Managing timeouts for dynamic flow capture and monitoring of packet flows
First Claim
1. A method for maintaining timers within a network flow capture device, the method comprising:
- defining a timeout array comprising a plurality of elements, wherein the timeout array represents a span of time and the elements represent sequential units of time;
executing a communication protocol to receive information specifying one or more filter criteria for matching one or more packet flows and a timeout associated with the filter criteria; and
updating an element of the timeout array to identify the filter criteria, wherein the updated element represents a time unit within the span of time that corresponds to the timeout for the flow criteria.
1 Assignment
0 Petitions
Accused Products
Abstract
Techniques are described for managing timeouts of filter criteria in a packet flow capture applications. The techniques allow for handling large amounts of timeouts used when monitoring a high volume of packet flows, without placing extreme demands on the operating system for managing the timeouts. The timeout data structure may be a circular array having a plurality of elements. The timeout array represents a span of time and the elements represent sequential units of time. Each element contains one or more pointers. The pointer may point to an entry in the filter table, or may be a null pointer. A timer thread periodically checks the timeout array to determine whether any timeouts occur at the current time. The timer thread checks the element of the array corresponding to the current time by computing an index into the array based on the current time.
-
Citations
22 Claims
-
1. A method for maintaining timers within a network flow capture device, the method comprising:
-
defining a timeout array comprising a plurality of elements, wherein the timeout array represents a span of time and the elements represent sequential units of time; executing a communication protocol to receive information specifying one or more filter criteria for matching one or more packet flows and a timeout associated with the filter criteria; and updating an element of the timeout array to identify the filter criteria, wherein the updated element represents a time unit within the span of time that corresponds to the timeout for the flow criteria. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15)
-
-
16. A network device comprising:
-
a timeout array comprising a plurality of elements, wherein the timeout array represents a span of time and the elements represent sequential units of time; a communication protocol to receive information specifying one or more filter criteria for matching one or more packet flows and a timeout associated with the criteria; and a flow match timer module that updates an element of the timeout array to identify the filter criteria, wherein the updated element represents a time unit within the span of time that corresponds to the timeout for the filter criteria. - View Dependent Claims (17, 18, 19, 20, 21)
-
-
22. A network device comprising:
-
a dynamic flow capture (DFC) service card executing a communication protocol to receive, from one or more control sources (CSs), flow capture information specifying at least one destination, filter criteria for matching one or more packet flows, and a timeout associated with the filter criteria; a network interface card to receive a packet from a network; a packet replication module to replicate the packet; a control unit to provide the replicated packet from the network interface card to the DFC service card; and a timeout array comprising a plurality of elements, wherein the timeout array represents a span of time and the elements represent sequential units of time.
-
Specification