METHOD AND SYSTEM FOR IDENTIFYING MATCHING PACKETS

• US 20160373320A1
• Filed: 09/02/2016
• Published: 12/22/2016
• Est. Priority Date: 10/30/2012
• Status: Active Grant

• Current Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Original Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Inventors: CHAN, Lai-chong, MOODY, Brian
• Granted Patent: US 9,736,039 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/024 by adaptive sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0858 One way delays
• CPC Class Codes: H04L 47/115 using a dedicated packet
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/34 ensuring sequence integrity, e.g. using sequence numbers
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

In a method of identifying matching packets at different locations in a network, a first plurality of packets is received at a first location in the network, and a first subset thereof is selected in accordance with a filter. A second plurality of packets is received at a second location in the network, and a second subset thereof is selected in accordance with the same filter. Each packet in the first and second subsets is parsed to extract invariant header fields from an outermost IP header inwards, until a minimal set of invariant header fields is obtained for that packet, or until it is determined that a minimal set is not obtainable for that packet. A packet signature is computed from the minimal set for each packet having a minimal set, and the packet signatures arc compared to identify matching packets in the first and second subsets.

Claims

1-19. -19. (canceled)

20. A method, comprising:

receiving, by a device, a first subset of a first plurality of packets,

the first plurality of packets being associated with a first location in a network;

receiving, by the device, a second subset of a second plurality of packets,

the second plurality of packets being associated with a second location in the network, and

the second location being different than the first location;

parsing, by the device, each packet in the first subset and the second subset to extract invariant header fields from an outermost header until a minimal set of invariant header fields is obtained, for each packet, that uniquely identifies each packet throughout the network;

determining, by the device, a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset; and

comparing, by the device, packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset.

21. The method of claim 20, where each packet in the first subset and the second subset is parsed header by header from the outermost header inwards.

22. The method of claim 20, where:

at least some of the packets in the first subset have different protocol combinations,

at least some of the packets in the second subset have different protocol combinations, and

the minimal set of invariant header fields for each packet in the first subset and the second subset depends on the protocol combination of each packet.

23. The method of claim 20, where the minimal set of invariant header fields includes a source address field, a destination address field, and at least one additional invariant header field selected from an identifier and a sequence number.

24. The method of claim 20, further comprising:

applying a hash function to the minimal set of invariant header fields for each packet to determine the packet signature for each packet in the first subset and the second subset.

25. The method of claim 24, further comprising:

storing each packet in the first subset and the second subset in memory and in a hash table indexed by packet signature.

26. The method of claim 20, where a first timestamp is assigned to each packet in the first subset, a second timestamp is associated to each packet in the second subset, and the method further comprises:

comparing a first timestamp and a second timestamp of matching packets in the first subset and the second subset to determine a latency between the first location and the second location in the network.

27. The method of claim 20, where:

the first subset and the second subset are selected based on a filter,

the filter including a first filter condition based on a first invariant header field selected from an identifier and a sequence number, and

the first filter condition defining at least one of an entire identifier, an entire sequence number, a subset of the identifier, or a subset of the sequence number.

28. The method of claim 27, further comprising:

counting each packet in the first subset and the second subset to obtain a total quantity of packets;

comparing the total quantity of packets to a predetermined threshold; and

when the total quantity of packets is less than the predetermined threshold, adding a second filter condition to the filter,

the second filter condition being based on a second invariant header field selected from another identifier and another sequence number, and

the second filter condition defining at least one of an entire identifier, an entire sequence number, a subset of the identifier, or a subset of the sequence number.

29. A device, comprising:

one or more processors to;

receive a first subset of a first plurality of packets,

the first plurality of packets being associated with a first location in a network;

receive a second subset of a second plurality of packets,

the second plurality of packets being associated with a second location in the network, and

the second location being different than the first location;

parse each packet in the first subset and the second subset to extract invariant header fields from an outermost header until a minimal set of invariant header fields is obtained, for each packet, that uniquely identifies each packet throughout the network;

determine a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset; and

compare packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset.

30. The device of claim 29, where:

at least some of the packets in the first subset have different protocol combinations,

at least some of the packets in the second subset have different protocol combinations, and

the set of invariant header fields for each packet in the first subset and the second subset depends on the protocol combination of each packet.

31. The device of claim 29, where the set of invariant header fields includes a source address field, a destination address field, and at least one additional invariant header field selected from an identifier and a sequence number.

32. The device of claim 29, where the one or more processors are further to:

apply a hash function to the minimal set of invariant header fields for each packet to determine the packet signature for each packet in the first subset and the second subset.

33. The device of claim 29, where a first timestamp is assigned to each packet in the first subset, a second timestamp is assigned to each packet in the second subset, and the one or more processors are further to:

compare a first timestamp and a second timestamp of matching packets in the first subset and the second subset to determine a latency between the first location and the second location in the network.

34. A system, comprising:

one or more devices to;

receive a first subset of a first plurality of packets,

the first plurality of packets being associated with a first location in a network;

receive a second subset of a second plurality of packets,

the second plurality of packets being associated with a second location in the network, and

the second location being different than the first location;

parse each packet in the first subset and the second subset to extract invariant header fields from an outermost header until a minimal set of invariant header fields is obtained, for each packet, that uniquely identifies each packet throughout the network;

determine a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset; and

compare packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset.

35. The system of claim 34, where the one or more devices are further to:

apply a hash function to the minimal set of invariant header fields for each packet to determine the packet signature for each packet in the first subset and the second subset.

36. The system of claim 34, where a first timestamp is assigned to each packet in the first subset, a second timestamp is assigned to each packet in the second subset, and the one or more devices are further to:

compare a first timestamp and a second timestamp of matching packets in the first subset and the second subset to determine a latency between the first location and the second location in the network.

37. The system of claim 34, where:

at least some of the packets in the first subset have different protocol combinations,

at least some of the packets in the second subset have different protocol combinations, and

the minimal set of invariant header fields for each packet in the first subset and the second subset depends on the protocol combination of each packet.

38. The system of claim 34, where the minimal set of invariant header fields includes a source address field, a destination address field, and at least one additional invariant header field selected from an identifier and a sequence number.

39. The system of claim 34, where:

the first subset and the second subset are selected based on a filter,

the filter including a first filter condition based on a first invariant header field selected from an identifier and a sequence number, and

the first filter condition defining at least one of an entire identifier, an entire sequence number, a subset of the identifier, or a subset of the sequence number.