# US 11,122,115 B1 · Workload distribution in a data network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,115 B1 - Document ID: US11122115B1 - Status: Granted - Kind: B1 - Application number: 15/844,687 - Filed: 2017-12-18 - Granted: 2021-09-14 - Earliest claimed: 2016-12-19 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Gal Sagie; Eran Gampel - Web page: https://patentgrep.com/patent/US11122115B1 ## CPC - H04L 67/1008: based on parameters of servers, e.g. available memory or workload (monitoring of computer activity G06F11/30) - G06N 3/084: Backpropagation, e.g. using gradient descent - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 45/08: {Learning-based routing, e.g. using neural networks or artificial intelligence} - H04L 45/74: Address processing for routing - H04L 47/2425: for supporting services specification, e.g. SLA - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 49/3063: {Pipelined operation} - H04L 67/1029: using data related to the state of servers by a load balancer - H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 69/22: Parsing or analysis of headers - G06N 20/00: Machine learning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A system for processing packets in a network is provided. The system includes a computing platform running a software framework configured for accessing packets flowing into a packet processing pipeline of a node in the network; and identifying at least one pattern in said packets. Based on this pattern, the systems routes a first portion of the packets into the packet processing pipeline and offloads a second portion of the packets to the computing platform to be processed by the software framework. ## Claims ### Claim 1 A system for processing packets in a network, said system comprising a processor of a computer, said processor configured to execute software instructions to implement a method, said method comprising: accessing, by the processor, multiple packets flowing into a hardware (HW) packet processing pipeline of a node in the network, said hardware packet processing pipeline configured to process the flowing multiple packets by hardware in the hardware packet processing pipeline; identifying, by the processor, multiple patterns in the multiple packets; and based on the identified multiple patterns in the multiple packets, ascertaining for each packet of the multiple packets whether said each packet is to be processed by the hardware in the hardware packet processing pipeline or is to be executed via a software framework by software in a computing platform, wherein the computing platform is distinct from the hardware packet processing pipeline, wherein said ascertaining ascertains that first packets of the multiple packets are identified with a first pattern of the multiple patterns and second packets of the multiple packets are identified with a second pattern of the multiple patterns, wherein the multiple packets consist of the first packets and the second packets, wherein the first packets and the second packets are mutually exclusive, and wherein the first pattern and the second pattern are different patterns; based on said ascertaining, routing, by the processor, the first packets into the hardware packet processing pipeline in which the first packets are processed by the hardware in the hardware packet processing pipeline and offloading the second packets to the computing platform that processes second packets by the software that is executed via the software framework, and wherein said offloading is initiated while the second packets are in the hardware packet processing pipeline and before the second packets can be processed by the hardware in the hardware packet processing pipeline. ### Claim 2 (depends on 1) The system of claim 1, wherein said identifying the at least one pattern comprises classifying the multiple packets flowing into the hardware packet processing pipeline over a time period to identify the at least one pattern. ### Claim 3 (depends on 2) The system of claim 2, wherein said classifying the multiple packets is implemented by a learning engine configured for parsing a header and/or a payload of each packet of the multiple packets. ### Claim 4 (depends on 3) The system of claim 3, wherein the learning engine classifies the multiple packets over time to predict a packet processing efficiency of the hardware packet processing pipeline or the software framework. ### Claim 5 (depends on 1) The system of claim 1, wherein the at least one pattern correlates with a time of day the multiple packets are flowing into the hardware packet processing pipeline. ### Claim 6 (depends on 1) The system of claim 1, wherein the at least one pattern is selected from the group consisting of recurrent volume of traffic, volume per application, application behavior, endpoint locations, statistical security risk, known security attack patterns, short peak volume, client types, protocol health, application health, and user workload statistics. ### Claim 7 (depends on 1) The system of claim 1, wherein the software framework is configured for rerouting packets of the second packets back to the hardware packet processing pipeline of the network. ### Claim 8 (depends on 1) The system of claim 1, wherein the hardware packet processing pipeline includes at least one type of a network device selected from the group consisting of a router, a bridge, a gateway, a firewall, and a switch. ### Claim 9 (depends on 1) The system of claim 1, wherein said routing is effected by an offload manager. ### Claim 10 (depends on 1) The system of claim 1, wherein the at least one pattern identifies packets of the multiple packets not matching routing rules stored by the hardware packet processing pipeline. ### Claim 11 (depends on 1) The system of claim 1, wherein the software framework is configured for routing packets of the second packets processed by the computing platform to a different node in the network. ### Claim 12 (depends on 1) The system of claim 1, wherein the software framework configures the hardware packet processing pipeline or a rule table thereof to handle the first packets based on said identifying. ### Claim 13 (depends on 1) The system of claim 1, wherein the at least one pattern comprises a time based pattern identifying a peak packet flow, and wherein the first packets includes less packets than the second packets. ### Claim 14 (depends on 1) The system of claim 1, wherein the at least one pattern comprises an attack pattern and the software framework modifies the hardware packet processing pipeline and/or the computing platform to include security functions. ### Claim 15 (depends on 1) The system of claim 1, said system comprising a plurality of software framework units, each software framework unit serving a virtual IP address assigned to a plurality of servers. ### Claim 16 (depends on 1) The system of claim 1, wherein the software performs, on the second packets, those hardware functions that would have been performed on the second packets by the hardware in the hardware packet processing pipeline if the second packets was not offloaded and had continued to flow in the hardware packet processing pipeline. ### Claim 17 (depends on 1) The system of claim 1, wherein the hardware in the hardware packet processing pipeline consists of at least three sequentially ordered HW processing units comprising in sequential order: a first HW processing unit, a second HW processing unit, and at least a third HW processing unit, and wherein each packet of the multiple packets entering the HW packet processing pipeline: initially enters the first HW processing unit which parses said each packet; next enters the second HW processing unit which performs said ascertaining for said each packed; and next enters the third HW processing unit if said each packet is ascertained by the second HW processing unit to be identified with the first pattern or enters the computing platform that processes the second packets by the software that is executed via the software framework if said each packet is ascertained by the second HW processing unit to be identified with the second pattern.