Offline analysis of packets

• US 20060080733A1
• Filed: 10/08/2004
• Published: 04/13/2006
• Est. Priority Date: 10/08/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Savoy, Jeremy Matthew, Petrovic, Ognjen, Woods, Duncan Allen, Khosmood, Foaad
• Granted Patent: US 7,490,235 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A method, apparatus, system, and signal-bearing medium that, in an embodiment, filter packets received from a network based on rules. The filtering discards a subset of the packets based on the rules and keeps a remaining subset of the packets. The remaining subset is copied to a destination. The rules are created offline in a lower priority process from the filtering and copying by detecting whether symptoms exist in a sample of the remaining subset. In an embodiment, the order that the symptoms are detected is changed based on the frequency of the existence of the symptoms in the sample. In various embodiments, the symptoms may include receiving a threshold number of ping packets within a time period, receiving a threshold number of broadcast packets within a time period, receiving a packet with an invalid source address, receiving a packet with an invalid header flag, and receiving a threshold number of the packets within a time period that contain a sequence flag. In this way, firewall throughput performance is increased.

Claims

1. A method comprising:

filtering packets based on a rule;

analyzing the filtered packets for a symptom; and

creating the rule based on the symptom, wherein the analyzing and the creating execute offline from the filtering.

2. The method of claim 1, further comprising:

sampling the filtered packets, wherein the sampling creates a subset of the filtered packets, and wherein the analyzing analyzes the subset.

3. The method of claim 1, wherein the symptom comprises:

receiving a threshold number of ping packets within a time period.

4. The method of claim 1, wherein the symptom comprises:

receiving a threshold number of broadcast packets within a time period.

5. The method of claim 1, wherein the symptom comprises:

receiving one of the packets with an invalid source address.

6. The method of claim 1, wherein the symptom comprises:

receiving one of the packets with an invalid header flag.

7. The method of claim 1, wherein the symptom comprises:

receiving a threshold number of the packets within a time period that contain a sequence flag.

8. An apparatus comprising:

means for filtering packets based on at least one rule, wherein the means for filtering discards a first subset of the packets based on the rule and keeps a remaining subset of the packets;

means for creating a sample of the remaining subset;

a plurality of means for detecting whether each of a plurality of symptoms exists in the sample; and

means for determining the at least one rule based on the plurality of means for detecting, wherein the plurality of means for detecting and the means for determining execute in a different process from the means for filtering and the means for creating.

9. The apparatus of claim 8, further comprising:

means for copying the remaining subset to a destination.

10. The apparatus of claim 8, further comprising:

means for changing an order of execution of the plurality of means for detecting based on a frequency of the plurality of symptoms in the sample.

11. The apparatus of claim 8, wherein the symptom comprises:

means for receiving a threshold number of ping packets within a time period.

12. The apparatus of claim 8, wherein the symptom comprises:

means for receiving a threshold number of broadcast packets within a time period.

13. The apparatus of claim 8, wherein the symptom comprises:

means for receiving one of the packets with an invalid source address.

14. The apparatus of claim 8, wherein the symptom comprises:

means for receiving one of the packets with an invalid header flag.

15. The apparatus of claim 8, wherein the symptom comprises:

means for receiving a threshold number of the packets within a time period that contain a sequence flag.

16. The apparatus of claim 8, wherein the different process has a lower priority than the means for filtering and the means for creating.

17. A signal-bearing medium encoded with instructions, wherein the instructions when executed comprise:

filtering packets based on at least one rule, wherein the filtering discards a first subset of the packets based on the rule and keeps a remaining subset of the packets;

creating a sample of the remaining subset;

detecting whether each of a plurality of symptoms exists in the sample;

changing an order of execution of the detecting whether each of the plurality of symptoms exists based on a frequency of each of the plurality of symptoms in the sample; and

determining the at least one rule based on the detecting, wherein the detecting and the determining execute in a different process from the filtering and the creating.

18. The signal-bearing medium of claim 17, further comprising:

copying the remaining subset to a destination.

19. The signal-bearing medium of claim 18, wherein the copying further comprises:

copying the remaining subset to the destination in a same process as the filtering and the creating.

20. The signal-bearing medium of claim 17, wherein the symptom comprises:

receiving a threshold number of ping packets within a time period.

21. The signal-bearing medium of claim 17, wherein the symptom comprises:

receiving a threshold number of broadcast packets within a time period.

22. The signal-bearing medium of claim 17, wherein the symptom comprises:

receiving one of the packets with an invalid source address.

23. The signal-bearing medium of claim 17, wherein the symptom comprises:

receiving one of the packets with an invalid header flag.

24. The signal-bearing medium of claim 17, wherein the symptom comprises:

receiving a threshold number of the packets that contain a sequence flag within a time period.

25. The signal-bearing medium of claim 17, wherein the different process has a lower priority than the filtering and the creating.

26. A firewall comprising:

a plurality of analyzer modules, wherein the plurality of analyzer modules detect a plurality of respective symptoms in packets and create a plurality of respective rules based on the plurality of symptoms; and

a filter module that filters the packets based on the plurality of rules, wherein the plurality of analyzer modules execute offline from the filter module.

27. The firewall of claim 26, wherein the plurality of analyzer modules execute in an order and wherein one of the plurality of analyzer modules reprioritizes the order based on a presence or absence of one of the plurality of symptoms.

28. The firewall of claim 27, wherein a priority of the one analyzer module is increased if the one symptom is present, and wherein the order is based on the priority.

29. The firewall of claim 27, wherein a priority of the one analyzer module is decreased if the one symptom is absent, and wherein the order is based on the priority.

30. The firewall of claim 26, wherein one of the plurality of analyzer modules periodically removes the respective rule from the filter module.

31. The firewall of claim 26, further comprising:

a sampling module that samples the filtered packets, wherein the sampling creates a subset of the filtered packets, and wherein the analyzer module analyzes the subset.

32. A computer system comprising:

a processor; and

a network interface comprising

a plurality of analyzer modules, wherein the plurality of analyzer modules detect a plurality of respective symptoms in packets and create a plurality of respective rules based on the plurality of symptoms,

a filter module that filters the packets based on the plurality of rules, wherein the plurality of analyzer modules execute offline from the filter module, and

a sampling module that sends the filtered packets to an application that executes on the processor and that sends a sample of the filtered packets to the plurality of analyzer modules.

33. The computer system of claim 32, wherein the plurality of analyzer modules execute in an order and wherein one of the plurality of analyzer modules reprioritizes the order based on a presence or absence of one of the plurality of symptoms.

34. The computer system of claim 33, wherein a priority of the one analyzer module is increased if the one symptom is present, and wherein the order is based on the priority.

35. The computer system of claim 33, wherein a priority of the one analyzer module is decreased if the one symptom is absent, and wherein the order is based on the priority.

36. The computer system of claim 32, wherein one of the plurality of analyzer modules periodically removes the respective rule from the filter module.

37. The computer system of claim 36, where the one of the plurality of analyzer modules periodically removes the respective rule from the filter module based on a time threshold.

38. The computer system of claim 36, where the one of the plurality of analyzer modules periodically removes the respective rule from the filter module based on a number of the packets that met the respective rule and were discarded.

39. The computer system of claim 32, wherein the sampling module creates a subset of the filtered packets, and wherein the analyzer module analyzes the subset.

40. A method for configuring a computer, comprising:

configuring the computer to filter packets based on a rule;

configuring the computer to analyze the filtered packets for a symptom; and

configuring the computer to create the rule based on the symptom, wherein the filtered packets are analyzed and the rule is created offline from the filtering of the packets.