Field content based packet classification
OwnerTeresa Buckley, Ellen Deleganes +3inventors
InventorsTeresa Buckley, Ellen Deleganes, Shuchi Chawla, Vijay Kesavan, Gamil Cain
Life of this patent
Estimating the term…
Abstract
An ordered classification procedure includes receiving a packet including a plurality of packet fields having corresponding field values. At least some of the packet fields are parsed to extract at least some of the field values of the packet. The extracted field values are examined using the ordered classification procedure to classify the packet into a flow. An order of the field examinations scheduled within the ordered classification procedure to examine the field values is based at least in part on the field values themselves.
Claims21
A method, comprising:
- receiving a packet including a plurality of packet fields having corresponding field values;
- parsing at least some of the packet fields to extract at least some of the field values;
- and
- examining the at least some of the field values based on an ordered classification procedure to classify the packet into a flow, wherein an order of field examinations scheduled within the ordered classification procedure to examine the field values is based at least in part on a number of dependent field examinations depending from each of the field examinations.
A machine-accessible medium that provides instructions that, if executed by a machine, will cause the machine to perform operations comprising:
- receiving packets each including a plurality of packet fields having corresponding field values;
- parsing at least some of the packet fields of each of the packets to extract at least some of the field values;
- and
- examining the at least some of the field values based on an ordered classification procedure to classify the packets into flows, wherein an order of field examinations scheduled within the ordered classification procedure to examine the field values of each of the packets is based at least in part on the field values themselves.
A network processing system, comprising:
- a processing engine to execute instructions;
- a network interface coupled to the processing engine;
- and
- a hard disk coupled to the processing engine, the hard disk providing instructions that, if executed by the processing engine, will cause the processing engine to perform operations comprising:
- receiving a packet including a plurality of packet fields having corresponding field values;
- parsing at least some of the packet fields to extract at least some of the field values;
- and
- examining the at least some of the field values based on an ordered classification procedure to classify the packet into a flow, wherein an order of field examinations scheduled within the ordered classification procedure to examine the field values is based at least in part on a packet type prevalence in a packet stream to be classified.
Dependencies are inferred from the claim text.