Method for automatically classifying traffic in a packet communications network
AssigneePacketeer, Inc.
InventorsGuy Riddle, Robert L. Packer
Life of this patent
Estimating the term…
Abstract
In a packet communication environment, a method is provided for automatically classifying packet flows for use in allocating bandwidth resources by a rule of assignment of a service level. The method comprises applying individual instances of traffic classification paradigms to packet network flows based on selectable information obtained from a plurality of layers of a multi-layered communication protocol in order to define a characteristic class, then mapping the flow to the defined traffic class. It is useful to note that the automatic classification is sufficiently robust to classify a complete enumeration of the possible traffic.
Claims15
A method for automatically classifying traffic in a packet communications network, said network having any number of flows, including zero, comprising the steps of:
- parsing a packet into a first flow specification, wherein said first flow specification contains at least one instance of any one of the following:
- a protocol family designation,
- a direction of packet flow designation,
- a protocol type designation,
- a pair of hosts,
- a pair of ports,
- in HTTP protocol packets, a pointer to a MIME type;
- thereupon,
- matching the first flow specification of the parsing step to a plurality of classes represented by a plurality nodes of a classification tree type, each said classification tree type node having a traffic specification;
- thereupon,
- if a matching classification tree type node was not found in the matching step, associating said first flow specification with one or more newly-created classification tree type nodes;
- thereupon,
- incorporating said newly-created classification tree type nodes into said plurality of classification tree type nodes.
A system for automatically classifying traffic in a packet telecommunications network, said network having any number of flows, including zero, comprising:
- a plurality of network links upon which said traffic is carried;
- a network routing means;
- and,
- a processor means operative to:
- parse a packet into a first flow specification, wherein said first flow specification contains at least one instance of any one of the following:
- a protocol family designation,
- a direction of packet flow designation,
- a protocol type designation,
- a pair of hosts,
- a pair of ports,
- in HTTP protocol packets, a pointer to a MIME type;
- thereupon,
- match the first flow specification of the parsing step to a plurality of classes represented by a plurality of said classification tree type nodes, each said classification tree type node having a traffic specification and a mask, according to the mask;
- thereupon,
- if a matching classification tree type node was not found in the matching step, associating said first flow specification with one or more newly-created classification tree type nodes;
- thereupon, incorporating said newly-created classification tree type nodes into said plurality of said classification tree type nodes.
A method for classifying traffic in a packet telecommunications network, said network having any number of flows, including zero, comprising the steps of:
- parsing a packet into a first flow specification, wherein said first flow specification contains at least one instance of any one of the following:
- a protocol family designation,
- a direction of packet flow designation,
- a protocol type designation,
- a pair of hosts,
- a pair of ports,
- in HTTP protocol packets, a pointer to a MIME type;
- thereupon,
- matching the first flow specification of the parsing step to a plurality of classes represented by a plurality of classification tree type nodes, each said classification tree type node having a traffic specification;
- thereupon,
- if a matching classification tree type node was not found in the matching step, associating said first flow specification with at least one more newly-created node;
- thereupon,
- displaying to a network administrator a representation of traffic according to said traffic specification for use in manual intervention.
Dependencies are inferred from the claim text.