Rate-controlled transmission of traffic flow information

• US 7,185,103 B1
• Filed: 09/10/2002
• Issued: 02/27/2007
• Est. Priority Date: 09/10/2002
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Jain, Sandeep
• Primary Examiner(s): Eng; David Y.
• Application Number:
  US10/241,785
• Time in Patent Office: 1,631 Days
• Field of Search: 709/223, 709/234, 709/238, 709/233, 710/29, 710/33, 710/52
• US Class Current: 709/234
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

Network analysis techniques are described for generating and outputting traffic flow packets which include traffic flow information indicative of network traffic flows. More specifically, the traffic flow packets may be generated and output in a rate-controlled fashion, which can avoid data loss of traffic flow information in the traffic flow packets. For example, rate-controlled transmission can be extremely useful in ensuring that transmitted traffic flow packets will be received by a packet flow collector without overloading input buffers of the packet flow collector.

Claims

1. A method comprising:

receiving packets from a network;

associating the packets with a packet flow based on data within the packets;

aggregating first traffic flow statistics for the packet flow by generating and storing the first traffic flow statistics in a first data structure;

outputting the first traffic flow statistics stored in the first data structure to a packet flow collector for analysis of the network;

while outputting the first traffic flow statistics;

(i) receiving additional packets from the network;

(ii) associating the additional packets with the same packet flow based on data within the additional packets;

(iii) aggregating second traffic flow statistics for the packet flow based on the additional packets by generating and storing the second traffic flow statistics in a second data suture over an allotted amount of time; and

(iv) controlling a rate of output of the first traffic flow statistics from the first data structure based on the allotted amount of time for the aggregation of the second traffic flow statistics in a second data structure such that the first traffic flow statistics are output substantially over a full amount of the time allotted for aggregation of the second traffic flow statistics in the second data structure.

2. The method of claim 1, further comprising alternating between the first and second data structures to store traffic flow statistics in one of the data structures, and output traffic flow statistics from the other data structure during subsequent time periods.

3. The method of claim 1, wherein outputting the first traffic flow statistics of the first data structure comprises outputting the first traffic flow statistics of the first data structure as a plurality of non-contiguous packet streams such that the first traffic flow statistics are output substantially over the full amount of time allotted for aggregation of the second traffic flow statistics in the second data structure.

4. The method of claim 1, wherein outputting the first traffic flow statistics comprises outputting subsets of packets at intervals of time over the full amount of time allotted for aggregation of the second traffic flow statistics in the second data structure.

5. The method of claim 1, wherein outputting the first traffic flow statistics comprises:

determining an amount of data stored by the first data structure, and

outputting packets at intervals to carry portions of the data stored by the first data structure.

6. The method of claim 1, wherein the traffic flow statistics defines a number of packets, a number of bytes, a time of capturing a first packet for the flow, a time of capturing a most recent packet for the flow, an incoming interface, an outgoing interface, a source, destination network mask, or a source/destination Autonomous System (AS) number.

7. The method of claim 1, wherein the traffic flow statistics define a number of packets for the flow, a number of bytes for the flow, a time of capturing a first packet for the flow, a time of capturing a most recent packet for the flow, an incoming interface by which the packets were received, an outgoing interface, a source for the flow, destination network mask, and a source/destination Autonomous System (AS) number.

8. An apparatus comprising:

a network interface to receive first packets from a network; and

a traffic flow module to generate traffic flow statistics based on the first packets, generate second packets that include the traffic flow statistics, and output the second packets including the traffic flow statistics in rate-controlled manner to a packet flow collector for analysis of the networks,

wherein the traffic flow module includes a first data structure and a second data structure to aggregate the traffic flow statistics, and

wherein a rate of output of a first subset of second packets associated with traffic flow statistics in the first data structure is controlled based on an amount of time allotted for aggregation of traffic flow statistics in the second data structure and a number of packets in the first subset of second packets.

9. The apparatus of claim 8, wherein the traffic flow module selectively alternates between the data structures to store the generated traffic flow statistics.

10. The apparatus of claim 8, wherein the traffic flow module exports the second packets in a plurality of non-contiguous streams so that the traffic flow statistics are output substantially over the full amount of the time allotted for aggregation of the flow statistics in the second data structure.

11. The apparatus of claim 8, wherein the traffic flow module maintains the first data structure to accumulate traffic flow statistics corresponding to a first set of the first packets, and the second data structure to accumulate traffic flow statistics corresponding to a second set of the first packets.

12. The apparatus of claim 11, the first data structure being further used for output of a first set of the second packets that include the traffic flow corresponding to the first set of the first packets.

13. The apparatus of claim 12, wherein output of the first set of second packets occurs during accumulation of traffic flow statistics corresponding to the second set of the first packets.

14. The apparatus of claim 13, wherein following output of the first set of the second packets, the first data structure previously used for output of the first set of second packets is used for accumulating traffic flow statistics corresponding to a third set of the first packets, and the second data structure previously used for accumulating traffic flow statistics corresponding to the second set of first packets is used for output of a second set of second packets, the second set of second packets including the traffic flow corresponding to the second set of the first packets.

15. The apparatus of claim 8, wherein the traffic flow module outputs subsets of the second packets at intervals of time.

16. The apparatus of claim 8, wherein the network interface comprises a set of interface cards to receive the first packets from the network, and further wherein the apparatus comprises a router, the router further including a control unit to:

receive the first packets from an in-bound port of one of the interface cards;

forward traffic flow statistics corresponding to the first packets to the traffic flow module; and

forward the first packets to an out-bound port of one of the interface cards corresponding to a next hop for the first packets.

17. The apparatus of claim 16, wherein the control unit includes a packet forwarding engine coupled to a routing engine.

18. An apparatus comprising:

a network interface to receive first packets from a network;

a traffic flow module to generate traffic flow statistics associated with the first packets received form the network;

a first data structure to accumulate the traffic flow statistics corresponding to a first set of the first packets;

a second data structure to accumulate the traffic flow statistics corresponding to a second set of the first packets; and

a controller to generate and output second packets based on the accumulated traffic flow statistics in the first and second data structures, wherein the controller causes output of a first set of second packets corresponding to statistics in the first data structure during a period of time when the traffic flow statistics is accumulated in the second data structure, and

wherein the controller controls a rate of output of the first set of second packets associated with traffic flow statistics in the first data structure based on an amount of time allotted for accumulation of traffic flow statistics in the second data structure.

19. The apparatus of claim 18, wherein following output of the first set of second packets, the controller causes output of a second set of second packets corresponding to statistics in the second data structure during a period of time when traffic flow statistics corresponding to a third set of the first packets is accumulated in the first data structure.

20. The apparatus of claim 18, wherein the controller causes output of the first set of second packets corresponding to statistics in the first data structure by identifying a number of the second packets in the first set to be output during a period of time and causing output of subsets of the number of the second packets in the first set at intervals of the period of time.

21. A method comprising:

receiving first packets from a network;

generating traffic flow statistics for the first packets, wherein the traffic flow statistics are stored in a first data structure and a second data structure;

generating second packets including the traffic flow statistics;

outputting the second packets including the traffic flow statistics in a rate-controlled manner to a packet flow collector for analysis of the network; and

controlling a rate of output of a first subset of second packets associated with traffic flow statistics in the first data structure based on an amount of time allotted for aggregation of traffic flow statistics in the second data structure.

22. The method of claim 21, further comprising:

defining the first data structure to be used for aggregation of the traffic flow statistics;

defining the second data structure to be used for output of the second packets; and

following output of the second packets, redefining the first data structure to be used for aggregation and redefining the second data structure to be used for output.

23. The method of claim 21, further comprising outputting subsets of the second packets during intervals of time.

24. A method comprising:

receiving first packets from a network;

generating traffic flow statistics for the first packets received from the network;

defining a first data structure as an aggregation data structure and a second data structure as an export data structure;

aggregating the traffic flow statistics for a first set of the first packets in the first data structure;

redefining the first data structure as the export data structure and the second data structure as the aggregation data structure;

aggregating the traffic flow statistics for a second set of the first packets in the second data structure; and

outputting a first set of second packets in a rate-controlled manner, the first set of second packets including the traffic flow statistics in the first data structure, wherein outputting the first set of second packets in a rate-controlled manner includes;

identifying a number of the second packets in the first set;

identifying a period of time to be used to output of the first set of second packets based on an amount of time allotted for aggregation of traffic flow statistics in the second data structure; and

outputting subsets of the number of second packets in the first set during intervals of the period of time.

25. The method of claim 24, further comprising following output of the first set of second packets in the rate-controlled manner:

redefining the first data structure as the aggregation data structure and the second data structure as the export data structure;

aggregating traffic flow statistics for a third set of the first packets in the first data structure;

outputting a second set of the second packets in a rate-controlled manner, wherein an amount of data associated with aggregation of the third set of the first packets is different than an amount of data associated with aggregation of the first set of the first packets.

26. A traffic flow service card capable of removable insertion into a network device comprising:

an interface for insertion within a slot of the network device; and

a traffic flow module coupled to the interface to generate traffic flow statistics based on first packets received by the network device, generate second packets to include the traffic flow statistics, and output the second packets including the traffic flow statistics in a rate-controlled manner,

wherein the traffic flow module includes a first data structure and a second data structure to aggregate the traffic flow statistics, and

wherein the traffic flow module controls a rate of output of a first subset of second packets associated with traffic flow statistics in the first data structure based on an amount of time allotted for aggregation of traffic flow statistics in the second data structure.

27. A computer readable medium comprising instructions that upon execution in a network analyzer cause the network analyzer to:

generate traffic flow statistics for first packets received from a network;

store the traffic flow statistics in a first data structure and a second data structure;

generate second packets to include the traffic flow statistics;

output second packets including the traffic flow statistics in a rate-controlled manner for transmission over the network to a packet flow collector for analysis of the network; and

control a rate of output of a first subset of second packets associated with traffic flow statistics in the first data structure based on an amount of time allotted for aggregation of traffic flow statistics in the second data structure.

28. The computer readable medium of claim 27, further comprising instructions that upon execution cause the network analyzer to:

define the first data structure to be used for aggregation of the traffic flow statistics;

define the second data structure to be used for output of the second packets; and

following output of the second packets, redefine the first data structure previously used for output to be subsequently used for aggregation and redefining the second data structure previously used for aggregation to be subsequently used for output.

29. The computer readable medium of claim 27, further comprising instructions that upon execution cause the network analyzer to output subsets of the second packets during intervals of time.

30. A computer readable medium comprising instructions that upon execution in a network analyzer cause the network analyzer to:

define a first data structure as an aggregation data structure and a second data structure as an export data structure;

aggregate in the first data structure traffic flow statistics for a first set of first packets received from a network;

redefine the first data structure as the export data structure and the second data structure as the aggregation data structure;

aggregate traffic flow statistics for a second set of the first packets in the second data structure;

generate second packet including the traffic flow statistics;

output a first set of second packets, the first set of second packet including the traffic flow statistics in the first data structure; and

control a rate of output of a first set of second packets associated with traffic flow statistics in the first data structure based on an amount of time allotted for aggregation of traffic flow statistics in the second data structure.

31. The computer readable medium of claim 30, further comprising instructions that upon execution cause the network analyzer to output the first set of second packets in a rate-controlled manner.

32. The computer readable medium of claim 31, further comprising instructions that upon execution cause the network analyzer to:

identify the number of second packets in the first set;

identify a period of time to be used to output of the first set of second packets; and

output subsets of the number of second packets in the first set during intervals of the period of time.

33. The computer readable medium of claim 30, further comprising instructions that upon execution cause the network analyzer to:

redefine the first data structure as the aggregation data structure and the second data structure as the export data structure;

aggregate traffic flow statistics for a third set of the first packets in the first data structure; and

output a second set of the second packets in a rate-controlled manner.

34. A method comprising:

receiving first packets from a network;

generating traffic flow statistics for the first packets;

storing the traffic flow statistics for the first packets in a first data structure;

generating second packets to include the traffic flow statistics in the first data structure;

defining an export rate for the second packets including the traffic flow statistics based on an amount of time allotted for subsequent accumulation of traffic flow statistics in a second data structure and a number of second packets associated with the traffic flow statistics in the first data structure to be output; and

outputting the second packets according to the export rate.

35. The method of claim 34, wherein outputting the second packets according to the export rate comprises outputting the second packets substantially continuously over the time allotted.

36. The method of claim 34, wherein outputting the second packets according to the export rate comprises outputting subsets of the second packets at intervals of the time allotted.

37. The method of claim 34, further comprising estimating the number of second packets based on a number of nodes in a data structure storing the traffic flow statistics.

38. The method of claim 34, further comprising estimating the number of second packets based on an amount of data in a data structure storing the traffic flow statistics.

39. An apparatus comprising:

a network interface to receive first packets from a network; and

a traffic flow module to generate traffic flow statistics for the first packets, store the traffic flow statistics for the first packets in a first data structure, generate second packets to include the traffic flow statistics in the first data structure, define an export rate for the second packets including the traffic flow statistics based on an amount of time allotted for subsequent accumulation of traffic flow statistics in a second data structure and a number of second packets associated with the traffic flow statistics in the first data structure to be output, and output the second packets according to the export rate.

40. The method of claim 39, wherein the apparatus outputs the second packets according to the export rate by outputting the second packets substantially continuously over the time allotted.

41. The method of claim 39, wherein the apparatus outputs the second packets according to the export rate by outputting subsets of the second packets at intervals of the time allotted.

42. A computer readable storage medium comprising:

a first data structure storing traffic flow statistics accumulated during a first time interval and exported during a second time interval;

a second data structure storing traffic flow statistics accumulated during the second time interval; and

instructions to cause a processor to control the second interval of time for export of the traffic flow statistics from the first data structure based on an amount of time allotted for accumulation of traffic flow statistics in the second data structure.

43. The computer readable storage medium of claim 42, wherein following export from the first data structure of traffic flow statistics accumulated during the second time interval, the first data structure stores traffic flow statistics accumulated during a third time interval, wherein the traffic flow statistics accumulated during the second time interval in the second data structure is exported during the third time interval.