# US 9,521,083 B2 · Traffic differentiator systems for network devices and related methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,083 B2 - Document ID: US9521083B2 - Status: Granted - Kind: B2 - Application number: 14/164,450 - Filed: 2014-01-27 - Published: 2015-07-30 - Granted: 2016-12-13 - Earliest claimed: 2014-01-27 - Assignees: Anue Systems, Inc. - Applicants: Anue Systems, Inc. - Inventors: Stefan Johansson; David W. McGhee; Shardendu Pandey; Cary J. Wright; Scott Register - Web page: https://patentgrep.com/patent/US9521083B2 ## CPC - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - H04L 43/50: Testing arrangements - H04L 47/28: in relation to timing considerations - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Traffic differentiator systems for network devices and related methods are disclosed that determine difference packets from multiple packet streams. Some embodiments are configured to receive two streams of packets with one stream being a processed version of another stream and then to determine difference packets within a lookup time window that is, for example, associated with a processing time for the second stream to be a processed version of the first stream. Difference packets within a lookup time window can also be determined for packets received within a single combined stream of packets. Difference packets and/or related statistical information is then output for additional processing, as desired. The streams of packets can be associated with ingress and egress packets for a network device, and the difference packets and related statistical information can be used to determine packets that are removed, added, and/or modified by the network device. ## Claims ### Claim 1 A traffic differentiator system for network packets, comprising: a packet difference processor configured to determine difference packets within a lookup time window between a first stream of packets and a second stream of packets received by the traffic differentiator system, the second stream of packets representing a processed version of the first stream of packets, and the lookup time window being associated with a processing time for the second stream to be a processed version of the first stream; and at least one output port configured to output the difference packets, the difference packets comprising packets present in only one of the first and second streams within the lookup time window so as to include only packets within the first stream and not within the second stream and packets within the second stream and not within the first stream. ### Claim 2 (depends on 1) The traffic differentiator system of claim 1, wherein the packet difference processor is further configured to output statistical information about the difference packets. ### Claim 3 (depends on 1) The traffic differentiator system of claim 1, further comprising: at least one input port configured to receive the first stream of packets; and at least one additional input port configured to receive the second stream of packets. ### Claim 4 (depends on 3) The traffic differentiator system of claim 3, wherein the first and second streams of packets are from a single network device. ### Claim 5 (depends on 4) The traffic differentiator system of claim 4, wherein the first stream of packets includes only ingress packets for the network device and the second stream of packets includes only egress packets for the network device. ### Claim 6 (depends on 4) The traffic differentiator system of claim 4, wherein the difference packets represent at least one of packets removed by the network device, packets added by the network device, or packets modified by the network device. ### Claim 7 (depends on 3) The traffic differentiator system of claim 3, further comprising: a packet signature generator associated with each input port and configured to generate a signature for each of a plurality of packets received at the input port; and a signature table associated with each input port and configured to store the signatures, the signature tables being configured to store signatures for the lookup time window. ### Claim 8 (depends on 7) The traffic differentiator system of claim 7, wherein the packet difference processor is further configured to perform for each input port at least one lookup between signatures generated for the packets received at that input port and the signature table associated with at least one other input port and to drop packets where matches are found. ### Claim 9 (depends on 8) The traffic differentiator system of claim 8, wherein the packet difference processor is configured to perform two lookups associated with each input port, and wherein a packet buffer stores packets between the two lookups. ### Claim 10 (depends on 8) The traffic differentiator system of claim 8, wherein the packet difference processor performs one lookup associated with each input port, and wherein a packet buffer stores packets before the lookup. ### Claim 11 (depends on 8) The traffic differentiator system of claim 8, wherein the input ports are configured to receive ingress packets or egress packets but not both, wherein the packet difference processor is configured to perform one lookup associated with each input port, and wherein a packet buffer stores packets for each input port configured to receive ingress packets. ### Claim 12 (depends on 3) The traffic differentiator system of claim 3, further comprising one or more packet filters associated with the input ports and configured to drop or pass packets based upon filter rules. ### Claim 13 (depends on 1) The traffic differentiator system of claim 1, wherein the first stream of packet includes only ingress packets associated with a network device, and wherein the second packet stream includes only egress packets associated with the network device. ### Claim 14 (depends on 13) The traffic differentiator system of claim 13, wherein the packet difference processor is configured to receive a combined packet stream including the first stream of ingress packets and the second stream of egress packets. ### Claim 15 (depends on 14) The traffic differentiator system of claim 14, further comprising an input port configured to receive the combined packet stream. ### Claim 16 (depends on 15) The traffic differentiator system of claim 15, further comprising: a packet signature generator configured to generate a signature for each of a plurality of packets received at the input port; and a signature table configured to store signatures for the lookup time window. ### Claim 17 (depends on 16) The traffic differentiator system of claim 16, wherein the packet difference processor is configured to perform two lookups associated with the input port and to drop packets where matches are found, and wherein a packet buffer stores packets between the two lookups. ### Claim 18 (depends on 15) The traffic differentiator system of claim 15, further comprising one or more packet filters associated with the input port and configured to drop or pass packets based upon filter rules. ### Claim 19 A method for generating difference packets between streams of network packets, comprising: determining difference packets within a lookup time window between a first stream of packets and a second stream of packets received by a traffic differentiator system, the second stream of packets representing a processed version of the first stream of packets, and the lookup time window being associated with a processing time for the second stream to be a processed version of the first stream; and outputting the difference packets, the difference packets comprising packets present in only one of the first and second streams within the lookup time window so as to include only packets within the first stream and not within the second stream and packets within the second stream and not within the first stream. ### Claim 20 (depends on 19) The method of claim 19, further comprising outputting statistical information about the difference packets. ### Claim 21 (depends on 19) The method of claim 19, further comprising: receiving the first stream of packets with at least one input port for the packet differentiator system; and receiving the second stream of packets with at least one additional input port for the packet differentiator system. ### Claim 22 (depends on 21) The method of claim 21, wherein the first and second streams of packets are received from a single network device. ### Claim 23 (depends on 22) The method of claim 22, wherein the first stream of packets include only ingress packets for the network device and the second stream of packets includes only egress packets for the network device. ### Claim 24 (depends on 22) The method of claim 22, wherein the difference packets represent at least one of packets removed by the network device, packets added by the network device, or packets modified by the network device. ### Claim 25 (depends on 21) The method of claim 21, wherein the determining step comprises: generating a signature for each of a plurality of packets received at the input ports; storing the signatures for the lookup time window; and comparing signatures to determine difference packets. ### Claim 26 (depends on 25) The method of claim 25, further comprising performing for each input port at least one lookup between signatures generated for the packets received at that input port and signatures stored for at least one other input port and dropping packets where matches are found. ### Claim 27 (depends on 26) The method of claim 26, wherein two lookups are performed for each input port, and further comprising storing packets between the two lookups. ### Claim 28 (depends on 26) The method of claim 26, wherein one lookup is performed for each input port, and further comprising storing packets before the lookup. ### Claim 29 (depends on 26) The method of claim 26, wherein the input ports are configured to receive ingress packets or egress packets but not both, wherein a lookup is performed at each input port for each other input port, and further comprising storing packets for each input port receiving ingress packets. ### Claim 30 (depends on 21) The method of claim 21, further comprising applying one or more packet filters to drop or pass packets based upon filter rules. ### Claim 31 (depends on 19) The method of claim 19, wherein the first stream of packet includes only ingress packets associated with a network device, and wherein the second packet stream includes only egress packets associated with the network device. ### Claim 32 (depends on 31) The method of claim 31, wherein the first stream of ingress packets and the second stream of egress packets are combined to form a combined packet stream. ### Claim 33 (depends on 32) The method of claim 32, further comprising receiving the combined packet stream at an input port for the packet differentiator system. ### Claim 34 (depends on 33) The method of claim 33, wherein the determining step comprises: generating a signature for each of a plurality of packets received at the input port; storing the signatures for the lookup time window; and comparing signatures to determine difference packets. ### Claim 35 (depends on 34) The method of claim 34, further comprising performing two lookups between signatures generated for the packets received at the input port and stored signatures, and dropping packets where matches are found. ### Claim 36 (depends on 33) The method of claim 33, further applying one or more packet filters to drop or pass packets based upon filter rules.