PERFORMANCE OPTIMIZED AND CONFIGURABLE STATE BASED HEURISTIC FOR THE CLASSIFICATION OF REAL-TIME TRANSPORT PROTOCOL TRAFFIC

• US 20120320767A1
• Filed: 06/20/2011
• Published: 12/20/2012
• Est. Priority Date: 06/20/2011
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: NetScout Systems Incorporated
• Inventors: Harrison, David Ronald
• Granted Patent: US 9,065,744 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/12 Network monitoring probes

Abstract

A probe receives a first packet over a network on a port. A sequence number and synchronization source identifier (SSRC) associated with the first packet are identified. The probe receives a subsequent packet and a sequence number and SSRC associated with the subsequent packet are determined. The probe determines whether the SSRC associated with first packet and the SSRC associated with the subsequent packet match. Additionally, the probe determines whether the sequence number associated with the subsequent packet is within an acceptable range of values related to the sequence number associated with the first packet. Additionally, the probe calculates the time interval between reception of the packets. The probe classifies traffic on the port as RTP or non-RTP traffic based on analysis of the SSRCs, sequence numbers and time intervals.

Claims

1. A method for classifying network traffic, the method comprising:

receiving a first packet of network traffic on a port;

determining a synchronization source identifier (SSRC) associated with the first packet and a first sequence number associated with the first packet;

receiving a subsequent packet of network traffic on the port;

determining a synchronization source identifier (SSRC) and a second sequence number associated with the subsequent packet;

determining whether the SSRC associated with the subsequent packet matches the SSRC associated with the first packet;

determining whether the second sequence number associated with the subsequent packet is within an acceptable range of sequence number values related to the first sequence number;

calculating an interval time between reception of the first packet and reception of the subsequent packet;

determining whether the interval time is within an acceptable range of time values; and

classifying traffic on the port based on whether the SSRC associated with the first packet matches the SSRC associated with the subsequent packet, the second sequence number associated with the subsequent packet is within the acceptable range of sequence number values, and the interval time is within the acceptable range of time values.

2. The method of claim 1, wherein classifying traffic on the port comprises classifying traffic as Real-Time Transport Protocol (RTP) traffic or non-RTP traffic.

3. The method of claim 1, wherein the acceptable range of sequence number values is user configurable.

4. The method of claim 3, wherein the acceptable range of time values is user configurable.

5. The method of claim 1, further comprising:

determining a directionality of the first packet and a plurality of subsequent packets; and

verifying that the directionality of the first packet matches the directionality of the plurality of subsequent packets.

6. The method of claim 1, further comprising:

determining whether the subsequent packet exceeds a maximum number of packets to be analyzed.

7. The method of claim 1, further comprising:

determining a payload type of the subsequent packet; and

determining whether a payload length of the subsequent packet is within an acceptable range of payload length values associated with the payload type.

8. A computer program product for classifying network traffic, the computer program product comprising a non-transitory computer-readable storage medium storing instructions that when executed cause at least one processor to:

receive a first packet of network traffic on a port;

determine a synchronization source identifier (SSRC) associated with the first packet and a first sequence number associated with the first packet;

receive a subsequent packet of network traffic on the port;

determine a synchronization source identifier (SSRC) and a second sequence number associated with the subsequent packet;

determine whether the SSRC associated with the subsequent packet matches the SSRC associated with the first packet;

determine whether the second sequence number associated with the subsequent packet is within an acceptable range of sequence number values related to the first sequence number;

calculate an interval time between reception of the first packet and reception of the subsequent packet;

determine whether the interval time is within an acceptable range of time values; and

classify traffic on the port based on whether the SSRC associated with the first packet matches the SSRC associated with the subsequent packet, the second sequence number associated with the subsequent packet is within the acceptable range of sequence number values, and the interval time is within the acceptable range of time values.

9. The computer program product of claim 8, wherein classifying traffic on the port comprises classifying traffic as Real-Time Transport Protocol (RTP) traffic or non-RTP traffic.

10. The computer program product of claim 8, wherein the acceptable range of sequence number values is user configurable.

11. The computer program product of claim 10, wherein a range of ports is automatically classified based on a configured preference.

12. The computer program product of claim 8, further comprising:

determine a directionality of the first packet and a plurality of subsequent packets; and

verify that the directionality of the first packet matches the directionality of the plurality of subsequent packets.

13. The computer program product of claim 8, further comprising:

determine whether the subsequent packet exceeds a maximum number of packets to be analyzed.

14. The computer program product of claim 8, further comprising:

determine a payload type of the subsequent packet; and

determine whether a payload length of the subsequent packet is within an acceptable range of payload length values associated with the payload type.

15. A system for classifying network traffic, comprising:

a computer-readable storage medium storing executable computer program instructions comprising instructions for;

receiving a first packet of network traffic on a port;

determining a synchronization source identifier (SSRC) associated with the first packet and a first sequence number associated with the first packet;

receiving a subsequent packet of network traffic on the port;

determining a synchronization source identifier (SSRC) and a second sequence number associated with the subsequent packet;

determining whether the SSRC associated with the subsequent packet matches the SSRC associated with the first packet;

determining whether the second sequence number associated with the subsequent packet is within an acceptable range of sequence number values related to the first sequence number;

calculating an interval time between reception of the first packet and reception of the subsequent packet;

determining whether the interval time is within an acceptable range of time values; and

classifying traffic on the port based on whether the SSRC associated with the first packet matches the SSRC associated with the subsequent packet, the second sequence number associated with the subsequent packet is within the acceptable range of sequence number values, and the interval time is within the acceptable range of time values; and

a processor for executing the computer program instructions.

16. The system of claim 15, wherein classifying traffic on the port comprises classifying traffic as Real-Time Transport Protocol (RTP) traffic or non-RTP traffic.

17. The system of claim 15, wherein the acceptable range of sequence number values is user configurable.

18. The system of claim 17, wherein the acceptable range of time values is user configurable.

19. The system of claim 15, further comprising instructions for:

determining a directionality of the first packet and a plurality of subsequent packets; and

verifying that the directionality of the first packet matches the directionality of the plurality of subsequent packets.

20. The system of claim 15, further comprising instructions for:

determining whether the subsequent packet exceeds a maximum number of packets to be analyzed.