System and method for storing and/or transmitting emulated network flows

• US 20070226483A1
• Filed: 03/24/2006
• Published: 09/27/2007
• Est. Priority Date: 03/24/2006
• Status: Abandoned Application

• Current Assignee: Brent Cook, Craig Cantrell, Dennis Cox, H.D. Moore, William Brewer
• Original Assignee: Breakingpoint Systems Incorporated (Keysight Technologies, Inc.)
• Inventors: Cox, Dennis, Cantrell, Craig, Brewer, William, Cook, Brent, Moore, H.D.
• Application Number:
  US11/388,805
• Publication Number:
  US 20070226483A1
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 67/5651 Reducing the amount or size of exchanged application data
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method of encoding network packets for storage and later transmitting emulated packets includes determining a protocol for the packet and validating the protocol as belonging to a list of recognized protocols. Upon validating the packet, a protocol attribute value from the packet is parsed and a dictionary is referenced using the protocol attribute value to obtain a binary encoding, which is stored as an encoded packet. The packet, for example, may be an HTTP protocol request packet and parsing may include parsing a TYPE attribute value where the TYPE attribute value indicates whether the packet is a GET, POST, PUT or OTHER type of HTTP request. The method may further include modifying environmental data in the packet when the packet is later generated for transmission on a network. The method may further include, for packets of unrecognized protocols, learning and creating an encoding for new protocols.

Claims

1. A method of encoding a network packet, comprising:

determining a protocol for the packet and validating the protocol as belonging to a list of recognized protocols;

responsive to validating the packet, parsing a protocol attribute value from the packet;

referencing a dictionary using the protocol attribute value to obtain a binary encoding; and

storing the binary encoding in storage as an encoded packet.

2. The method of claim 1, wherein the packet is an HTTP protocol request packet and wherein the list of recognized protocols includes HTTP and wherein parsing a protocol attribute value from the packet includes parsing a TYPE attribute value from the packet and wherein the TYPE attribute value is indicative of whether the packet is a GET, POST, PUT or OTHER type of HTTP request.

3. The method of claim 2, wherein referencing a dictionary comprises referencing a TYPE dictionary, wherein the TYPE dictionary defines a set of bits indicative of the type of HTTP request.

4. The method of claim 2, wherein the TYPE attribute value is further indicative of an HTTP protocol version associated with the packet and wherein the TYPE dictionary defines a set of bits indicative of the HTTP protocol version.

5. The method of claim 4, wherein the TYPE attribute value is further indicative of whether the packet includes a target URL and wherein the TYPE dictionary defines a bit indicative of whether the packet includes a target URL.

6. The method of claim 2, wherein parsing a protocol attribute value from the packet further includes parsing a HOST attribute value from the packet, wherein the HOST attribute value is indicative of a host URL associated with the packet.

7. The method of claim 6, wherein referencing a dictionary includes referencing a HOST dictionary, wherein the HOST dictionary defines a set of bits indicative of a host URL associated with the packet.

8. The method of claim 7, wherein the HOST dictionary defines a first set of bits indicative of the prefix of the host URL and a second set of bits indicative of a suffix of the host URL.

9. The method of claim 6, wherein parsing a protocol value further comprises parsing a USER/AGENT attribute value from the packet and wherein referencing a dictionary comprises referencing a USER/AGENT dictionary indicative of a client application associated with the packet.

10. The method of claim 9, wherein the USER/AGENT dictionary includes a set of bits indicative of the client application.

11. The method of claim 9, wherein the encoding includes a set of bits indicative of the type of request packet, a set of bits indicative of the host URL, and a set of bits indicative of the client application.

12. The method of claim 1, further comprising associating a first binary encoding associated with a first packet with a second binary encoding associated with a second packet, the second packet being related to the first packet.

13. The method of claim 12, wherein the second packet and the first packet are associated with a common initial request packet.

14. The method of claim 13, further comprising merging the first binary encoding with the second binary encoding to generate a third binary encoding, wherein the third binary encoding represents a cumulative effect of the first and second binary encoding.

15. The method of claim 13, wherein the second binary encoding is a change encoding indicative only of attribute values in the second packet that differ from corresponding packet values in the first packet.

16. The method of claim 1, further comprising:

retrieving the encoded packet from storage and referencing the dictionary using the encoding to obtain a protocol attribute value; and

generating an emulated packet suitable for transmission from the encoded packet based at least in part on the protocol attribute value.

17. The method of claim 16, wherein generating the emulated packet includes replacing captured environmental data in the encoded packet with contemporary environmental data to reflect a time and a network environment in which the emulated packet is to be transmitted.

18. The method of claim 17, wherein the environmental data is selected from the group consisting of, network address translation (NAT) information, checksum information, and time to live (TTL) information.

19. The method of claim 16, further comprising, including in the encoded packet information indicative of a pacing of the packet relative to other packets.

20. The method of claim 19, wherein the pacing indicative information is selected from the group consisting of number of packets transmitted between two packets, the number of bytes transmitted between two packets, and the number of times a network interface card clock cycle counter increments.

21. The method of claim 19, further comprising retrieving and using the pacing indicative information to preserve the recorded pacing when transmitting the emulated packet.

22. The method of claim 1, further comprising responsive to not validating the packet, recording the packet as an unrecognized packet and determining whether a sufficient sample of unrecognized packets have been recorded.

23. The method of claim 19, further comprising, responsive to determining that a sufficient sample of unrecognized packets have been recorded, creating a new encoding for the unrecognized packets by identifying patterns in the bits of the unrecognized packets.

24. A computer instruction product comprising computer executable instructions, stored on a computer readable medium for encoding a network packet, the instructions comprising:

instructions for determining a protocol for the packet and validating the protocol as belonging to a list of recognized protocols;

responsive to validating the packet, instructions for parsing a protocol attribute value from the packet;

instructions for referencing a dictionary using the protocol attribute value to obtain a binary encoding; and

instructions for storing the binary encoding in storage as an encoded packet.

25. The computer program product of claim 1, further comprising:

instructions for retrieving the encoded packet from storage and referencing the dictionary using the encoding to obtain a protocol attribute value; and

instructions for generating an emulated packet suitable for transmission from the encoded packet based at least in part on the protocol attribute value.

26. The computer program product of claim 25, wherein the instructions for generating the emulated packet include instructions for replacing captured environmental data in the encoded packet with contemporary environmental data to reflect a time and a network environment in which the emulated packet is to be transmitted.

27. The computer program product of claim 26, wherein the environmental data is selected from the group consisting of, network address translation (NAT) information, checksum information, and time to live (TTL) information.

28. The computer program product of claim 25, further comprising, instructions for including in the encoded packet information indicative of a pacing of the packet relative to other packets.

29. The computer program product of claim 28, wherein the pacing indicative information is selected from the group consisting of number of packets transmitted between two packets, the number of bytes transmitted between two packets, and the number of times a network interface card clock cycle counter increments.

30. The computer program product of claim 28, further comprising instructions for retrieving and using the pacing indicative information to preserve the recorded pacing when transmitting the emulated packet.

31. The computer program product of claim 24, further comprising, responsive to not validating the packet, instructions for recording the packet as an unrecognized packet and determining whether a sufficient sample of unrecognized packets have been recorded.

32. The computer program product of claim 31, further comprising, responsive to determining that a sufficient sample of unrecognized packets have been recorded, instructions for creating a new encoding for the unrecognized packets by identifying patterns in the bits of the unrecognized packets.

33. A data processing system including a processor, a computer readable storage medium accessible to the processor, and software stored on the computer readable storage medium, the software comprising computer executable instructions including:

instructions for determining a protocol for the packet and validating the protocol as belonging to a list of recognized protocols;

responsive to validating the packet, instructions for parsing a protocol attribute value from the packet;

instructions for referencing a dictionary using the protocol attribute value to obtain a binary encoding; and

instructions for storing the binary encoding in storage as an encoded packet.