Prioritized data capture, classification and filtering in a network monitoring environment

• US 6,633,835 B1
• Filed: 01/11/2002
• Issued: 10/14/2003
• Est. Priority Date: 01/10/2002
• Status: Expired due to Term

• Current Assignee: Network General Technology
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Liubinskas, Tauras, Moran, Mike, Goral, Jack
• Primary Examiner(s): Hoff, Marc S.
• Assistant Examiner(s): SUAREZ, FELIX E
• Application Number:
  US10/046,027
• Time in Patent Office: 641 Days
• Field of Search: 702/179, 702/180, 702/181, 702/182, 702/183, 702/188, 702/189, 702/190, 709/108, 709/226, 395/183
• US Class Current: 702/190
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2458 Modification of priorities while in transit
• CPC Class Codes: H04L 47/29 using a combination of thresholds
• CPC Class Codes: H04L 47/326 with random discard, e.g. random early discard [RED]
• CPC Class Codes: H04L 47/745 Reaction in network
• CPC Class Codes: H04L 47/762 triggered by the network
• CPC Class Codes: H04L 49/90 Buffering arrangements

Abstract

A system, method and computer program product are provided for adaptive priority data filtering. Data is collected from a network segment and classified into multiple flows. The flows are prioritized into high and low priority flows. High priority flows are stored in a high priority queue prior to processing, while low priority flows are stored in a low priority queue prior to processing. An amount of data in the high priority flows is monitored. Buffers from the low priority queue are reallocated to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold.

Claims

1. A method for priority data filtering, comprising:

collecting data from a network segment;

classifying the data into multiple flows;

prioritizing the flows into high and low priority flows;

storing high priority flows in a high priority queue prior to processing;

storing low priority flows in a low priority queue prior to processing;

monitoring an amount of data in the high priority flows;

reallocating buffers from the low priority queue to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold; and

randomly removing flows from the high priority queue.

2. The method as recited in claim 1, further comprising reallocating buffers from the high priority queue to the low priority queue if the amount of data in the high priority flows is below a predetermined threshold.

3. The method as recited in claim 1, further comprising selectively removing flows from the high priority queue based on predetermined criteria.

4. The method as recited in claim 1, further comprising identifying a flow of data as being important, and forwarding additional data from the identified flow for processing.

5. The method as recited in claim 1, wherein prioritizing the flows includes matching packets to a set of matching priority filter criteria.

6. A method for priority data filtering, comprising:

collecting data from a network segment;

classifying the data into multiple flows;

prioritizing the flows into high and low priority flows;

storing high priority flows in a high priority queue prior to processing;

storing low priority flows in a low priority queue prior to processing;

monitoring an amount of data in the high priority flows;

reallocating buffers from the low priority queue to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold; and

declassifying inactive flows.

7. A computer program product for priority data filtering, comprising:

computer code for collecting data from a network segment;

computer code for classifying the data into multiple flows;

computer code for prioritizing the flows into high and low priority flows;

computer code for storing high priority flows in a high priority queue prior to processing;

computer code for storing low priority flows in a low priority queue prior to processing;

computer code for monitoring an amount of data in the high priority flows;

computer code for reallocating buffers from the low priority queue to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold; and

computer code for randomly removing flows from the high priority queue based on predetermined criteria.

8. A computer program product for priority data filtering, comprising:

computer code for collecting data from a network segment;

computer code for classifying the data into multiple flows;

computer code for prioritizing the flows into high and low priority flows;

computer code for storing high priority flows in a high priority queue prior to processing;

computer code for storing low priority flows in a low priority queue prior to processing;

computer code for monitoring an amount of data in the high priority flows;

computer code for reallocating buffers from the low priority queue to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold; and

computer code for declassifying inactive flows.

9. The computer program product as recited in claim 8, further comprising reallocating buffers from the high priority queue to the low priority queue if the amount of data in the high priority flows is below a predetermined threshold.

10. The computer program product as recited in claim 8, further comprising selectively removing flows from the high priority queue based on predetermined criteria.

11. The computer program product as recited in claim 8, further comprising identifying a flow of data as being important, and using the identification as criteria for forwarding additional data from the identified flow for processing.

12. The computer program product as recited in claim 8, wherein prioritizing the flows includes matching packets to a set of matching priority filter criteria.

13. A system for adaptive priority data filtering, comprising:

(a) logic for collecting data from a network segment;

(b) logic for classifying the data into multiple flows;

(c) logic for prioritizing the flows into high and low priority flows;

(d) logic for storing high priority flows in a high priority queue prior to processing;

(e) logic for storing low priority flows in a low priority queue prior to processing;

(f) logic for monitoring an amount of data in the high priority flows; and

(g) logic for reallocating buffers from the low priority queue to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold

(h) logic for randomly removing flows from the high priority queue.

14. A method for priority data filtering, comprising:

allocating all buffers to a low priority queue;

collecting data from a network segment;

storing the collected data in the low priority queue;

classifying the data into multiple flows;

prioritizing the flows into high and low priority flows;

storing high priority flows in a high priority queue prior to processing;

storing low priority flows in the low priority queue prior to processing;

monitoring an amount of data in the high priority flows;

reallocating buffers from the low priority queue to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold; and

processing data in both the high and low priority queues.

15. The method as recited in claim 14, further comprising randomly relegating high priority flows from the high priority queue to the low priority queue if the amount of data in the high priority queue surpasses a predetermined threshold.

16. The method as recited in claim 15, further comprising removing inactive high priority flows from the high priority queue.

17. A method for adaptive priority data filtering, comprising:

(a) allocating all buffers to a low priority queue;

(b) collecting data from a network segment;

(c) storing the collected data in the low priority queue;

(d) classifying the data into multiple flows;

(e) prioritizing the flows into high and low priority flows;

(f) storing high priority flows in a high priority queue prior to processing;

(g) storing low priority flows in the low priority queue prior to processing;

(h) monitoring an amount of data in the high priority flows;

(i) reallocating buffers from the low priority queue to the high priority queue if the

amount of data in the high priority flows surpasses a predetermined threshold;

(j) processing data in both the high and low priority queues;

(k) randomly relegating high priority flows from the high priority queue to the low priority queue if the amount of data in the high priority queue surpasses a predetermined threshold;

(l) removing inactive high priority flows from the high priority queue;

(m) reallocating buffers from the high priority queue to the low priority queue if the amount of data in the high priority flows is below a predetermined threshold; and

(n) identifying a flow of data as being important, and using the identification as criteria for forwarding additional data from the identified flow for processing.

18. A method for adaptive priority data filtering, comprising:

collecting data from a network segment;

classifying the data into multiple flows;

prioritizing the flows into high and low priority flows;

storing high priority flows in a high priority queue prior to processing;

storing low priority flows in a low priority queue prior to processing;

monitoring an amount of data in the high priority flows;

reallocating buffers from the low priority queue to the high priority queue if the amount of data in the high priority flows surpasses a predetermined threshold; and

randomly relegating high priority flows from the high priority queue to the low priority queue if the amount of data in the high priority queue surpasses a predetermined threshold.