# US 11,444,877 B2 · Packet flow identification with reduced decode operations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,877 B2 - Document ID: US11444877B2 - Status: Granted - Kind: B2 - Application number: 16/356,166 - Filed: 2019-03-18 - Published: 2020-09-24 - Granted: 2022-09-13 - Earliest claimed: 2019-03-18 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Arthur L. Zaifman; John Mark Mocenigo - Web page: https://patentgrep.com/patent/US11444877B2 ## CPC - H04L 47/2483: involving identification of individual flows - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4645: {Details on frame tagging (routing of packets H04L45/00; support for virtual LAN H04L49/354)} - H04L 43/026: using flow identification - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one example, a processing system including at least one processor may obtain a first packet, determine a first tunnel identifier from a tunnel identifier field and a first source port identifier from a source port identifier field of the header of the first packet, and assign the first packet to a first flow. The processing system may further obtain a second packet, extract a first value from a tunnel identifier field and a second value from a source port identifier field of a header of the second packet, determine that the first value matches the first tunnel identifier and that the second value matches the first source port identifier, and assign the second packet to the first flow in response to the determining that the first value matches the first tunnel identifier and that the second value matches the first source port identifier. ## Claims ### Claim 1 A method comprising: obtaining, by a processing system including at least one processor, a first packet including a first header from a network tap deployed on at least one link of a telecommunication network; decapsulating, by the processing system, a plurality of fields of the first header, the plurality of fields including a tunnel identifier field, a source port identifier field, and at least one additional field; determining, by the processing system, a first tunnel identifier from the tunnel identifier field, a first source port identifier from the source port identifier field, and a first value from the at least one additional field; assigning, by the processing system, the first packet to a first flow based on the first tunnel identifier, the first source port identifier, and the first value; determining, by the processing system, an offset of the tunnel identifier field and an offset of the source port identifier field; obtaining, by the processing system, a second packet including a second header from the network tap; extracting, by the processing system, a second value from a tunnel identifier field of the second header using the offset of the tunnel identifier field and a third value from a source port identifier field of the second header using the offset of the source port identifier field, without decapsulating the second packet; determining, by the processing system, that the second value matches the first tunnel identifier and that the third value matches the first source port identifier; assigning, by the processing system, the second packet to the first flow in response to the determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier, wherein the assigning is performed without determining whether any values associated with any additional fields of the second header in addition to the tunnel identifier field and the source port identifier field match any identifiers of the plurality of fields in addition to the tunnel identifier field and the source port identifier field of the first packet; obtaining, by the processing system, a third packet including a third header; extracting, by the processing system, at least one value from a field of the third header in accordance with at least one of: the offset of the tunnel identifier field or the offset of the source port identifier field; determining, by the processing system, that the at least one value does not match the at least one of: the first tunnel identifier or the first source port identifier; and determining, by the processing system, that the third packet does not belong to the first flow in response to the determining that the at least one value does not match the at least one of: the first tunnel identifier or the first source port identifier. ### Claim 2 (depends on 1) The method of claim 1, wherein the first flow is characterized by the first tunnel identifier and the first source port identifier. ### Claim 3 (depends on 1) The method of claim 1, wherein the offset of the tunnel identifier field comprises a number of data units from a start of the first packet to a start of the tunnel identifier field. ### Claim 4 (depends on 3) The method of claim 3, wherein the offset of the source port identifier field comprises a number of bits from a start of the first packet to a start of the source port identifier field. ### Claim 5 (depends on 1) The method of claim 1, further comprising: assigning the third packet to a second flow in response to the determining that the third packet does not belong to the first flow. ### Claim 6 (depends on 5) The method of claim 5, further comprising: determining a second tunnel identifier and a second source port identifier from a plurality of fields of the third header, wherein the second flow is characterized by the second tunnel identifier and the second source port identifier. ### Claim 7 (depends on 1) The method of claim 1, wherein the first tunnel identifier comprises a general packet radio service tunnel identifier. ### Claim 8 (depends on 1) The method of claim 1, wherein the source port identifier field comprises a transport layer protocol header field. ### Claim 9 (depends on 8) The method of claim 8, wherein the transport layer protocol header field comprises: a uniform datagram protocol header field; or a transmission control protocol header field. ### Claim 10 (depends on 1) The method of claim 1, wherein the extracting the second value and the third value from the second header is performed within a defined time window from the assigning of the first packet to the first flow. ### Claim 11 (depends on 10) The method of claim 10, further comprising: reducing the defined time window when a collision probability between the first flow and at least a second flow exceeds a collision probability threshold. ### Claim 12 (depends on 11) The method of claim 11, wherein the collision probability comprises a rate at which packets from the at least the second flow comprising the first tunnel identifier and the first source port identifier are detected within the defined time window. ### Claim 13 A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations, the operations comprising: obtaining a first packet including a first header from a network tap deployed on at least one link of a telecommunication network; decapsulating a plurality of fields of the first header, the plurality of fields including a tunnel identifier field, a source port identifier field, and at least one additional field; determining a first tunnel identifier from the tunnel identifier field, a first source port identifier from the source port identifier field, and a first value from the at least one additional field; assigning the first packet to a first flow based on the first tunnel identifier, the first source port identifier, and the first value; determining an offset of the tunnel identifier field and an offset of the source port identifier field; obtaining a second packet including a second header from the network tap; extracting a second value from a tunnel identifier field of the second header using the offset of the tunnel identifier field and a third value from a source port identifier field of the second header using the offset of the source port identifier field, without decapsulating the second packet; determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier; assigning the second packet to the first flow in response to the determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier, wherein the assigning is performed without determining whether any values associated with any additional fields of the second header in addition to the tunnel identifier field and the source port identifier field match any identifiers of the plurality of fields in addition to the tunnel identifier field and the source port identifier field of the first packet; obtaining a third packet including a third header; extracting at least one value from a field of the third header in accordance with at least one of the offset of the tunnel identifier field or the offset of the source port identifier field; determining that the at least one value does not match the at least one of the first tunnel identifier or the first source port identifier; and determining that the third packet does not belong to the first flow in response to the determining that the at least one value does not match the at least one of the first tunnel identifier or the first source port identifier. ### Claim 14 A device comprising: a processing system including at least one processor; and a non-transitory computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising: obtaining a first packet including a first header from a network tap deployed on at least one link of a telecommunication network; decapsulating a plurality of fields of the first header, the plurality of fields including a tunnel identifier field, a source port identifier field, and at least one additional field; determining a first tunnel identifier from the tunnel identifier field, a first source port identifier from the source port identifier field, and a first value from the at least one additional field; assigning the first packet to a first flow based on the first tunnel identifier, the first source port identifier, and the first value; determining an offset of the tunnel identifier field and an offset of the source port identifier field; obtaining a second packet including a second header from the network tap; extracting a second value from a tunnel identifier field of the second header using the offset of the tunnel identifier field and a third value from a source port identifier field of the second header using the offset of the source port identifier field, without decapsulating the second packet; determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier; assigning the second packet to the first flow in response to the determining that the second value matches the first tunnel identifier and that the third value matches the first source port identifier, wherein the assigning is performed without determining whether any values associated with any additional fields of the second header in addition to the tunnel identifier field and the source port identifier field match any identifiers of the plurality of fields in addition to the tunnel identifier field and the source port identifier field of the first packet; obtaining a third packet including a third header; extracting at least one value from a field of the third header in accordance with at least one of the offset of the tunnel identifier field or the offset of the source port identifier field; determining that the at least one value does not match the at least one of the first tunnel identifier or the first source port identifier; and determining that the third packet does not belong to the first flow in response to the determining that the at least one value does not match the at least one of the first tunnel identifier or the first source port identifier. ### Claim 15 (depends on 1) The method of claim 1, wherein the first packet and the second packet both comprise packets of data plane traffic. ### Claim 16 (depends on 1) The method of claim 1, wherein the network tap copies traffic on a link between components of the telecommunications network. ### Claim 17 (depends on 16) The method of claim 16, wherein the network tap provides traffic that is copied, including the first packet, the second packet, and the third packet, to the processing system. ### Claim 18 (depends on 17) The method of claim 17, wherein the traffic that is copied comprises data plane traffic.