US 7,002,974 B1 · Learning state machine for use in internet protocol networks

Abstract

A network processing system is described that is able to scan the entire contents of data packets passing through it, and to associate related data packets into discrete sessions, or flows. This ability allows the network processing system to learn characteristics of flows and events contained within those flows. Further, the network processing system can remember characteristics and events that have already been learned for use in processing future data packets. And finally, the network processing system can apply treatments to individual data packets and flows based on the characteristics and events learned, as well as previous state that has been maintained for that flow. To accomplish this, the network processing system includes processing engines, referred to as learning state machines, that scan the entire contents of data packets, use specific information in the data packets to associate the data packet with a particular session, or flow, identify characteristics of the data packet and associated flow, as well as events contained within the flow, store a state for the flow that contains the characteristics and events already learned, and determine a treatment for the data packet based on its contents and flow state.

Claims17

Dependent claims

A network processing system for use in a network, the network passing a plurality of data packets, which form a plurality of flows, the network processing system comprising:

a network interface operable to receive data packets from the network and further operable to send processed data packets back onto the network;
and
a learning state machine in communication with the network interface, the learning state machine operable to learn and maintain state for particular flows based on content of respective flows, wherein the learning state machine assigns an identifier to one or more of the particular flows and associates each data packet belonging to that flow with the identifier, the learning state machine further operable to identify characteristics of one or more of the particular flows and to store those characteristics in a state database in the learning state machine such that the network processing system is able to treat the data packets based on the state of the associated flow.

A network processing system for use in a network, the network consisting of multiple flows each flow formed by multiple data packets, the network processing system comprising:

at least one left line interface operable to receive data packets from the network and to send processed data packets onto the network;
at least one right line interface operable to receive data packets from the network and to send processed data packets onto the network;
a right learning state machine receiving data packets from the left interface, and sending processed data packets to the right line interface;
and
a left learning state machine receiving data packets from the right interface, and sending processed data packets to the left line interface;
each of the right and left learning state machines further comprising:
a traffic flow processor processing the data packets to associate each data packet with a particular flow, to maintain state for each flow, and to compare one or more flows to a database of known signatures, such that a match with one or more signatures within the database of known signatures causes the network processing system to apply a treatment to the flow;
a quality of service processor communicating with the traffic flow processor and receiving the treatment, such that the quality of service processor uses the treatment to determine the handling of the data packets and their associated flow.

5 more elements

Dependencies are inferred from the claim text.

Learning state machine for use in internet protocol networks

Life of this patent

Learning state machine for use in internet protocol networks

Life of this patent

Abstract

Claims17