Method for automatically classifying traffic in a packet communications network

• US 6,412,000 B1
• Filed: 11/23/1998
• Issued: 06/25/2002
• Est. Priority Date: 11/25/1997
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Packeteer Incorporated (Gen Digital Inc.)
• Inventors: Riddle, Guy, Packer, Robert L.
• Primary Examiner(s): Maung, Zarni
• Assistant Examiner(s): Barot, Bharat
• Application Number:
  US09/198,090
• Time in Patent Office: 1,310 Days
• Field of Search: 709/223-226, 709/230, 709/235-236, 709/238-239, 709/242, 709/246, 370/229-230, 370/235, 370/252-253, 370/355-356, 370/401, 370/466-469
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 65/613 for the control of the source by the destination control signals issued by the client directed to the server or network components specially adapted for selective content distribution H04N21/637
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

In a packet communication environment, a method is provided for automatically classifying packet flows for use in allocating bandwidth resources by a rule of assignment of a service level. The method comprises applying individual instances of traffic classification paradigms to packet network flows based on selectable information obtained from a plurality of layers of a multi-layered communication protocol in order to define a characteristic class, then mapping the flow to the defined traffic class. It is useful to note that the automatic classification is sufficiently robust to classify a complete enumeration of the possible traffic.

Claims

1. A method for automatically classifying traffic in a packet communications network, said network having any number of flows, including zero, comprising the steps of:

parsing a packet into a first flow specification, wherein said first flow specification contains at least one instance of any one of the following;

a protocol family designation,

a direction of packet flow designation,

a protocol type designation,

a pair of hosts,

a pair of ports,

in HTTP protocol packets, a pointer to a MIME type;

thereupon,

matching the first flow specification of the parsing step to a plurality of classes represented by a plurality nodes of a classification tree type, each said classification tree type node having a traffic specification;

thereupon,

if a matching classification tree type node was not found in the matching step, associating said first flow specification with one or more newly-created classification tree type nodes;

thereupon,

incorporating said newly-created classification tree type nodes into said plurality of classification tree type nodes.

2. The method of claim 1 further comprising the steps of:

for at least a second flow having a second flow specification, recognizing said second flow specification and said first flow specification to comprise together a service aggregate;

thereupon,

associating said first flow specification and said second flow specification with a newly-created classification tree node, said newly-created classification tree type node having a first traffic specification corresponding to said first flow specification and a second traffic specification corresponding to said second flow specification.

3. The method of claim 1 further comprising the steps of:

applying policies from said newly-created classification tree type nodes to instances of detected traffic.

4. The method of claim 1 further comprising the steps of:

for a subclassification under a specified criterion, if a matching classification tree type node was found in the matching step, said matching classification tree type node having at least one child classification tree type node, applying the matching, associating, and incorporating steps to a particular child classification tree type node of said matching classification tree type node as a part of classification.

5. The method of claim 1 wherein the parsing step further comprises the steps of:

examining data contained within a plurality of component packets belonging to said first flow for any number of a plurality of indicators of any of the following;

a protocol;

a service;

thereupon, matching said plurality of indicators to said classes represented by a plurality of said classification tree type nodes.

6. The method of claim 1 further including measuring traffic load and invoking said classification upon achievement of a minimum usage threshold.

7. The method according to claim 1 wherein said matching step is applied to hierarchically-recognized classes.

8. A system for automatically classifying traffic in a packet telecommunications network, said network having any number of flows, including zero, comprising:

a plurality of network links upon which said traffic is carried;

a network routing means; and

,

a processor means operative to;

parse a packet into a first flow specification, wherein said first flow specification contains at least one instance of any one of the following;

a protocol family designation,

a direction of packet flow designation,

a protocol type designation,

a pair of hosts,

a pair of ports,

in HTTP protocol packets, a pointer to a MIME type;

thereupon,

match the first flow specification of the parsing step to a plurality of classes represented by a plurality of said classification tree type nodes, each said classification tree type node having a traffic specification and a mask, according to the mask;

thereupon,

if a matching classification tree type node was not found in the matching step, associating said first flow specification with one or more newly-created classification tree type nodes;

thereupon, incorporating said newly-created classification tree type nodes into said plurality of said classification tree type nodes.

9. The method of claim 8 further including measuring traffic load and invoking said classification upon achievement of a minimum usage threshold.

10. The method according to claim 8 wherein said matching step is applied to hierarchically-recognized classes.

11. A method for classifying traffic in a packet telecommunications network, said network having any number of flows, including zero, comprising the steps of:

parsing a packet into a first flow specification, wherein said first flow specification contains at least one instance of any one of the following;

a protocol family designation,

a direction of packet flow designation,

a protocol type designation,

a pair of hosts,

a pair of ports,

in HTTP protocol packets, a pointer to a MIME type;

thereupon,

matching the first flow specification of the parsing step to a plurality of classes represented by a plurality of classification tree type nodes, each said classification tree type node having a traffic specification;

thereupon,

if a matching classification tree type node was not found in the matching step, associating said first flow specification with at least one more newly-created node;

thereupon,

displaying to a network administrator a representation of traffic according to said traffic specification for use in manual intervention.

12. The method according to claim 11 further including the step of sorting said traffic representation according to most recently occurring.

13. The method according to claim 11 further including the step of sorting said traffic representation according to most data transferred for a preselected period of time.

14. The method of claim 11 further including measuring traffic load and invoking said classification upon achievement of a minimum usage threshold.

15. The method according to claim 11 wherein said matching step is applied to hierarchically-recognized classes.