Multiplex communications – Pathfinding or routing – Switching a message which includes an address header
Reexamination Certificate
2000-06-12
2003-11-25
Pezzlo, John (Department: 2662)
Multiplex communications
Pathfinding or routing
Switching a message which includes an address header
C370S429000, C370S395100, C709S240000
Reexamination Certificate
active
06654373
ABSTRACT:
TECHNICAL FIELD OF THE INVENTION
The present invention relates to broadband data networking equipment. Specifically, the present invention relates to a network device that classifies and modifies traffic based on protocol, destination, source and payload content.
BACKGROUND OF THE INVENTION
The character and requirements of networks and networking hardware are changing dramatically as the demands on networks change. Not only is there an ever-increasing demand for more bandwidth, the nature of the traffic flowing on the networks is changing. With the demand for video and voice over the network in addition to data, end users and network providers alike are demanding that the network provide services such as quality-of-service (QoS), traffic metering, and enhanced security. However, the existing Internet Protocol (IP) networks were not designed to provide such services because of the limited information they contain about the nature of the data passing over them.
Existing network equipment that makes up the infrastructure was designed only to forward data through the network's maze of switches and routers without any regard for the nature of the traffic. The equipment used in existing networks, such as routers, switches, and remote access servers (RAS), are not able to process any information in the network data stream beyond the packet headers and usually only the headers associated with a particular layer of the network or with a set of particular protocols. Inferences can be made about the type of traffic by the particular protocol, or by other information in the packet header such as address or port numbers, but high-level information about the nature of the traffic and the content of the traffic is impossible to discern at wire speeds.
In order to better understand packet processing and the deficiencies of existing network equipment it is helpful to have an understanding of its basic operation. The functionality of most network equipment can be broken down into four basic components. The first component is the physical layer interface (PHY layer) which converts an analog waveform transmitted over a physical medium such as copper wire pairs, coaxial cable, optical fiber, or air, into a bit stream which the network equipment can process, and vise versa. The PHY layer is the first or last piece of silicon that the network data hits in a particular device, depending on the direction of traffic. The second basic functional component is the switch fabric. The switch fabric forwards the traffic between the ingress and egress ports of a device across the bus or backplane of that device. The third component is host processing, which can encompass a range of operations that lie outside the path of the traffic passing thought a device. This can include controlling communication between components, enabling configuration, and performing network management functions. Host processors are usually off-the-shelf general purpose RISC or CISC microprocessors.
The final component is the packet processing function, which lies between the PHY layer and the switch fabric. Packet processing can be characterized into two categories of operation, those classified as fast-path and those classified as slow-path. Fast-path operations are those performed on the live data stream in real time. Slow-path operations are performed outside the flow of traffic but are required to forward a portion of the packets processed. Slow-path operations include unknown address resolution, route calculation, and routing and forwarding table updates. Some of the slow-path operations can be performed by the host processor if necessary.
For a piece of network equipment to be useful and effective, the vast majority of traffic must be handled on the fast-path in order to keep up with network traffic and to avoid being a bottleneck. To keep up with the data flow fast-path operations have always been limited both in number and in scope. There are five basic operations that have traditionally been fast-path operations: framing/parsing, classification, modification, encryption/compression, and queuing.
Traditionally the fast-path operations have been performed by a general purpose microprocessor or custom ASICs. However, in order to provide some programmability while maintaining speed requirements, many companies have recently introduced highly specialized network processors (NPUs) to operate on the fast-path data stream. While NPUs are able to operate at the same data rates as ASICs, such as OC-12, OC-48 and OC-192, they provide some level of programmability. Even with state of the art NPUs, however, fast-path operations must still be limited to specific, well-defined operations that operate only on very specific fields within the data packets. None of the current network devices, even those employing NPUs, are able to delve deep into a packet, beyond simple header information and into the packet contents while on the fast-path of data flow. The ability to look beyond the header information while still in the fast-path and into the packet contents would allow a network device to identify the nature of the information carried in the packet, thereby allowing much more detailed packet classification. Knowledge of the content would also allow specific contents to be identified and scanned to provide security such as virus detection, denial of service (DoS) prevention, etc. Further, looking deeper into the data packets and being able to maintain an awareness of content over an entire traffic flow would allow for validation of network traffic flows, and verification of network protocols to aid in the processing of packets down stream.
Accordingly, what is needed is a network device that can look beyond simple header information and into the packet contents or payload, to be able to scan the payload on the fast-path at wire speeds beyond 1 gigabit per second, and to be able to maintain state information or awareness throughout an entire data traffic flow.
SUMMARY OF THE INVENTION
The present invention provides for a network device or apparatus that is able to scan the entire contents of data packets forming a network data flow. The network device consists of a traffic flow scanning processor, or engine, operable to scan the contents of any or all data packets received from the network. The contents of the data packet include both the header information and the payload contents. The traffic flow scanning processor can be divided into a header processor and a payload analyzer. The header processor is capable of scanning the header information, determining routing requirements based on the header information, and creating a unique session id based on predetermined attributes of the data packet for identifying each individual active traffic flow within the network apparatus. The payload analyzer scans the contents of data packet's payload and attempts to match the payload contents against a database of known strings. If a match is detected in the payload analyzer, the network apparatus is operable to perform a variety of programmable functions on the data packet or on the particular traffic flow to which the data packet is associated. In addition, the traffic flow scanning processor is able to maintain state awareness across each individual traffic flow.
In addition to the traffic flow scanning processor the network apparatus includes a quality of service processor. The quality of service processor is connected to the traffic flow scanning engine and receives the scanned data packets along with one or more conclusions or instructions from the scanning engine associated with each data packet. The quality of service processor is then operable to place each data packet into one of a plurality of quality of service queues according to the associated conclusions. The quality of service queue determines the priority of the associated data for transmission back onto the network. In addition to the quality of service queues for traffic management and traffic shaping, the quality of service processor includes a packet modification engine
Bennett Victor A.
Brandon Kevin William
Garrow Corey Alan
Hervin Mark Warden
Lie Milton Andre
Cox Craig J.
Netrake Corporation
Pezzlo John
LandOfFree
Content aware network apparatus does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Content aware network apparatus, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Content aware network apparatus will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3176775