Content aware network apparatus

• US 6,654,373 B1
• Filed: 06/12/2000
• Issued: 11/25/2003
• Est. Priority Date: 06/12/2000
• Status: Active Grant

• Current Assignee: AudioCodes, Inc. (Audiocodes Limited)
• Original Assignee: Netrake Corp. (Audiocodes Limited)
• Inventors: Maher, III, Robert Daniel, Bennett, Victor A., Rana, Aswinkumar Vishanji, Lie, Milton Andre, Brandon, Kevin William, Hervin, Mark Warden, Garrow, Corey Alan
• Primary Examiner(s): Pezzlo, John
• Application Number:
  US09/591,728
• Time in Patent Office: 1,261 Days
• Field of Search: 370/395, 370/394, 370/395.71, 370/516, 370/230.1, 370/400, 370/338, 370/392, 370/418, 370/258, 370/389, 370/412, 370/417, 370/429, 709/236, 709/240, 709/239
• US Class Current: 370/392
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols

Abstract

A content aware network device is described that is able to scan the contents of entire data packets including header and payload information. The network device includes a physical interface for converting analog network signal into bit streams and vise versa. The bit stream from the physical interface is sent to a traffic flow scanning processor that may be, but is not necessarily, divided into a header processor and a payload analyzer. The header processor scans the header information from each data packet, which is used to determine routing information and session identification. The payload analyzer scans the data packet'"'"'s payload and matches the payload against a database of known strings. The payload analyzer is able to scan across packet boundaries and to scan for strings of variable and arbitrary length. Once the payload has been scanned the network device can operate on the data packet based on the results of the payload analyzer. The scanned data packets and the associated conclusions are then passed to a quality of service processor which modifies the data packets if necessary and performs traffic management and traffic shaping on the flow of data packets based on contents of the data packets.

Claims

1. A network apparatus connected to a data network passing data packets of a plurality of types and having a plurality of destinations and sources, each data packet consisting of a header and a payload, the network apparatus comprising:

a header processor receiving the data packets from the data network and operable to scan the header to determine the type of the data packet, the source of the data packet, and the destination of the data packets and to classify the data packets based on attributes of the data packets;

a payload analyzer connected to the header processor and operable to scan the payload of each data packet, wherein the payload analyzer can further classify the data packet according to the contents of the payload; and

a quality of service processor connected to the payload analyzer and operable to process each data packet based on its classification.

2. The network apparatus of claim 1 further comprising a physical interface operable to convert an input analog signal from a network transmission line into a bit stream comprising the data packets from the data network, and further operable to convert a bit stream from the quality of service processor to an output analog signal capable of transmission on the data network.

3. The network apparatus of claim 1 further comprising a flow management processor and a microprocessor operable to manage the header processor, the payload analyzer and the quality of service processor.

4. The network apparatus of claim 3 wherein the flow management processor and the microprocessor are further operable to collect network traffic flow metrics and statistics and to report back to a network manager.

5. The network apparatus of claim 1 wherein the network apparatus is operable to generate a unique session id for each individual traffic flow based on a source address, a destination address, a source port, a destination port and a protocol.

6. The network apparatus of claim 5 wherein the network apparatus is able to learn and maintain a state for each of the individual traffic flows.

7. The network apparatus of claim 5 wherein the payload analyzer includes a queue engine, a context engine and a payload scanning engine, the queue engine operable to reorder and reassemble the data packets, the context engine operable to manage data packets associated with a plurality of session ids and to schedule the operation of the payload scanning engine, and the payload scanning engine operable to compare the payload of the data packet with a database of known strings.

8. The network apparatus of claim 1 wherein the quality of service processor includes a plurality of quality of service queues, the quality of service processor operable to assign the data packets to one of the plurality of quality of service queues based on the classifications from the header processor and the payload analyzer, the quality of service queue determining the priority of the data packet on the data network.

9. The network apparatus of claim 1 wherein the attributes of the data packets are the type, the destination and the source of the data packets.

10. A network device as part of a data network, the data network including a stream of data packets of a plurality of protocols and a plurality of destinations and sources, each data packet containing header information and payload information, the network device comprising:

a traffic flow scanning processor operable to scan the header information and the payload information of each data packet, the traffic flow scanning processor including at least one reassembly and reordering engine which ensures that the data packets are properly assembled and ordered, and further includes at least one scanning engine which scans the data packet, matches information in the data packet with a database of known signatures, and produces an associated conclusion based on the matching of information in the data packet; and

a quality of service processor connected to the traffic flow scanning processor and receiving the data packets and the associated conclusion, the quality of service processor operable to interpret the conclusion and to place the data packet onto one of a plurality of quality of service queues contained within the quality of service processor, the quality of service queue determined by the associated conclusion, wherein the data packet in then transmitted from the quality of service queue to the data network.

11. The network device of claim 10 further comprising a physical interface connected to the traffic flow scanning processor and the quality of service processor, the physical interface including input ports that receive an input analog signal from the data network and converts the input analog signal into an input bit stream containing the data packets and output ports for receiving an output bit stream and converting the output bit stream into an output analog signal sent out onto the data network.

12. The network device of claim 10 wherein the traffic flow scanning processor associates each data packet with a session id, the session id representing an individual traffic flow within the data network.

13. The network device of claim 12 wherein the session id is determined from a source address, a destination address, a source port, a destination port, and a protocol.

14. The network device of claim 12 wherein the network device is able to learn and maintain state for each of the individual traffic flows.

15. The network device of claim 10 wherein the traffic flow scanning processor is divided into a header processor and a payload analyzer.

16. The network device of claim 15 wherein the payload analyzer includes a queue engine, a context engine, and a payload scanning engine.

17. The network device of claim 16 wherein the context engine operable to manage data packets associated with a plurality of session ids and to schedule the operation of the payload scanning engine, and the payload scanning engine operable to compare the payload of the data packet with a database of known strings.

18. The network apparatus of claim 10 wherein the quality of service queue determines the priority of the data packet on the data network.

19. The network apparatus of claim 10 further comprising a flow management processor and a microprocessor operable to control the traffic flow scanning processor and to collect network traffic flow metrics and statistics and to report back to a network manager.

20. The network apparatus of claim 10 wherein the associated conclusion is an instruction executable by the network device.

21. A network device as part of a data network, the data network including a stream of data packets of a plurality of protocols and a plurality of destinations and sources, each data packet containing header information and payload information, the network device comprising:

a physical interface which includes input ports that receive an input analog signal from the data network and converts the input analog signal into an input bit stream containing the data packets and output ports for receiving an output bit stream and converting the output bit stream into an output analog signal sent out onto the data network;

a plurality of route engines each route engine further comprising;

a traffic flow scanning processor connected to the physical interface to receive the input bit stream, the traffic flow scanning processor operable to scan the header information and the payload information of each data packet, the traffic flow scanning processor including at least one reassembly and reordering engine which ensures that the data packets are properly assembled and ordered, and further includes at least one scanning engine which scans the data packet, matches information in the data packet with a database of known signatures, and produces an associated conclusion based on the matching of information in the data packet;

at least one quality of service processor connected to the traffic flow scanning processor and receiving the data packets and the associated conclusion, the at least one quality of service processor operable to interpret the conclusion and to place the data packet onto one of a plurality of quality of service queues contained within the at least one quality of service processor, the quality of service queue being determined by the associated conclusion, wherein the data packet in then transmitted from the quality of service queue to a switch fabric interface; and

a switch fabric connected between the at least one quality of service processors for at least two or more route engines, such that data packets are sent from one of the at least one quality of service processor associated with an input port for the data packet to the at least one quality of service processor associated with an appropriate output port for the data packet, such that the network device is operable as a network router.

22. The network device of claim 21 wherein the traffic flow scanning processor associates each data packet with a session id, the session id representing an individual traffic flow within the data network.

23. The network device of claim 22 wherein the session id is determined from a source address, a destination address, a source port, a destination port, and a protocol.

24. The network device of claim 22 wherein the network device is able to learn and maintain state for each of the individual traffic flows.

25. The network device of claim 21 wherein the traffic flow scanning processor is divided into a header processor and a payload analyzer.

26. The network device of claim 25 wherein the payload analyzer includes a queue engine, a context engine, and a payload scanning engine.

27. The network device of claim 26 wherein the context engine operable to manage data packets associated with a plurality of session ids and to schedule the operation of the payload scanning engine, and the payload scanning engine operable to compare the payload of the data packet with a database of known strings.

28. The network apparatus of claim 21 wherein the quality of service queue determines the priority of the data packet on the data network.

29. The network apparatus of claim 22 wherein the flow management processor and the microprocessor are further operable to collect network traffic flow metrics and statistics and to report back to a network manager.

30. The network apparatus of claim 21 wherein the associated conclusion is an instruction executable by the network device.