Packet flow identification with reduced decode operations

A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations, the operations comprising:

• obtaining a first packet including a first header from a network tap deployed on at least one link of a telecommunication network;
• decapsulating a plurality of fields of the first header, the plurality of fields including a tunnel identifier field, a source port identifier field, and at least one additional field;
• determining a first tunnel identifier from the tunnel identifier field, a first source port identifier from the source port identifier field, and a first value from the at least one additional field;
• assigning the first packet to a first flow based on the first tunnel identifier, the first source port identifier, and the first value;
• determining an offset of the tunnel identifier field and an offset of the source port identifier field;
• obtaining a second packet including a second header from the network tap;
• extracting a second value from a tunnel identifier field of the second header using the offset of the tunnel identifier field and a third value from a source port identifier field of the second header using the offset of the source port identifier field, without decapsulating the second packet;
• determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier;
• assigning the second packet to the first flow in response to the determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier, wherein the assigning is performed without determining whether any values associated with any additional fields of the second header in addition to the tunnel identifier field and the source port identifier field match any identifiers of the plurality of fields in addition to the tunnel identifier field and the source port identifier field of the first packet;
• obtaining a third packet including a third header;
• extracting at least one value from a field of the third header in accordance with at least one of the offset of the tunnel identifier field or the offset of the source port identifier field;
• determining that the at least one value does not match the at least one of the first tunnel identifier or the first source port identifier;
• and
• determining that the third packet does not belong to the first flow in response to the determining that the at least one value does not match the at least one of the first tunnel identifier or the first source port identifier.

A device comprising:

• a processing system including at least one processor;
• and
• a non-transitory computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising:
• obtaining a first packet including a first header from a network tap deployed on at least one link of a telecommunication network;
• decapsulating a plurality of fields of the first header, the plurality of fields including a tunnel identifier field, a source port identifier field, and at least one additional field;
• determining a first tunnel identifier from the tunnel identifier field, a first source port identifier from the source port identifier field, and a first value from the at least one additional field;
• assigning the first packet to a first flow based on the first tunnel identifier, the first source port identifier, and the first value;
• determining an offset of the tunnel identifier field and an offset of the source port identifier field;
• obtaining a second packet including a second header from the network tap;
• extracting a second value from a tunnel identifier field of the second header using the offset of the tunnel identifier field and a third value from a source port identifier field of the second header using the offset of the source port identifier field, without decapsulating the second packet;
• determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier;
• assigning the second packet to the first flow in response to the determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier, wherein the assigning is performed without determining whether any values associated with any additional fields of the second header in addition to the tunnel identifier field and the source port identifier field match any identifiers of the plurality of fields in addition to the tunnel identifier field and the source port identifier field of the first packet;
• obtaining a third packet including a third header;
• extracting at least one value from a field of the third header in accordance with at least one of the offset of the tunnel identifier field or the offset of the source port identifier field;
• determining that the at least one value does not match the at least one of the first tunnel identifier or the first source port identifier;
• and
• determining that the third packet does not belong to the first flow in response to the determining that the at least one value does not match the at least one of the first tunnel identifier or the first source port identifier.