# US 2023/0054961 A1 · Collecting and analyzing data regarding flows associated with dpi parameters > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0054961 A1 - Document ID: US20230054961A1 - Status: Published application - Kind: A1 - Application number: 17/976,784 - Filed: 2022-10-29 - Published: 2023-02-23 - Earliest claimed: 2019-12-12 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Navaneeth Krishnan Ramaswamy; Ganesh Srinivasan - Web page: https://patentgrep.com/patent/US20230054961A1 ## CPC - H04L 43/026: using flow identification - H04L 41/142: using statistical or mathematical methods - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 45/38: {Flow based routing} - H04L 47/22: Traffic shaping - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2483: involving identification of individual flows - H04L 47/36: by determining packet size, e.g. maximum transfer unit [MTU] - H04L 41/5003: Managing SLA; Interaction between SLA and QoS - H04L 43/16: Threshold monitoring - H04L 47/11: Identifying congestion - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some embodiments provide a method for performing deep packet inspection (DPI) for an SD-WAN (software defined, wide area network) established for an entity by a plurality of edge nodes and a set of one or more cloud gateways. At a particular edge node, the method uses local and remote deep packet inspectors to perform DPI for a packet flow. Specifically, the method initially uses the local deep packet inspector to perform a first DPI operation on a set of packets of a first packet flow to generate a set of DPI parameters for the first packet flow. The method then forwards a copy of the set of packets to the remote deep packet inspector to perform a second DPI operation to generate a second set of DPI parameters. In some embodiments, the remote deep packet inspector is accessible by a controller cluster that configures the edge nodes and the gateways. In some such embodiments, the method forwards the copy of the set of packets to the controller cluster, which then uses the remote deep packet inspector to perform the remote DPI operation. The method receives the result of the second DPI operation, and when the generated first and second DPI parameters are different, generates a record regarding the difference. ## Claims ### Claim at position 1 1-19. (canceled) ### Claim 20 For an SD-WAN (software defined, wide area network) established by a plurality of edge nodes and a set of one or more cloud gateways, a method of using deep packet inspection (DPI) to control packet flows through the WAN, the method comprising: at a server, identifying, from sets of parameters collected for packet flows processed by a first set of two or more edge nodes for which DPI operations were performed, a subset of parameters associated with a plurality of flows relating to a particular application identifier specified by the DPI operations; analyzing the identified subset of parameters to identify at least one packet flow with an undesirable path through the WAN; and distributing adjusted forwarding records to a second set of one or more edge nodes to modify paths used by the second set of edge nodes for flows associated with the particular application identifier. ### Claim 21 (depends on 20) The method of claim 20, wherein at least a subset of the DPI operations is performed at the edge nodes. ### Claim 22 (depends on 20) The method of claim 20, wherein at least a subset of the DPI operations is performed at a physical location that is remote form physical locations at which the first set of edge nodes operate. ### Claim 23 (depends on 20) The method of claim 20, wherein the collected sets of parameters comprise operational metrics relating to a set of packet flows processed by the edge nodes. ### Claim 24 (depends on 23) The method of claim 23, wherein at least a set of the operational metrics are collected at the set of edge nodes. ### Claim 25 (depends on 23) The method of claim 23, wherein at least a set of the operational metrics are collected by at least one gateway. ### Claim 26 (depends on 20) The method of claim 20, wherein analyzing the identified subset of parameters comprises determining durations of time for packets in each of a plurality of packet flows to traverse from a source edge node of the flow through the WAN to reach a destination edge node of the flow. ### Claim 27 (depends on 20) The method of claim 20, wherein analyzing the identified subsets of parameters comprises determining durations of time for packets in each flow in a plurality of packet flows to traverse though a gateway to reach a destination edge node for the flow. ### Claim 28 (depends on 20) The method of claim 20, wherein a first node initially receives a first forwarding record and then receives a second forwarding record; based on the first forwarding record, the first node forwards a first packet flow through a first gateway before receiving the second forwarding record; and based on the second forwarding record, the first node stops forwarding the first packet flow through the first gateway and instead forwards the first packet flow through a second gateway. ### Claim 29 (depends on 20) The method of claim 20, wherein a first node initially receives a first forwarding record and then receives a second forwarding record; based on the first forwarding record, the first node uses a first gateway to forward a first packet flow associated with a first DPI parameter to a first destination of the first packet flow; and based on the second forwarding record, the first node uses a second gateway to forward a second packet flow associated with the first DPI parameter to a second destination of the second packet flow. ### Claim 30 (depends on 20) The method of claim 20, wherein the first and second destinations are the same destination. ### Claim 31 (depends on 20) The method of claim 20, wherein the first set of edge nodes is a subset of the second set of edge nodes. ### Claim 32 (depends on 31) The method of claim 31, wherein the second set of edge nodes includes at least one edge node not in the first set. ### Claim 33 (depends on 20) The method of claim 20 further comprising collecting parameters from the edge nodes in the first set, wherein the collected parameters comprise statistics collected by the edge nodes in the first set. ### Claim 34 (depends on 20) The method of claim 20 further comprising collecting parameters from a set of gateways, wherein the collected parameters comprise statistics collected by the gateways in the set. ### Claim 35 (depends on 20) The method of claim 20 further comprising: receiving, for each of a plurality of flow passing through the WAN, packets collected by the source and destination edge nodes and parameters associated with the collected packets. ### Claim 36 (depends on 35) The method of claim 35, wherein the collected packets comprise packets associated with a particular application identifier specified by DPI operations that were performed for the collected packets. ### Claim 37 (depends on 36) The method of claim 36, wherein the DPI operations are performed at both source and destination edge nodes. ### Claim 38 (depends on 36) The method of claim 36, wherein the DPI operations are performed at the source edge node and the application identifiers are provided by the source edge nodes to the destination edge nodes ### Claim 39 (depends on 36) The method of claim 36, wherein the number of collected packets for a flow relate to number of packets needed for the DPI operation on the flow.