System and method for decoding communications between nodes of a cluster server

• US 7,562,156 B2
• Filed: 08/16/2002
• Issued: 07/14/2009
• Est. Priority Date: 08/16/2002
• Status: Active Grant

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Operating Corporation (Gen Digital Inc.)
• Inventors: Phadke, Abhay N.
• Primary Examiner(s): Blair; Douglas B
• Application Number:
  US10/222,104
• Publication Number:
  US 20040034703A1
• Time in Patent Office: 2,524 Days
• Field of Search: 709/224, 709/230, 709/246, 726/23, 726/25
• US Class Current: 709/246
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

A table-based packet sniffing/decoding system and method suitable for cluster server systems is provided. Packets having portions of various protocols are communicated between nodes of a cluster server. Fields of the packets are decoded using protocol definition tables and may be stored for subsequent analysis. A protocol is identified from a protocol identification field of a packet and the field definition table is identified for the identified protocol. The field definition table defines fields of packets for a particular protocol and identifies a field decode handler for use in decoding each field. A filter may be applied to selectively decode (or refrain from decoding) certain fields. A filter may also be applied to selectively decode particular protocols.

Claims

1. A method of decoding packets communicated between nodes of a cluster server comprising:

identifying a protocol from a protocol identification field of a communication packet, wherein the protocol is identified in a protocol identification table by reading a unique qualifier present in the protocol identification field of the communication packet, wherein the unique qualifier identifies a value at a location within the communication packet;

identifying a field definition table for the identified protocol, the field definition table defining fields of packets of the identified protocol, wherein the fields of packets of the identified protocol comprise at least a first field and a second field; and

decoding each field of the packet in accordance with a respective field decode handler identified for the field in the field definition table, wherein the field decode handler identified for the first field differs from the field decode handler identified for the second field.

2. The method of claim 1 further comprising determining a number of fields for the identified protocol from a field identification table, and wherein the field definition table identifies a corresponding field decode handler corresponding to each of the number of fields identified for the protocol, and wherein the method includes repeating the decoding for the number of fields of at least a portion of the packet in accordance with the corresponding field decode handler.

3. The method of claim 1 wherein the field definition table is one of a plurality of field definition tables, each of the plurality of field definition tables being associated with one of a plurality of protocols, and wherein identifying the protocol in the protocol identification table comprises identifying the protocol from a parent protocol, the unique qualifier identifying a number of bytes at an offset having the value.

4. The method of claim 1 wherein the packets are communicated between the nodes over a plurality of private network links coupling the nodes of the cluster server, and wherein the packets are comprised of one or more protocol portions, wherein each protocol portion having fields that are arranged in accordance with one of a plurality of protocols identified by a unique qualifier in the protocol identification field of each of the protocol portions.

5. The method of claim 4 wherein identifying the protocol includes identifying a first protocol for a first protocol portion of the packet, and wherein identifying a first field definition table includes identifying a field definition table for the first protocol, and wherein decoding comprises decoding fields of the first protocol portion of the packet,

and wherein the method further comprises:

identifying a second protocol for a second protocol portion of the packet;

identifying a second field definition table for the second protocol; and

decoding fields of the second protocol portion of the packet in accordance with field decode handlers for fields of the second protocol portion of the packet identified in the second field definition table.

6. The method of claim 5 wherein when the packet has remaining protocol portions, the method includes repeating the identifying and decoding steps for the remaining protocol portions of the packet using other definition tables for the remaining protocol portions for the packet.

7. The method of claim 1 further comprising storing the decoded field in an output file for subsequent analysis.

8. The method of claim 1 further comprising applying a filter to the decoding to decode predetermined fields of the packet and refrain from decoding other predetermined fields of the packet, wherein the predetermined fields are specified in a user preference file.

9. The method of claim 1 wherein the decode handler utilizes a user preferences file for decoding particular fields of the packet.

10. The method of claim 1 further comprising refraining from decoding fields of packets identified by the protocol identification field as being of a predetermined protocol.

11. A packet decoding system to decode packets communicated between nodes of a cluster server, the system comprising:

a network interface to read communication packets communicated over a plurality of private network links coupling the nodes of the cluster server;

a memory to store at least a field definition table associated with each protocol of a plurality of protocols, the field definition table defining fields and identifying field decode handlers for fields of the associated protocol, wherein the fields comprise at least a first field and a second field, and wherein the field decode handler identified for the first field differs from the field decode handler identified for the second field; and

a processing element to identify a protocol from a protocol identification field of a communication packet, to identify a field definition table for the identified protocol, and to decode each field of the packet in accordance with the respective field decode handler identified for the field in the field definition table;

wherein the protocol is identified in a protocol identification table by reading a unique qualifier present in the protocol identification field of the communication packet, wherein the unique qualifier identifies a value at a location within the communication packet.

12. The system of claim 11 further wherein the network interface reads packets that are communicated between the nodes over the plurality of private network links coupling the nodes of the cluster server, and wherein the packets are comprised of one or more protocol portions, wherein each protocol portion has fields that are arranged in accordance with one of a plurality of protocols, each portion identified by the unique qualifier in the protocol identification field to identify the protocol from a parent protocol, the unique qualifier identifying a number of bytes at an offset having the value.

13. The system of claim 12 wherein the processing element identifies a second protocol from a second protocol identification. field of a. second protocol portion of the communication packet, identifies a second field definition table for, the second identified protocol, and decodes a field of the second protocol portion packet in accordance with the field decode handler for at least one field identified in the second field definition table.

14. The system of claim 11 wherein the memory further stores a field identification table, wherein the processor determines a number of fields for the identified protocol from the field identification table, and wherein the field definition table identifies a corresponding field decode handler corresponding to each of the number of fields identified for the protocol, and wherein the processor repeats the decoding for the number of fields of at least a portion of the packet in accordance with the corresponding field decode handler.

15. The system of claim 11 wherein the field definition table is one of a plurality of field definition tables, each field definition table being associated with one of a plurality of protocols, and wherein the processor, when identifying the protocol, determines if the protocol is identified in a protocol identification table by reading a unique qualifier present in the protocol identification field.

16. The system of claim 11, wherein the decoded field is stored in an output file for subsequent analysis,

wherein the processor applies a filter to decode preselected fields of the packet and refrains from decoding other preselected fields of the packet, the preselected fields being specified in a user preference file.

17. An article comprising a storage medium having stored thereon instructions, that when executed by a computing platform, result in:

identifying a protocol from a protocol identification field of a communication packet, wherein the protocol is identified in a protocol identification table by reading a unique qualifier present in the protocol identification field of the communication packet, wherein the unique qualifier identifies a value at a location within the communication packet;

identifying a field definition table for the identified protocol, the field definition table defining fields of packets of the identified protocol, wherein the fields of packets of the identified protocol comprise at least a first field and a second field; and

decoding each field of the packet in accordance with a respective field decode handler for at least one field identified in the field definition table, wherein the field decode handler identified for the first field differs from the field decode handler identified for the second field.

18. The article of claim 17 wherein the instructions, when, executed by the computing platform, further result in determining a number of fields for the identified protocol from a field identification table, and wherein the field definition table identifies a corresponding field decode handler corresponding to each of the number of fields identified for the protocol, and

repeating the decoding for the number of fields of at least a portion of the packet in accordance with the corresponding field decode handler,

and wherein the field definition table is one of a plurality of field definition tables, each of the plurality of field definition tables being associated with one of a plurality of protocols, and wherein identifying the protocol in the protocol identification table comprises identifying the protocol from a parent protocol, the unique qualifier identifying a number of bytes at an offset having the value.

19. The article of claim 17 wherein the packets are communicated between the nodes over a plurality of private network links coupling the nodes of the cluster server, and wherein the packets are comprised of one or more protocol portions, wherein each protocol portion has fields that are arranged in accordance with one of a plurality of protocols identified by a unique qualifier in the protocol identification field,

and wherein the instructions, further result in:

identifying a first protocol for a first protocol portion of the packet, and wherein identifying a field definition table includes identifying a first field definition table for the first protocol and wherein decoding comprises decoding fields of the first protocol portion of the packet;

identifying a second protocol for a second protocol portion of the packet;

identifying a second field definition table for the second protocol; and

decoding fields of the second protocol portion of the packet in accordance with field decode handlers for fields of the second protocol portion of the packet identified in the second field definition table.

20. The article of claim 17 wherein the article is a computer readable medium, and wherein the instructions, when executed by the computing platform, further result in:

storing the decoded field in an output file for subsequent analysis; and

applying a filter to the decoding to decode predetermined fields of the packet and refrain from decoding other predetermined fields of the packet, wherein the predetermined fields are specified in a user preference file.