Rule-based packet selection, storage, and access method and system

• US 20040010473A1
• Filed: 07/11/2002
• Published: 01/15/2004
• Est. Priority Date: 07/11/2002
• Status: Active Grant

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Takahashi, Nobuhisa, Scoredos, Eric C., Hsu, Wan-Yen
• Granted Patent: US 7,254,562 B2
• Time in Patent Office: Days
• US Class Current: 705/77
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/085 involving remote charge determination or related payment systems
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A rule-based selection, storage and access method and system for processing packets from network traffic. First, packet intercepted from network traffic are selected based on at least one rule. Second, the selected packets are stored in an in-kernel storage buffer, which can be tuned to a size that is appropriate to the number packets being captured and the ability of a packet usage application (e.g., a billing program) to process the packets. Third, an access mechanism is provided to a packet usage application for accessing the stored packets. The intercepted network traffic is provided to a receiving application.

Claims

1. A method for processing packets in an environment that has requirements comprising the steps of:

a) selecting network packets based on one or more rules;

b) storing the selected packets in an configurable in-kernel memory buffer; and

c) providing a tuning tool for generating an output;

wherein the output can be utilized to adjust at least one configurable parameter to meet the requirements of the environment.

2. The method of claim 1 further comprising the step of:

d) employing the output of the tuning tool for adjusting the size of the in-kernel storage buffer to meet the requirements of a particular network environment;

wherein the size of the in-kernel storage buffer is configurable by an administrator.

3. The method of claim 1 wherein a configurable user-space storage buffer having a size is provided, the method further comprising the step of:

e) employing the output of the tuning tool for adjusting the size of the user-space storage buffer to meet the requirements of a particular network environment;

wherein the size of the user-space storage buffer is configurable by an administrator.

4. The method of claim 1 further comprising the step of:

d) providing an interface for use by an application to access the stored packets in the in-kernel storage buffer.

5. The method of claim 4 further comprising the step of:

e) providing a mechanism for reading a large number of packets from the in-kernel storage buffer in one read operation, and then allowing the billing application to access the retrieved packets one at a time.

6. The method of claim 1 wherein the step of selecting packets based on at least one rule includes intercepting packets from network traffic based on a rule that compares one of a source address field and a destination address field of the intercepted packet with a corresponding predetermined source address value and destination address value.

7. The method of claim 1 wherein the step of storing the selected packets in an in-kernel memory buffer includes storing a portion of the packet in the in-kernel memory buffer.

8. The method of claim 6 wherein the portion of the packet includes one of the TCP header, the IP header, and a predetermined user-defined field of the packet.

9. The method of claim 4 wherein the application includes one of a pay-per-use billing application for network access and a network traffic analysis application.

10. The method of claim 1 wherein the output of the tuning tool is a peak buffer usage in-kernel storage.

11. A method for selecting packets from network traffic comprising:

a) intercepting IP packets from incoming network traffic;

b) storing one or more of the intercepted packets in an in-kernel storage buffer based on at least one rule;

wherein the in-kernel storage buffer includes a size that is configurable;

c) transferring at least one packet from the in-kernel storage buffer to a user space storage buffer; and

d) forwarding the intercepted packets to a receiving application.

12. The method of claim 11 further comprising:

e) using the stored packets for a statistical purpose.

13. The method of claim 11 wherein the step of storing one or more of the intercepted packets based on at least one rule includes the steps of

b_—

1) applying a rule to the intercepted packets; and

b_—

2) storing the intercepted packets that comply with the rule in an in-kernel memory.

14. The method of claim 11 wherein the step of storing one or more of the intercepted packets based on at least one rule includes the steps of

b_—

1) storing a portion of the intercepted packet; and

b_—

2) storing a header portion of each intercepted packet;

wherein the portion includes a size that is configurable.

15. The method of claim 14 wherein the header portion includes one or an IP header, a TCP header, a HTTP header, and an application data field.

16. The method of claim 11 further comprising the steps of:

performing system configuration;

configuring at least one packet capturing rule;

capturing a packet from incoming network traffic based on the packet capturing rule; and

logging a portion of the packet in an in-kernel memory buffer.

17. The method of claim 16 further comprising the steps of:

a packet usage application opening a pseudo-driver;

the packet usage application issuing a read call;

the pseudo-driver retrieving a preconfigured amount of logged portions of packets;

the packet usage application accessing one logged network packet at a time from the pseudo-driver.

18. The method of claim 17 further comprising the steps of:

wherein the packet usage application is a billing program;

wherein the packet usage application accesses one header at a time from the in-kernel storage buffer by employing an access mechanism;

wherein remaining unread headers are cached in the user-space storage buffer.

19. The method of claim 18 wherein the size of the user-space buffer is configurable;

wherein a user can configure the size of the user-space buffer to meet the performance needs of the packet usage application.

20. A method for metering packets comprising the steps of:

a) setting at least one configuration parameter that includes at least one rule;

b) intercepting packets from network traffic;

c) selectively storing packets that match the rule in an in-kernel storage buffer;

wherein the size of the in-kernel storage buffer is configurable to accommodate a predetermined network traffic load without packet loss; and

d) a packet usage application accessing the stored packets.

21. The method of claim 20 wherein the stored packets are utilized by one of a packet metering application, a pay-per-use billing application, and a network traffic analyzer application;

the method further comprising;

extracting a header portion and a leading portion of user data from the packets;

storing the extracted portions; and

providing the extracted portions to a packet usage application for a billing application.

22. A system for metering packets in a network comprising:

a) an in-kernel storage buffer having a configurable size;

b) a rule-based packet selection mechanism for intercepting network traffic that includes a plurality of packets, applying at least one rule to the intercepted packets, and selectively storing packets in the in-kernel storage buffer that meet the rule; and

c) a kernel space to user space data transfer mechanism for providing an interface for use by a packet usage application to retrieve the stored packets from the in-kernel storage buffer.

23. The system of claim 22 further comprising:

wherein the network has predetermined load requirements and the packet usage application has requirements;

d) an configuration parameter tuning utility for providing statistical information about the kernel;

wherein the statistical information can be employed by a user to adjust at least one configuration parameter to accommodate the load requirements of the network and accommodate the requirements of the packet usage application without packet loss.

24. The system of claim 23 wherein the statistical information is a peak buffer usage of the in-kernel storage buffer.

25. The system of claim 23 wherein the configuration parameter is one of a size of the in-kernel storage buffer and a size of the user-space storage buffer.

26. The system of claim 22 further including:

wherein the kernel space to user space data transfer mechanism provides an input/output driver interface for use by a packet usage application to read data from the in-kernel storage buffer.

27. The system of claim 22 further including:

an efficient transfer mechanism for reducing the number accesses to the in-kernel storage buffer.

28. The system of claim 27 wherein the efficient transfer mechanism retrieves a predetermined amount of data during each read operation performed on the in-kernel storage buffer space, fills a user-space storage buffer with the retrieved data, and an provides a packet at a time directly from the user-space storage buffer for subsequent read operations.