Device for enabling trap and trace of internet protocol communications

• US 20030227917A1
• Filed: 06/11/2002
• Published: 12/11/2003
• Est. Priority Date: 06/11/2002
• Status: Active Grant

• Current Assignee: AudioCodes, Inc. (Audiocodes Limited)
• Original Assignee: Netrake Corp. (Audiocodes Limited)
• Inventors: Maher, Robert Daniel III, Lie, Milton Andre, Deerman, James Robert
• Granted Patent: US 6,741,595 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42

Abstract

A network processing system is described that is able to monitor IP network traffic, including the ability to perform trap and trace on IP communications flowing over the IP network. The network processing system is able to scan the entire contents of data packets passing through it, and to associate related data packets into discrete sessions, or flows, which allows the network processing system to search for predetermined search criteria contained within those flows. If a flow is found to contain a predetermined search criteria, the network processing system is able to maintain a record of the flow or to replicate the flow and save it or send it to another IP address for monitoring. The monitoring of a flow can include the entire contents of the flow, or any subset of information in the flow such as call identifying information.

Claims

1. A network processing system for use in a network and operable to intercept communications flowing over the network, the network passing a plurality of data packets, which form a plurality of flows, the network processing system comprising:

a learning state machine operable to identify characteristics of one or more of the flows and to compare the characteristics to a database of known signatures, one or more of the known signatures representing a search criteria, wherein when one characteristics of one or more of the flows matches the search criteria the learning state machine intercepts the flow.

2. The network processing system of claim 1 wherein only the identifying information of the flow is intercepted.

3. The network processing system of claim 1 wherein the entire contents of the flow are intercepted.

4. The network processing system of claim 1 wherein the communication to be intercepted has a control flow and a data flow.

5. The network processing system of claim 4 wherein a characteristic of the control flow matches the search criteria resulting in both the control flow and the data flow being intercepted.

6. The network processing system of claim 1 wherein intercepting the flow includes replicating the flow and redirecting the replication to a separate address.

7. The network processing system of claim 1 wherein the intercepted flow is a voice over IP call.

8. The network processing system of claim 1 wherein the learning state machine includes a header preprocessor for examining header information in the packet, a content processor for comparing the packet to the database and determining a treatment, and a quality of service processor for modifying the packet and directing the packet according to the treatment.

9. The network processing system of claim 8 wherein each learning state machine further includes a microprocessor for data packets that require additional processing.

10. A network processing system for use in a network, the network consisting of multiple flows each flow formed by multiple data packets, the network processing system operable to intercept selected flows in the network and comprising:

a learning state machines further comprising;

a traffic flow processor processing the data packets to associate each data packet with a particular flow, to maintain state for each flow, and to compare one or more flows to a database of known signatures, the data base of known signatures including predetermined search criteria such that a match with the predetermined search criteria within the database of known signatures causes the network processing system to monitor the flow;

a quality of service processor communicating with the traffic flow processor, the quality of service processor operable to assign the data packets into a quality of service queue corresponding to the associated flow.

11. The network processing system of claim 10 wherein the monitoring of the flow includes making a record of call identifying information.

12. The network processing system of claim 10 wherein the monitoring of the flow includes replicating the flow and sending the replicated flow to a predetermined IP address.

13. The network processing system of claim 10 wherein the traffic flow processor is comprised of a header preprocessor and a content processor, the header preprocessor operable to examine header information for each packet, and the content processor operable to compare the packet with the database of known signatures.

14. The network processing system of claim 10 wherein the state includes information concerning the characteristics of the flow as well as a record of events contained in the flow.

15. The network processing system of claim 10 wherein the state existing for the particular flow at the time a new packet belonging to the particular flow is examined, is used in conjunction with the database to determine whether the flow matches the predetermined search criteria.

16. The network processing system of claim 10 wherein the database of known signatures including the predetermined search criteria is programmed using a management interface on a separate server and downloaded into the network processing system in the form of an image file.

17. The network processing system of claim 16 wherein the management interface also acts to retrieve monitoring records from the network processing system.