Session-based packet routing for facilitating analytics

• US 9,648,542 B2
• Filed: 01/22/2015
• Issued: 05/09/2017
• Est. Priority Date: 01/28/2014
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Brocade Communications Systems, Inc. (Broadcom, Inc.)
• Inventors: Hsu, Ivy Pei-Shan, Chhabria, Sanjeev Nand, Chen, Xiaochu, Munshi, Sanjay, Narasimhan, Arvindsrinivasan Lakshmi
• Primary Examiner(s): Cho, Hong
• Application Number:
  US14/603,304
• Publication Number:
  US 20150215841A1
• Time in Patent Office: 838 Days
• Field of Search: None
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 40/02 Communication route or path selection, e.g. power-based or shortest path routing

Abstract

A GTP correlation cluster (GCC) can automatically program a network element to forward copies of packets originating from a mobile device and having a shared attribute to the same analytic server, regardless of the regions into which the mobile device moves. The GCC can monitor attributes of copies of control packets that the network element receives. In response to detecting a changed attribute within a control packet originating from a mobile device, the GCC can update a session map specific to that mobile device in order to cause packets having that changed attribute to be forwarded to the same port to which packets having the former attribute were being forwarded prior to the change. As a result, the network element can ensure that packets belonging to a particular session still are forwarded to the same analytic server even if the mobile device has moved to a different region.

Claims

1. A network node configured to perform operations comprising:

receiving a first packet from a first network entry point;

receiving a second packet from a second network entry point that differs from the first network entry point;

determining that the second packet belongs to a same session to which the first packet belongs;

determining that the second packet contains a second combination of attributes that differs from a first combination of attributes contained in the first packet;

in response to determining that the second combination of attributes differs from the first combination of attributes, replacing a mapping between the first combination of attributes and an identifier of an analytic server to which the first packet was forwarded with a mapping between the second combination of attributes and the identifier of the analytic server; and

after the replacing, forwarding packets that contain the second combination of attributes to the analytic server having the identifier that is mapped to the second combination of attributes.

2. The network node of claim 1, wherein the first and second packets are GTP-C packets.

3. The network node of claim 1, wherein the replacing comprises:

updating a mapping that is associated with an IMSI of a mobile device from which the first packet originated.

4. The network node of claim 1, wherein routing the packets that contain the second combination of attributes comprises routing GTP-U packets that specify the second set of attributes.

5. The network node of claim 1, wherein a set of attributes to which the identifier of the analytic server is mapped includes a source IP address, a destination IP address, a TCP port, and a tunnel identifier.

6. The network node of claim 5, wherein the source IP address is an SGSN IP address, and wherein the destination IP address is a GGSN IP address.

7. The network node of claim 5, wherein the source IP address is an MME IP address, and wherein the destination IP address is a SGW IP address.

8. The network node of claim 1, wherein replacing the mapping between the first combination of attributes and the identifier of the analytic server with the mapping between the second combination of attributes and the identifier of the analytic server comprises:

inputting at least a subset of the second combination of attributes into a specified function; and

determining a card and port pair based on the output of the specified function.

9. The network node of claim 8, wherein routing packets that contain the second combination of attributes to the analytic server having the identifier that is mapped to the second combination of attributes comprises:

determining whether an access control list contains an entry that contains the second combination of attributes; and

responsive to determining that the access control list does not contain any entry that contains the second combination of attributes, determining the card and port pair based on the output of the specified function.

10. The network node of claim 1, further comprising:

responsive to the replacing, altering an access control list to reflect changes produced by the replacing.

11. The network node of claim 1, wherein:

the first network entry point is a first cellular telephone tower with which a mobile device interfaces when the mobile device originates the first packet; and

the second network entry point is a second cellular telephone tower with which the mobile device interfaces when the mobile device originates the second packet.

12. The network node of claim 1, wherein:

the first packet specifies a first source IP address and a particular destination IP address;

the second packet specifies a second source IP address and the particular destination IP address; and

the first source IP address differs from the second source IP address.

13. The network node of claim 1, wherein:

the first packet specifies a first SGSN and a particular GGSN;

the second packet specifies a second SGSN and the particular GGSN; and

the first SGSN differs from the second SGSN.

14. The network node of claim 1, wherein:

the first packet specifies an IMSI; and

the second packet does not specify the IMSI.

15. A method comprising:

receiving, by a network node, a first packet from a first network entry point;

receiving, by the network node, a second packet from a second network entry point that differs from the first network entry point;

determining, by the network node, that the second packet belongs to a same session to which the first packet belongs;

determining, by the network node, that the second packet contains a second combination of attributes that differs from a first combination of attributes contained in the first packet;

in response to determining that the second combination of attributes differs from the first combination of attributes, replacing, by the network node, a mapping between the first combination of attributes and an identifier of an analytic server to which the first packet was forwarded with a mapping between the second combination of attributes and the identifier of the analytic server; and

after the replacing, forwarding, by the network node, packets that contain the second combination of attributes to the analytic server having the identifier that is mapped to the second combination of attributes.

16. A non-transitory computer readable storage medium having stored thereon program code that, when executed by a network node, causes the network node to:

receive a first packet from a first network entry point;

receive a second packet from a second network entry point that differs from the first network entry point;

determine that the second packet belongs to a same session to which the first packet belongs;

determine that the second packet contains a second combination of attributes that differs from a first combination of attributes contained in the first packet;

in response to determining that the second combination of attributes differs from the first combination of attributes, replace a mapping between the first combination of attributes and an identifier of an analytic server to which the first packet was forwarded with a mapping between the second combination of attributes and the identifier of the analytic server; and

after the replacing, forward packets that contain the second combination of attributes to the analytic server having the identifier that is mapped to the second combination of attributes.