System and method for processing network packet flows

• US 8,570,866 B2
• Filed: 02/09/2012
• Issued: 10/29/2013
• Est. Priority Date: 07/02/2001
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Buckman, Charles R., Cox, Dennis J., Kolbly, Donovan M., Cantrell, Craig S., Smith, Brian C., Werner, Jon H., Willebeek-LeMair, Marc, Blackard, Joe Wayne, Webster, Francis S. III
• Primary Examiner(s): Phillips, Hassan
• Assistant Examiner(s): DUONG, DUC T
• Application Number:
  US13/369,813
• Publication Number:
  US 20120140672A1
• Time in Patent Office: 628 Days
• Field of Search: None
• US Class Current: 370/230
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1485 Tariff-related aspects
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/22 Traffic shaping
• CPC Class Codes: H04L 47/2416 Real-time traffic
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 69/12 Protocol engines
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A network node includes a classify engine interfaced with the Internet. The classify engine accepts packets from the Internet and determines classification information for each packet. A process engine is interfaced with the classify engine, and has ports, each port being associated with a function. A controller is interfaced with the classify engine and the process engine. The controller programs the classify engine with a dataflow program to route each packet to a predetermined port of the process engine based on the classification information of the packet.

Claims

1. A network node comprising:

a classify engine interfaced with the Internet, the classify engine to accept packets from the Internet and determine classification information for each packet;

a process engine having a plurality of ports to receive the packets from the classify engine, each port having an associated function; and

a controller interfaced with the classify engine and the process engine, wherein the controller is to program the classify engine to route each packet to a predetermined port of the process engine based on the classification information of the packet;

wherein the controller is to program the classify engine with a dataflow program that determines the classification information for the packets, and

wherein the classify engine is further to monitor DHCP requests and responses to extract MAC and IP address mapping, and the controller is further to program the classify engine with rules to control traffic with IP address information.

2. The node of claim 1, wherein the classify engine is further to detect packets associated with an FTP data stream and the controller is further to program the classify engine with a new dataflow program that classifies the FTP data stream.

3. The node of claim 1, wherein the classify engine is further to monitor DNS requests and responses to associate traffic with an IP address and the controller is further to program the classify engine with rules to control traffic with IP address information.

4. The node of claim 1, wherein the controller detects host and port quadruples of a new TCP connection and creates a new dataflow program based on the host and port quadruples for the new TCP connection.

5. The node of claim 4, wherein the new dataflow program is provided to the classify engine, and the classify engine creates a new flow based on the new dataflow program to classify packets for the new TCP connection.

6. The node of claim 5, wherein a new function is added to the process engine for the new flow, and the new function is associated with a port of the process engine.

7. The node of claim 1, wherein the node comprises a broadband network node processing packets from the Internet.

8. A method for routing Internet packets, the method comprising:

classifying, by a processor, the packets into one or more packet flows according to classification rules;

routing each classified packet flow to a predetermined input port of a process engine according to classification information of the packets, each input port having an associated function, so that the packets flow through the processing engine as a data path;

programming the classification rules and functions through a control path that looks across packet flows of the data path;

detecting a new packet type;

creating a dataflow program to classify the new packet type based on parameters of the new packet type;

monitoring DNS requests and responses to associate traffic with an IP address; and

programming a classify engine with rules to control traffic with IP address information.

9. The method of claim 8, wherein the new packet type comprises a new TCP connection and creating a dataflow diagram comprises creating the dataflow diagram based on host and port quadruples for the new TCP connection.

10. The method of claim 9, comprising:

creating a new flow based on the dataflow program to classify packets for the new TCP connection.

11. The method of claim 10, comprising:

including a new function for processing packets for the new flow; and

associating the new function with an input port of the process engine processing the packets for the new flow.

12. The method of claim 8, comprising:

monitoring DHCP requests and responses to extract MAC and IP address mapping; and

programming a classify engine with rules to control traffic with IP address information.

13. A system for processing packets comprising:

a classify engine executed by a processor and interfaced with the Internet, the classify engine to accept packets from the Internet and determine classification information for each packet;

a process engine having plural ports to receive the packets from the classify engine, each port having an associated function; and

a controller interfaced with the classify engine and the process engine, wherein the controller is to program the classify engine to route each packet to a predetermined port of the process engine based on the classification information of the packet;

wherein the controller is to program the classify engine with a dataflow program that determines the classification information for the packets, and

wherein the controller detects host and port quadruples of a new TCP connection and creates a new dataflow program based on the host and port quadruples for the new TCP connection.

14. The system of claim 13, wherein the new dataflow program is provided to the classify engine, and the classify engine creates a new flow based on the new dataflow program to classify packets for the new TCP connection.

15. The system of claim 13, wherein a new function is added to the process engine for the new flow, and the new function is associated with a port of the process engine.