself and a FPGA coupled to said logic device upon receipt of the FPGA programming data; and

retransmit the FPGA programming data back onto the network such that other switching devices can reprogram at least one of themselves and an attached FPGA using the FPGA programming data.

29. A network in accordance with claim 28 wherein to monitor stream-oriented network traffic for FPGA programming data, at least some of said switching devices configured to:

receive an Internet Protocol (IP) frame sent from a first device addressed to a second device;

remove an embedded stream-oriented protocol frame from the received IP frame; and

determine if the removed protocol frame includes FPGA programming data.

30. A network in accordance with claim 28 wherein to monitor stream-oriented network traffic for FPGA programming data, at least some of said switching devices configured to:

receive an Internet Protocol (IP) frame sent from a first device addressed to a second device;

remove an embedded stream-oriented protocol frame from the received IP frame;

determine if the removed steam-oriented protocol frame includes FPGA programming data;

supply a client application with data from the removed protocol frame when the removed protocol includes FPGA programming data; and

send an IP frame including the removed protocol frame to the second device.

31. A method for distributing data, said method comprising

receiving at a first device an Internet Protocol (IP) frame sent from a second device to a third device wherein the first device is in a flow path between the second and third devices, the first device including an Integrated Circuit (IC);

removing an embedded protocol frame from the received IP frame with the IC;

supplying a client application with data from the removed protocol frame;

analyzing the data supplied to the client application; and

sending an IP frame including the removed protocol frame to the third device from the first device only after analyzing the data.

32. A method for distributing data on a network using a single TCP/IP source, a single destination and one or more intermediate hardware based monitoring nodes, said method comprising:

receiving at a first device an Internet Protocol (IP) frame sent from a second device to a third device wherein the first device is in a flow path between the second and third devices, the first device including a logic device;

removing an embedded Transmission Control Protocol (TCP) frame from the received IP frame with the logic device;

supplying a client application with data from the removed protocol frame; and

sending an IP frame including the removed protocol frame to the third device from the first device after performing an analysis on the removed frame.

33. A method for identifying and selectively removing data on a data transmission system, said method comprising:

receiving at a first device an Internet Protocol (IP) frame sent from a second device to a third device wherein the first device is in a flow path between the second and third devices, the first device including a logic device;

actively dropping IP frames addressed to the third device sent by the second device such that the first device always has an accumulated in order content stream before the third device accumulates the in order content stream.

34. A dynamically reconfigureable data transmission system, having an apparatus comprising:

at least one input port;

at least one output port; and

at least one logic device operationally coupled to said input port and said output port, said logic device configured to;

receive an Internet Protocol (IP) frame sent from a first device addressed to a second device;

remove an embedded protocol frame from the received IP frame;

determine if the removed protocol frame includes Field Programmable Field Array (FPGA) programming data;

supply a client application with data from the removed protocol frame when the removed protocol includes FPGA programming data such that the application receives a content stream in order; and

send an IP frame including the removed protocol frame to the second device.