Intelligent collection and management of flow statistics

• US 20090086651A1
• Filed: 10/02/2007
• Published: 04/02/2009
• Est. Priority Date: 10/02/2007
• Status: Active Grant

• Current Assignee: Tellabs Communications Canada Ltd. (Infinera Corp.)
• Original Assignee: Tellabs Communications Canada Ltd. (Infinera Corp.)
• Inventors: Luft, Siegfried J., Back, Jonathan
• Granted Patent: US 8,374,102 B2
• Time in Patent Office: Days
• US Class Current: 370/253
• CPC Class Codes: H04L 41/5067 Customer-centric QoS measurements
• CPC Class Codes: H04L 43/026 using flow identification

Abstract

A system and method for collecting packet flow statistics within a network node includes forwarding packet flows received at the network node between subscribers of one or more network services and one or more providers of the network services. The flow statistics related to each of the packet flows passing through the network node are collected and statistics summaries are generated in real-time within the network node summarizing the flow statistics on a per subscriber basis.

Claims

1. A method, comprising:

forwarding packet flows received at a network node between subscribers of one or more network services and one or more providers of the network services;

collecting flow statistics related to each of the packet flows passing through the network node; and

generating statistics summaries in real-time within the network node summarizing the flow statistics on a per subscriber basis.

2. The method of claim 1, wherein collecting flow statistics related to each of the packet flows passing through the network node comprises:

collecting the flow statistics within a data plane of the network node to generate flow statistics updates;

periodically providing the flow statistics updates to one or more statistics engines executing in a control plane of the network node; and

updating the statistics summaries with the flow statistics updates received from the data plane.

3. The method of claim 2, further comprising:

periodically providing the flow statistics updates to a plurality of statistics engines executing in the control plane, wherein each of the statistics engines is assigned to track the flow statistics associated with a subset of the subscribers.

4. The method of claim 3, wherein the control plane comprises a plurality of compute node instances each executing one of the plurality of statistics engines and wherein the data plane comprises a plurality of traffic blades each performing traffic forwarding of the packet flows and executing a statistics collector to collect the flow statistics within the data plane.

5. The method of claim 2, further comprising periodically reporting the statistics summaries to an external management server (“

EMS”

).

6. The method of claim 5, further comprising merging the statistics summaries reported to the EMS into a multi-subscriber summary summarizing the flow statistics related to a plurality of subscribers.

7. The method of claim 5, wherein each of the statistics summaries comprises a table for tracking flow attributes for a corresponding one of the subscribers, the method further comprising:

incrementing an attribute count associated with one of the flow attributes in response to a determination that the one of the flow attributes was present in one of the packet flows of the corresponding one of the subscribers.

8. The method of claim 7, further comprising:

monitoring the attribute count in real-time; and

issuing a threshold crossing alert (“

TCA”

) if the attribute count exceeds a threshold value.

9. The method of claim 8, further comprising resetting the attribute count upon reporting one of the statistics summaries corresponding to the one of the subscribers to the EMS.

10. The method of claim 8, further comprising:

updating an access control list of the network node in real-time in response to the TCA; and

denying access to the network node in response to the updating of the access control list.

11. The method of claim 7, wherein the flow attributes for the corresponding one of the subscribers include at least one of:

number of flows, number of packets, number of bytes, number of short-term flows, number of long-term flows, number of inbound flows, number of outbound flows, number of dropped packets, number of flows with a specified differentiated service, or number of flows with faults.

12. The method of claim 11, wherein the flow attributes for the corresponding one of the subscribers are tracked on a per category basis, wherein categories include one or more of file transfer protocol (“

FTP”

) flows, hypertext transfer protocol (“

HTTP”

) flows, simple object access protocol (“

SOAP”

) flows, voice over Internet protocol (“

VoIP”

) flows, video-on-demand (“

VoD”

) flows, or simple mail transfer protocol (“

SMTP”

) flows.

13. The method of claim 1, further comprising:

providing a context based tracking rule for tracking specified flow attributes within the packet flows; and

associating two or more of the subscribers with the context based tracking rule to monitor the specified flow attributes for each of the two or more subscribers associated with the context based tracking rule.

14. Machine-accessible media that provides instructions that, if executed by a machine, will cause the machine to perform operations comprising:

forwarding packet flows received at a network node between subscribers of one or more network services and one or more providers of the network services;

collecting flow statistics related to each of the packet flows passing through the network node; and

generating statistics summaries in real-time within the network node summarizing the flow statistics on a per subscriber basis.

15. The machine-accessible media of claim 14, wherein collecting flow statistics related to each of the packet flows passing through the network node comprises:

collecting the flow statistics within a data plane of the network node to generate flow statistics updates;

periodically providing the flow statistics updates to one or more statistics engines executing in a control plane of the network node; and

updating the statistics summaries with the flow statistics updates received from the data plane.

16. The machine-accessible media of claim 15, further providing instructions that, if executed by the machine, will cause the machine to perform further operations, comprising:

periodically providing the flow statistics updates to a plurality of statistics engines executing in the control plane, wherein each of the statistics engines is assigned to track the flow statistics associated with a subset of the subscribers.

17. The machine-accessible media of claim 16, wherein the control plane comprises a plurality of compute node instances each executing one of the plurality of statistics engines and wherein the data plane comprises a plurality of traffic blades each performing traffic forwarding of the packet flows and executing a statistics collector to collect the flow statistics within the data plane.

18. The machine-accessible media of claim 15, further providing instructions that, if executed by the machine, will cause the machine to perform further operations, comprising:

periodically reporting the statistics summaries to an external management server (“

EMS”

).

19. The machine-accessible media of claim 18, wherein each of the statistics summaries comprises a table for tracking flow attributes for a corresponding one of the subscribers, the machine-accessible media further providing instructions that, if executed by the machine, will cause the machine to perform further operations, comprising:

incrementing an attribute count associated with one of the flow attributes in response to a determination that the one of the flow attributes was present in one of the packet flows of the corresponding one of the subscribers.

20. The machine-accessible media of claim 19, further providing instructions that, if executed by the machine, will cause the machine to perform further operations, comprising:

monitoring the attribute count in real-time; and

issuing a threshold crossing alert (“

TCA”

) if the attribute count exceeds a threshold value.

21. The machine-accessible media of claim 20, further providing instructions that, if executed by the machine, will cause the machine to perform further operations, comprising:

resetting the attribute count upon reporting one of the statistics summaries corresponding to the one of the subscribers to the EMS.

22. The machine-accessible media of claim 20, further providing instructions that, if executed by the machine, will cause the machine to perform further operations, comprising:

updating an access control list of the network node in real-time in response to the TCA; and

denying access to the network node in response to the updating of the access control list.

23. The machine-accessible media of claim 14, further providing instructions that, if executed by the machine, will cause the machine to perform further operations, comprising:

providing a context based tracking rule for tracking specified flow attributes within the packet flows; and

associating two or more of the subscribers with the context based tracking rule to monitor the specified flow attributes for each of the two or more subscribers associated with the context based tracking rule.

24. A system for coupling between a plurality of subscribers of network services and providers of the network services, the system comprising a plurality of processors and computer readable media, the computer readable media containing a distributed data structure for execution by the plurality of processors, the distributed data structure comprising:

a plurality of statistics collectors for collecting flow statistics related to packet flows passing through the system; and

a plurality of statistics engines for generating statistics summaries in real-time summarizing the flow statistics on a per subscriber basis, wherein each of the statistics engines is responsible for generating the statistics summaries for a subset of the plurality of subscribers.

25. The system of claim 24, further comprising:

a plurality of traffic blades each including one or more of the processors, the traffic blades for performing packet forwarding on the packet flows and for executing the statistics collectors;

a plurality of compute blades each including one or more of the processors, the compute blades for executing the statistics engines; and

a mesh interconnect communicatively interconnecting the traffic blades and the compute blades.

26. The system of claim 25, wherein the statistics collectors collect the flow statistics to generate flow statistics updates, periodically provide the flow statistics updates to the statistics engines, and the statistics engines update the statistics summaries with the flow statistics updates, wherein the flow statistics updates collected from outbound packet flows from a single subscriber are all provide to a single one of the statistics engines.

27. The system of claim 24, wherein the statistics engines are further configured to periodically report the statistics summaries to an external management server.

28. The system of claim 24, wherein the statistics engines are configured to generate each of the statistics summaries as a table for tracking flow attributes for a corresponding one of the subscribers and to increment an attribute count associated with one of the flow attributes in response to a determination that the one of the flow attributes was present in one of the packet flows of the corresponding one of the subscribers.

29. The system of claim 28, wherein the distributed data structure further comprises a plurality of threshold crossing alert (“

TCA”

) agents for monitoring attribute value counts associated with flow attributes of the packet flows, wherein the attribute value counts are accumulated within the statistics summaries, the TCA agents further configured for issuing TCAs in real-time if one or more attribute value counts exceed threshold values set for the one or more flow attributes.

30. The system of claim 28, further comprising an access control list (“

ACL”

) for determining whether the packet flows are permitted access to the system, the TCA agent configured to install access rules into the ACL in response to one of the TCAs.