CONTINUED DEEP PACKET INSPECTION CLASSIFICATION AFTER ROAMING

• US 20160036664A1
• Filed: 07/30/2014
• Published: 02/04/2016
• Est. Priority Date: 07/30/2014
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Unnimadhavan, Sandeep, Vadivelu, Jagachittes, Madan, Amit
• Application Number:
  US14/446,819
• Publication Number:
  US 20160036664A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation

Abstract

A non-transitory computer readable medium when executed by one or more devices, causes performance of operations including forwarding, by a network device, a set of messages corresponding to a particular connection to a server, the set of messages being forwarded between a client device and a server via the network device, receiving, by the network device, a copy of a second set of messages corresponding to the particular connection that are transmitted between the client device and the server via without being transmitted through the network device, and analyzing, by the network device, both sets of messages to obtain a classification associated with the particular connection to the server.

Claims

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more devices, causes performance of operations comprising:

forwarding, by a first network device, a first set of messages corresponding to a particular connection to a server, the first set of messages being forwarded between a client device and a server via the first network device;

receiving, by the first network device, a copy of a second set of messages corresponding to the particular connection that are transmitted between the client device and the server via without being transmitted through the first network device; and

analyzing, by the first network device, both the first set of messages and the second set of messages to obtain a classification associated with the particular connection to the server.

2. The non-transitory computer readable medium of claim 1,

wherein the first network device is a first access point,

wherein the client device is associated with the first access point during the transmission of the first set of messages,

wherein the client device is associated with a second access point during the transmission of the second set of messages, and

wherein the copy of the second set of messages is received by the first access point from the second access point.

3. The non-transitory computer readable medium of claim 1,

wherein the first network device is a first controller controlling a first access point,

wherein the client device is associated with the first access point during the transmission of the first set of messages,

wherein the client device is associated with a second access point during the transmission of the second set of messages,

wherein the second access point is controlled by a second controller different than the first controller, and

wherein the copy of the second set of messages is received by the first controller from the second controller.

4. The non-transitory computer readable medium of claim 1,

wherein the first network device is a first switch connecting a first access point to the server,

wherein the client device is associated with the first access point during the transmission of the first set of messages,

wherein the client device is associated with a second access point during the transmission of the second set of messages,

wherein a second switch connects the second access point to the server, and

wherein the copy of the second set of messages is received by the first switch from the second switch.

5. The non-transitory computer readable medium of claim 1, wherein the classification associated with the particular connection indicates an application type associated with the particular connection to the server.

6. The non-transitory computer readable medium of claim 1, wherein at least a portion of the first set of messages and at least a portion of the second set of messages are needed for obtaining the classification for the particular connection.

7. The non-transitory computer readable medium of claim 1, wherein the operations further comprise:

obtaining, by a second network device, information identifying the first network device as a classifying device for classifying the particular connection to the server;

wherein the second set of messages are transmitted to the first network device by the second network device; and

subsequent to the client device switching an association with the second network device to the third network device;

transmitting, by the second network device to the third device, the information identifying the first network device as the classifying device for classifying the particular connection to the network.

8. The non-transitory computer readable medium of claim 1, wherein the particular connection to the server comprises:

at least one Open Systems Interconnection (OSI) layer 4 parameter;

a first Internet Protocol (IP) address for the client device; and

a second IP address for the server.

9. A non-transitory computer readable medium comprising instructions which, when executed by one or more devices, causes performance of operations comprising:

forwarding, by a first network device, a first set of messages corresponding to a particular connection to a server, the first set of messages being forwarded between a client device and a server via the first network device;

analyzing, by the first network device, the first set of messages to obtain a first classification information;

receiving, by the first network device, a second classification information for a second set of messages corresponding to the particular connection that are transmitted between the client device and the server via without being transmitted through the first network device; and

determining a classification for the particular connection to the server based on both the first classification information and the second classification information.

10. The non-transitory computer readable medium of claim 9, wherein the first set of messages is exchanged between the client device and the server prior to the second set of messages.

11. The non-transitory computer readable medium of claim 9,

wherein the first network device is a first access point,

wherein the client device is associated with the first access point during the transmission of the first set of messages,

wherein the client device is associated with a second access point during the transmission of the second set of messages, and

wherein the second classification information is received by the first access point from the second access point.

12. The non-transitory computer readable medium of claim 9,

wherein the first network device is a first controller controlling a first access point,

wherein the client device is associated with the first access point during the transmission of the first set of messages,

wherein the client device is associated with a second access point during the transmission of the second set of messages,

wherein the second access point is controlled by a second controller different than the first controller, and

wherein the second classification information is received by the first controller from the second controller.

13. The non-transitory computer readable medium of claim 9,

wherein the first network device is a first switch connecting a first access point to the server,

wherein the client device is associated with the first access point during the transmission of the first set of messages,

wherein the client device is associated with a second access point during the transmission of the second set of messages,

wherein a second switch connects the second access point to the server, and

wherein the second classification information is received by the first switch from the second switch.

14. The non-transitory computer readable medium of claim 9, wherein the classification associated with the particular connection indicates an application type associated with the particular connection to the server.

15. The non-transitory computer readable medium of claim 9, wherein at least a portion of the first set of messages and at least a portion of the second set of messages are needed for obtaining the classification for the particular connection.

16. The non-transitory computer readable medium of claim 9, wherein the operations further comprise:

obtaining, by a second network device, information identifying the first network device as a classifying device for classifying the particular connection to the server,

wherein the second set of messages are transmitted to the first network device by the second network device; and

subsequent to the client device switching an association with the second network device to the third network device;

transmitting, by the second network device to the third device, the information identifying the first network device as the classifying device for classifying the particular connection to the network.

17. The non-transitory computer readable medium of claim 9, wherein the particular connection to the server comprises:

at least one Open Systems Interconnection (OSI) layer 4 parameter;

a first Internet Protocol (IP) address for the client device; and

a second IP address for the server.

18. A non-transitory computer readable medium comprising instructions which, when executed by one or more devices, causes performance of operations comprising:

forwarding, by a first network device, a first set of messages corresponding to a particular connection to a server, the first set of messages being forwarded between a client device and a server via the first network device without being transmitted through a second network device or a third network device;

forwarding, by a second network device, a second set of messages corresponding to the particular connection to the server, the second set of messages being forwarded between the client device and the server without being transmitted through the first network device or the third network device;

receiving, by the third network device, a copy of the first set of messages from the first network device and a copy of the second set of messages from the second network device; and

analyzing, by the third network device, both the first set of messages and the second set of messages to obtain a classification associated with the particular connection to the server.

19. The non-transitory computer readable medium of claim 18,

wherein the first network device is a first access point,

wherein the client device is associated with the first access point during the transmission of the first set of messages,

wherein the client device is associated with a second access point during the transmission of the second set of messages,

wherein the copy of the first set of messages is received by the third network device from the first access point, and

wherein the copy of second set of messages is received by the third network device from the second access point.

20. The non-transitory computer readable medium of claim 18, wherein at least a portion of the first set of messages and at least a portion of the second set of messages are needed for obtaining the classification for the particular connection.