System and method for reporting packet characteristics in a network environment

• US 9,009,293 B2
• Filed: 11/18/2009
• Issued: 04/14/2015
• Est. Priority Date: 11/18/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Batz, Robert, Galatioto, Richard A., Mojica, Juan M., Tavres, Humberto M.
• Primary Examiner(s): LAMONT, BENJAMIN S
• Application Number:
  US12/621,066
• Publication Number:
  US 20110116377A1
• Time in Patent Office: 1,973 Days
• Field of Search: 370/328, 370/329, 370/401, 370/235, 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/193 at the transport layer, e.g. TCP related
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 47/35 by embedding flow control information in regular packets, e.g. piggybacking
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/66 Policy and charging system
• CPC Class Codes: H04M 15/8033 location-dependent, e.g. business or home
• CPC Class Codes: H04M 15/8214 Data or packet based
• CPC Class Codes: H04W 28/10 Flow control between communication endpoints
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]

Abstract

A method is provided in one example and includes receiving a request to initiate a communication flow associated with a subscriber and identifying one or more parameters to be monitored for the communication flow. The method further includes extracting one or more bits from packets associated with the communication flow; the bits are used to determine an operating system associated with the communication flow. A policy decision can be executed for the communication flow based on the operating system associated with the communication flow. In more specific examples, the bits are sent to a next destination in response to a threshold being reached for at least one of the parameters. The parameters can be associated a volume parameter or a time parameter. The policy decision could include blocking traffic associated with the subscriber, initiating billing, redirecting the communication, managing a quality of service level for the communication flow, etc.

Claims

1. A method, comprising:

receiving a request to initiate a communication flow;

mapping a source IP address associated with the communication flow to a subscriber;

determining a service level for the subscriber;

identifying one or more parameters to be monitored for the communication flow;

requesting a synchronization packet in response to a threshold being reached for at least one of the parameters;

receiving the synchronization packet;

extracting one or more bits from the synchronization packet, wherein the bits are attribute value pairs;

determining an operating system associated with the communication flow using the one or more bits from the synchronization packet; and

executing a policy decision based on the operating system associated with the communication flow and the service level for the subscriber, wherein the policy decision was received from a policy and charging rules function element.

2. The method of claim 1, wherein the bits are sent to a next destination in response to the threshold being reached for at least one of the parameters, and wherein the parameters are associated with a selected one of a volume parameter and a time parameter.

3. The method of claim 1, wherein executing the policy decision includes blocking traffic associated with the subscriber.

4. The method of claim 1, wherein executing the policy decision includes initiating billing for the communication flow.

5. The method of claim 1, wherein executing the policy decision includes redirecting the communication flow to a next destination.

6. The method of claim 1, wherein executing the policy decision includes managing a quality of service level for the communication flow.

7. The method of claim 1, wherein the bits are part of a selected one of a group of elements within the synchronization packet, the group of elements consisting of:

a) a transmission control protocol (TCP) header;

b) a packet option;

c) a packet flag;

d) a TCP field; and

e) an IP header field.

8. The method of claim 1, further comprising:

establishing a trigger used to initiate a request for the synchronization packet, wherein the trigger was received from a policy and charging rules function element.

9. The method of claim 8, wherein the trigger is a per-user volume threshold and the request for the synchronization packet is sent after the per-user volume threshold is met.

10. Logic encoded in one or more tangible media that includes code for execution and when executed by a processor operable to perform operations comprising:

receiving a request to initiate a communication flow;

mapping a source IP address associated with the communication flow to a subscriber;

determining a service level for the subscriber;

identifying one or more parameters to be monitored for the communication flow;

requesting a synchronization packet in response to a threshold being reached for at least one of the parameters;

receiving the synchronization packet;

extracting one or more bits from the synchronization packet, wherein the bits are attribute value pairs;

determining an operating system associated with the communication flow using the one or more bits from the synchronization packet; and

executing a policy decision based on the operating system associated with the communication flow and the service level for the subscriber, wherein the policy decision was received from a policy and charging rules function element.

11. The logic of claim 10, wherein the bits are sent to a next destination in response to the threshold being reached for at least one of the parameters, and wherein the parameters are associated with a selected one of a volume parameter and a time parameter.

12. The logic of claim 10, wherein executing the policy decision includes blocking traffic associated with the subscriber.

13. The logic of claim 10, wherein executing the policy decision includes initiating billing for the communication flow.

14. An apparatus, comprising:

a memory element configured to store data,

a processor operable to execute instructions associated with the data, and

a packet signature module configured to;

receive a request to initiate a communication flow;

map a source IP address associated with the communication flow to a subscriber;

determine a service level for the subscriber;

identify one or more parameters to be monitored for the communication flow;

request a synchronization packet in response to a threshold being reached for at least one of the parameters;

receive the synchronization packet;

extract one or more bits from the synchronization packet, wherein the bits are attribute value pairs;

determine an operating system associated with the communication flow using the one or more bits from the synchronization packet; and

execute a policy decision based on the operating system associated with the communication flow and the service level for the subscriber, wherein the policy decision was received from a policy and charging rules function element.

15. The apparatus of claim 14, wherein the bits are sent to a next destination in response to the threshold being reached for at least one of the parameters, and wherein the parameters are associated with a selected one of a volume parameter and a time parameter.

16. The apparatus of claim 14, further comprising:

a policy control enforcement function (PCEF) module configured to block traffic associated with the subscriber in response to the operating system being determined.

17. The apparatus of claim 16, wherein the PCEF module is further configured to:

redirect the communication flow to a next destination in response to the operating system being determined.

18. The apparatus of claim 14, further comprising:

a quality of service module configured to manage a quality of service level for the communication flow.

19. The apparatus of claim 14, further comprising:

a known user table (KUT) element configured to use an application program interface (API) to determine if one or more thresholds associated with the parameters are reached.

20. The apparatus of claim 14, further comprising:

a policy and charging rules function configured to compare the bits to predetermined operating system characteristics to determine the operating system associated with the communication flow.