Data matching using flow based packet data storage

• US 9,191,342 B2
• Filed: 11/20/2014
• Issued: 11/17/2015
• Est. Priority Date: 08/02/2006
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Silver Peak Systems Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Hughes, David Anthony, Burns, John, Yin, Zhigang
• Primary Examiner(s): VU, HOANG-CHUONG Q
• Application Number:
  US14/549,425
• Publication Number:
  US 20150078397A1
• Time in Patent Office: 362 Days
• Field of Search: 370/395.32, 370/389, 370/392, 707/205, 711/216
• US Class Current: 1/1
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 49/90 Buffering arrangements
• CPC Class Codes: H04L 49/901 using storage descriptor, e.g. read or write pointers
• CPC Class Codes: H04L 49/9047 including multiple buffers, e.g. buffer pools
• CPC Class Codes: H04L 49/9057 Arrangements for supporting packet reassembly or resequencing
• CPC Class Codes: H04L 49/9094 Arrangements for simultaneous transmit and receive, e.g. simultaneous reading/writing from/to the storage element
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A system for matching data using flow based packet data storage includes a communications interface and a processor. A communications interface receives a packet between a source and a destination. The processor identifies a flow between the source and the destination based on the packet. The processor determines whether some of packet data of the packet indicates a potential match to data in storage using hashes. The processor then stores the data from the most likely data match and second most likely data match without a packet header in a block of memory in the storage based on the flow.

Claims

1. A system for matching data using flow based packet data storage, the system comprising:

a communications interface that receives at least one data packet at a network device between a source and a destination, the at least one data packet including data and flow information; and

a processor that;

identifies a flow between the source and the destination based on the flow information in the at least one data packet;

determines whether at least a portion of the data from the received at least one data packet indicates one or more potential matches to data in storage;

retrieves a list of possible data matches;

determines match sizes of the most likely data match and a second most likely data match by directly comparing packet bytes and matched data bytes; and

stores the data from the at least one data packet without a packet header in a block of memory allocated for the flow, or

generates a retrieve instruction for the data match depending on the match sizes.

2. The system of claim 1, wherein the processor moves the storage data between a fast memory and a slow memory.

3. The system of claim 1, wherein the flow comprises a session between the source and the destination.

4. The system of claim 1, wherein the processor allocates the block of the memory for the identified flow.

5. The system of claim 1, wherein the processor transmits the packet data.

6. The system of claim 1, wherein the block of memory allocated for the flow is allocated from a list of partially filled blocks of memory.

7. A method for matching data using flow based packet data storage, the method comprising:

receiving at least one data packet at a network device between a source and a destination, the at least one data packet including data and flow information;

identifying a flow between the source and the destination based on the flow information in of the at least one data packet;

determining whether at least a portion of the data from the received at least one data packet indicates one or more potential matches to data in storage;

retrieving a list of possible data matches;

determining match sizes of the most likely data match and a second most likely data match by directly comparing packet bytes and matched data bytes; and

storing the data from the at least one data packet without a packet header in a block of memory allocated for the flow, or

generating a retrieve instruction for the data match depending on the match sizes.

8. The method of claim 7, further comprising moving the storage data between a fast memory and a slow memory.

9. The method of claim 7, wherein the flow comprises a session between the source and the destination.

10. The method of claim 7, further comprising allocating the block of the memory for the identified flow.

11. The method of claim 7, further comprising transmitting the packet data.

12. The method of claim 7, further comprising allocating the block of memory for the identified flow from a list of partially filled blocks of memory.

13. A software product for processing packets, the software product comprising:

software operational when executed by a processor to direct the processor to receive at least one data packet at a network device between a source and a destination, the at least one data packet including data and flow information;

to identify a flow between the source and the destination based on the flow information in the at least one data packet;

to determine whether at least a portion of the data from the received at least one data packet indicates one or more potential matches to data in storage;

to retrieve a list of possible data matches;

to determine match sizes of the most likely data match and a second most likely data match, by directly comparing packet bytes and matched data bytes; and

to store the data from the at least one data packet without a packet header in a block of memory allocated for the flow, or to generate a retrieve instruction for the data match depending on the match sizes; and

a non-transitory computer-readable storage medium configured to store the software.

14. The software product of claim 13, wherein the software is operational when executed by the processor to direct the processor to move the storage data between a fast memory and a slow memory.

15. The software product of claim 13, wherein the flow comprises a session between the source and the destination.

16. The software product of claim 13, wherein the software is operational when executed by the processor to direct the processor to allocate the block of the memory for the identified flow.

17. The software product of claim 13, wherein the software is operational when executed by the processor to direct the processor to transmit the packet data.

18. The software product of claim 13, wherein the block of memory allocated for the flow is allocated from a list of partially filled blocks of memory.