Rate limiting of events

• US 20060036720A1
• Filed: 06/14/2004
• Published: 02/16/2006
• Est. Priority Date: 06/14/2004
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Faulk, Robert L. Jr.
• Application Number:
  US10/868,093
• Publication Number:
  US 20060036720A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0622 based on time
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

In an embodiment, a method for rate limiting of events includes: monitoring and processing an event instance of an event type; and if a value of the event instance to be monitored meets or exceeds an associated suspension threshold value, then performing a user-defined action for the event instance. The method may also comprise resuming the suspended event instance. The suspended event instance may be resumed, for example, after a suspension time value has elapsed. Additionally or alternatively, the suspended event instance may be resumed, for example, after a value of the event instance falls below the resumption threshold value. In another embodiment, an apparatus for rate limiting of events includes: a rate limiter configured to monitor and process an event instance of an event type, and perform a user-defined action for the event instance, if a value of the event instance to be monitored exceeds an associated suspension threshold value.

Claims

1. A method for rate limiting of events, the method comprising:

monitoring and processing an event instance of an event type; and

if a value of the event instance to be monitored meets or exceeds an associated suspension threshold value, then performing a user-defined action for the event instance.

2. The method of claim 1, wherein a value of the event instance to be monitored is a count of the event instance in an interval time period.

3. The method of claim 1, wherein the act of performing the user-defined action comprises suspending the event instance.

4. The method of claim 1, wherein the event instance is suspended for a suspension time length.

5. The method of claim 1, further comprising:

resuming the suspended event instance.

6. The method of claim 5, wherein the act of resuming comprises:

resuming the suspended event instance after a suspension time length has elapsed.

7. The method of claim 5, wherein the act of resuming comprises:

resuming the suspended event instance after a value of the event instance falls below the resumption threshold value.

8. The method of claim 5, wherein the act of resuming comprises:

resuming the suspended event instance after a value of the event instance falls below the suspension threshold value.

9. The method of claim 1, further comprising:

logging a suspension of the event instance.

10. The method of claim 1, further comprising:

logging a resumption of the suspended event instance.

11. The method of claim 1, further comprising;

deleting an identifier, eventKey, associated with the event instance, if the event instance does not occur within a maximum age time value.

12. The method of claim 1, wherein the event type is associated with a Domain Name Service (DNS) lookup request.

13. The method of claim 12, wherein the event instance is a DNS look request packet for a particular host name.

14. The method of claim 1, wherein the event type is a broadcast packet.

15. The method of claim 14, wherein the event instance is a broadcast packet from a particular port.

16. The method of claim 1, wherein the event type is a Simple Network Management Protocol (SNMP) packet.

17. The method of claim 16, wherein the event instance is an SNMP packet from a particular host.

18. The method of claim 1, wherein the act of monitoring comprises counting a number of observed event instances and performing a hash operation on an identifier, eventId, of the event type and an identifier, eventKey, of the event instance.

19. The method of claim 1, wherein the event type is associated with an event identifier (eventId).

20. The method of claim 1, wherein the event instances is associated with an event key identifier (eventKey).

21. The method of claim 1, further comprising:

deleting a data structure associated with the event instance if the event instance is not observed within a maximum age time value.

22. An apparatus for rate limiting of events, the apparatus comprising:

a rate limiter configured to monitor and process an event instance of an event type, and perform a user-defined action for the event type, if a value of the event instance to be monitored meets or exceeds an associated suspension threshold value.

23. The apparatus of claim 22, wherein a value of the event instance to be monitored is a count of the event instance in an interval time period.

24. The apparatus of claim 22, wherein the rate limiter is configured to perform the user-defined action by suspending the event instance.

25. The apparatus of claim 22, wherein the event instance is suspended for a suspension time length.

26. The apparatus of claim 22, wherein the rate limiter is configured to resume the suspended event instance.

27. The apparatus of claim 26, wherein the rate limiter is configured to resume act the suspended event instance after a suspension time length has elapsed.

28. The apparatus of claim 26, wherein the rate limiter is configured to resume the suspended event instance after a value of the event instance falls below the resumption threshold value.

29. The apparatus of claim 26, wherein the rate limiter is configured to resume the suspended event instance after a value of the event instance falls below the suspension threshold value.

30. The apparatus of claim 22, wherein the rate limiter is configured to log a suspension of the event instance.

31. The apparatus of claim 22, wherein the rate limiter is configured to log a resumption of the suspended event instance.

32. The apparatus of claim 22, wherein the rate limiter is configured to delete an identifier, eventKey, associated with the event instance, if the event instance does not occur within a maximum age time value.

33. The apparatus of claim 22, wherein the event type is associated with a Domain Name Service (DNS) lookup request.

34. The apparatus of claim 33, wherein the event instance is a DNS look request packet for a particular host name.

35. The apparatus of claim 22, wherein the event type is a broadcast packet.

36. The apparatus of claim 35, wherein the event instance is a broadcast packet from a particular port.

37. The apparatus of claim 22, wherein the event type is a Simple Network Management Protocol (SNMP) packet.

38. The apparatus of claim 37, wherein the event instance is an SNMP packet from a particular host.

39. The apparatus of claim 22, wherein the rate limiter is configured to count a number of observed event instances and perform a hash operation on an identifier, eventId, of the event type and an identifier, eventKey, of the event instance.

40. The apparatus of claim 22, wherein the event type is associated with an event identifier (eventId).

41. The apparatus of claim 22, wherein the event instance is associated with an event key identifier (eventKey).

42. The apparatus of claim 22, wherein the rate limiter is configured to delete a data structure associated with the event instance if the event instance is not observed with a maximum age time value.

43. An article of manufacture, comprising:

a machine-readable medium having stored thereon instructions to;

monitor and process an event instance of an event type; and

perform a user-defined action for the event instance, If a value of the event instance to be monitored exceeds an associated suspension threshold value.

44. An apparatus for rate limiting of events, the apparatus comprising:

means for monitoring and processing an event instance of an event type; and

means for performing a user-defined action for the event instance, if a value of the event instance to be monitored meets or exceeds an associated suspension threshold value.