Coordinated environment for classification and control of network traffic

A coordinated network traffic classification system, comprising

• a first network device operably connected to a first network, wherein the first network comprises at least one host;
• a second network device operably connected to a second network, wherein the second network comprises at least one host;
• a communication path between the first and second network devices;
• wherein the first network device is operative to:
• classify a data flow between a host on the first network and a host on the second network, wherein the data flow comprises at least one packet;
• modify a packet in the data flow by adding traffic class information to the packet in the data flow;
• and
• forward the modified packet including the traffic class information along the communications path to the host on the second network;
• wherein the second network device, comprises a network traffic classification engine operative to classify, independently from the first network device, data flows between the first and second networks, and wherein the second network device, is operative to:
• receive the modified packet including the traffic class information from the first network device;
• use the traffic class information in the modified packet to classify the data flow corresponding to the packet, to bypass operation of one or more matching rules implemented by the network traffic classification engine, wherein each of the one or more matching rules corresponds to a traffic class and comprises one or more matching attributes against which corresponding attributes of the data flows are compared;
• and
• strip the traffic class information from the modified packet.

A method for use in a coordinated network traffic classification system, comprising

• buffering in a memory received first packets traversing in a first direction and second packets traversing in a second direction corresponding to data flows traversing a network path;
• invoking a traffic classification engine operative to classify the data flows in a traffic class from a plurality of traffic classes;
• associating the received first packets and second packets buffered in the memory with corresponding data flows;
• conditionally adding traffic classification information generated by the traffic classification engine to at least one of the first packets in a first data flow;
• causing a second data flow, for which at least one of the second packets includes traffic classification information, to bypass operation of one or more matching rules implemented by the traffic classification engine, wherein each of the one or more matching rules corresponds to a traffic class and comprises one or more matching attributes against which corresponding attributes of the data flows are compared;
• and
• conditionally stripping traffic classification information added to the second packets by remote second network devices;
• forward the first packets including the conditionally added traffic classification information to remote first network devices;
• and
• forwarding the second packets to destination hosts.

A network device, comprising:

• one or more network interfaces;
• a memory;
• a processor;
• and
• computer-executable program code stored in the memory and executable by the processor, the computer-executable program code comprising:
• a packet processor module comprising computer-executable instructions configured, when executed, to cause the processor to process a packet received at the network device, the packet being sent from a source network device to a destination network device along a communication path on which the network device is disposed, comprising:
• determine whether traffic classification information is contained in the packet;
• if the traffic classification information is not contained in the packet, then:
• cause a traffic classification engine module to generate the traffic classification information for the packet;
• add the traffic classification information to the packet;
• and
• cause a flow controller module to forward the packet together with the traffic classification information to a next network device along the communication path;
• and
• if the traffic classification information is contained in the packet, then
• determine whether the next network device along the communication path is the destination network device;
• and
• if the next network device is not the destination network device, then:
• provide the traffic classification information to the traffic classification engine module;
• cause the traffic classification engine module to bypass operation of one or more matching rules corresponding to a traffic class specified in the traffic classification information;
• and
• cause the flow controller module to forward the packet together with the traffic classification information to the next network device along the communication path;
• and
• if the next network device is the destination network device, then:
• remove the traffic classification information from the packet;
• and
• cause the flow controller module to forward the packet without the traffic classification information to the destination network device;
• the traffic classification engine module comprising computer-executable instructions configured, when executed, to cause the processor to:
• determine the traffic class and generate the traffic classification information for the packet based on a data flow to which the packet belongs;
• and
• operate the one or more matching rules corresponding to the traffic class of the packet;
• and
• the flow controller module comprising computer-executable instructions configured, when executed, to cause the processor to forward the packet along the communication path.