Method and system for dynamically capturing flow traffic data

• US 7,580,356 B1
• Filed: 03/16/2006
• Issued: 08/25/2009
• Est. Priority Date: 06/24/2005
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Packeteer Incorporated (Gen Digital Inc.)
• Inventors: Ghannadian, Farzad, Mishra, Sanjeev K., Fang, Li
• Primary Examiner(s): Moore; Ian N
• Assistant Examiner(s): VILLA, JOSE F
• Application Number:
  US11/377,786
• Time in Patent Office: 1,258 Days
• Field of Search: 370/353, 370/392, 370/389, 370/229, 370/230, 370/230.1, 370/231, 370/395.32, 709/232, 709/224, 709/236
• US Class Current: 370/230.1
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level

Abstract

An exemplary embodiment provides for a method for recording network traffic data that can be used in a network device operably disposed in a network, wherein the network device comprises a measurement data structure including at least one entry and a corresponding measurement key and wherein the at least one entry comprises at least one measurement attribute. The method includes receiving a packet and matching the packet to a data flow. A measurement policy for the data flow is identified, wherein the measurement policy comprises one or more measurement axes corresponding to respective data flow attributes, and a rule set relating to at least one of the one or more measurement axes. The rule set is applied to dynamically select one or more of the measurement axes in the measurement policy to be applied to the data flow. A measurement key is created based on the selected one or more measurement axes and attributes of the data flow corresponding to the selected one or more measurement axes. The measurement key is matched to an entry in a measurement data structure. If a matching entry is found, at least one of the one or more measurement attributes is updated corresponding to the entry based on the received packet. If no matching entry is found, a new entry is created in the measurement data structure.

Claims

1. A method for recording network traffic data, in a network device operably disposed in a network, wherein the network device comprises a measurement data structure including at least one entry and a corresponding measurement key, wherein the at least one entry comprises one or more measurement attributes, comprising:

receiving a packet;

matching the packet to a data flow;

identifying, by a processor, a measurement policy for the data flow from a plurality of measurement engine policies, wherein one of the measurement engine policies is a default measurement engine policy and at least one other of the measurement engine policies is a specific measurement engine policy, wherein each of the measurement policies comprises one or more measurement axes corresponding to respective data flow attributes, and wherein at least one of the measurement engine policies is a dynamic measurement engine policy that further comprises a rule set relating to at least one of the one or more measurement axes, wherein the rule set for the at least one of the one or more measurement axes defines a default state and one or more rules controlling when to switch from the default state to a second state, and wherein the identifying the measurement engine policy comprises applying one or more matching rules to match the data flow to a specific measurement engine policy of the plurality of measurement engine policies and selecting the default measurement engine policy if the data flow is not matched to a specific measurement engine policy;

if the identified measurement engine policy is a dynamic measurement engine policy, then applying the rule set to determine states for the at least one or more measurement axes and dynamically select, conditioned on the respective determined states, one or more of the measurement axes in the measurement policy to be applied to the data flow, else selecting all of the one or more measurement axes associated with the identified measurement engine policy;

creating, by the processor, a measurement key based on the selected one or more measurement axes and attributes of the data flow corresponding to the selected one or more measurement axes;

matching the measurement key to an entry in a measurement data structure;

if a matching entry is found, updating at least one of the one or more measurement attributes corresponding to the entry based on the received packet; and

if no matching entry is found, creating a new entry in the measurement data structure.

2. The method as recited in claim 1 wherein the rule set includes one or more numerical thresholds characterizing the data flow.

3. The method of claim 1 wherein the rule set includes a matching initiator address.

4. The method of claim 1 wherein the rule set includes a matching destination address.

5. The method of claim 1 wherein the rule set includes a matching application.

6. The method of claim 1 wherein the measurement engine policy identifies at least one measurement axis.

7. The method of claim 6 wherein the one or more measurement axes is one selected from a group consisting of a service type identifier, an initiator network address, an acceptor network address, a flow control policy identifier, a measurement tag, an ingress interface, an egress interface, and a port identifier.

8. The method of claim 1, wherein the measurement policy identifies at least one measurement axis, wherein the selecting step comprises comparing the at least one measurement axis to corresponding attributes of the data flow object.

9. The method of claim 1 wherein the creating step comprises:

concatenating, based on the measurement policy, a plurality of attributes in the data flow object; and

hashing the concatenated attributes to create the measurement key.

10. The method of claim 6 wherein the creating step comprises:

concatenating, based on the at least one measurement axis identified in the measurement policy, a plurality of attributes in the data flow object; and

hashing the concatenated attributes to create measurement key.

11. The method of claim 1 further comprising:

periodically writing the network traffic data in the measurement structure to a persistent data store; and

clearing the measurement data structure.

12. The method of claim 1 wherein the measurement data structure comprises a table.

13. The method of claim 12 wherein the measurement key is an index to the entries in the table.

14. An apparatus for recording network traffic data, comprising

one or more processors;

one or more network interfaces,

a memory, the memory comprising a measurement data structure, and at least one data flow object;

a software application, physically stored in the memory, comprising instructions operable to cause the one or more processors and the apparatus to;

receive a packet;

match the packet to a data flow;

identify a measurement policy for the data flow from a plurality of measurement engine policies, wherein one of the measurement engine policies is a default measurement engine policy and at least one other of the measurement engine policies is a specific measurement engine policy, wherein each of the measurement policies comprises one or more measurement axes corresponding to respective data flow attributes, and wherein at least one of the measurement engine policies is a dynamic measurement engine policy that further comprises a rule set relating to at least one of the one or more measurement axes, wherein the rule set for the at least one of the one or more measurement axes defines a default state and one or more rules controlling when to switch from the default state to a second state, and wherein the identifying the measurement engine policy comprises applying one or more matching rules to match the data flow to a specific measurement engine policy of the plurality of measurement engine policies and selecting the default measurement engine policy if the data flow is not matched to a specific measurement engine policy;

if the identified measurement engine policy is a dynamic measurement engine policy, then apply the rule set to determine states for the at least one or more measurement axes and dynamically select, conditioned on the respective determined states, one or more of the measurement axes in the measurement policy to be applied to the data flow, else select all of the one or more measurement axes associated with the identified measurement engine policy;

create a measurement key based on the selected one or more measurement axes and attributes of the data flow corresponding to the selected one or more measurement axes;

match the measurement key to an entry in a measurement data structure;

if a matching entry is found, update at least one of the one or more measurement attributes corresponding to the entry based on the received packet; and

if no matching entry is found, create a new entry in the measurement data structure.

15. The apparatus as recited in claim 14 wherein the rule set includes one or more numerical thresholds characterizing the data flow.

16. The apparatus of claim 14 wherein the rule set includes a matching initiator address.

17. The apparatus of claim 14 wherein the rule set includes a matching destination address.

18. The apparatus of claim 14 wherein the rule set includes a matching application.

19. The apparatus of claim 14 wherein the measurement policy identifies at least one measurement axis.

20. The apparatus of claim 19 wherein the one or more measurement axes is one selected from a group consisting of a service type identifier, an initiator network address, an acceptor network address, a flow control policy identifier, a measurement tag, an ingress interface, an egress interface, and a port identifier.

21. The apparatus of claim 14, wherein the measurement policy identifies at least one measurement axis, wherein to select the measurement policy, the software application further comprises instructions operative to cause the processor to compare the at least one measurement axis to corresponding attributes of the data flow object.

22. The apparatus of claim 14 wherein to create the measurement key, the software application further comprises instructions operative to cause the processor to:

concatenate, based on the measurement engine policy, a plurality of attributes in the data flow object; and

hash the concatenated attributes to create measurement key.

23. The apparatus of claim 19 wherein to create the measurement engine key, the software application further comprises instructions operative to cause the one or more processors to:

concatenate, based on the at least one measurement axis identified in the measurement policy, a plurality of attributes in the data flow object; and

hash the concatenated attributes to create measurement key.

24. The apparatus of claim 14 further comprising a persistent data store, and wherein the software application further comprises instructions operative to cause the one or more processors to:

periodically write the network traffic data in the measurement data structure to a persistent data store; and

clear the measurement data structure.

25. The apparatus of claim 14 wherein the measurement data structure comprises a table.

26. The apparatus of claim 25 wherein the measurement key is an index to the entries in the table.