Patent Application
20140092900
At least some embodiments of the present invention generally relate to networking, and more particularly, to splitting incoming data into sub-channels to allow parallel processing.
Generally, to monitor and troubleshoot network operations, network traffic packets are captured and analyzed. The amount of data that need to be captured and analyzed can be large in high speed, high traffic volume networks. Because of the large amount of data to analyze and how much computation needs to be done on each packet, a single central processing unit (CPU) core having a limited processing capability cannot handle all of the data needed.
Further, as the network speeds increase it becomes more and more difficult to keep up with the incoming data traffic and analyze the data in a timely manner that reduces network analysis efficiency.
Exemplary embodiments of methods and apparatuses to split incoming data into a plurality of sub-channels to allow parallel processing are described. A packet is received over a network. The packet is compared against a filter. The packet is routed to a process sub-channel in a memory based on the comparing. The process sub-channel is one of the plurality of process sub-channels that are configured to allow parallel processing. In one embodiment, the filter includes user defined criteria for the packet.
Other features of the present invention will be apparent from the accompanying drawings and from the detailed description which follows.
The embodiments as described herein are illustrated by way of example and not limitation in the figures of the accompanying drawings in which like references indicate similar elements.
Exemplary embodiments of methods and apparatuses to split incoming data into a plurality of sub-channels to allow parallel processing are described. Exemplary embodiments of the invention described herein address a high-speed way to distribute a processing load across multiple processors and/or processes.
A packet is received over a network. The packet is compared against a filter. In at least some embodiments, the filter is a network traffic filter. The packet is routed to a process sub-channel in a memory based on the comparing. In at least some embodiments, the packet is compared with the filter. The filter is one of a plurality of filters stored in the memory. The filter matched to the packet is selected from the plurality of filters. In at least some embodiments, the filter includes user defined criteria for the packet. In at least some embodiments, the process sub-channel is one of the plurality of process sub-channels that are configured to allow parallel processing of incoming packet data.
In at least some embodiments, a hash value of at least a portion of the packet is determined. The process sub-channel for the packet data is selected based on the hash value. In at least some embodiments, a network interface at which the packet has been received is determined. A logical channel in a memory corresponding to the network interface is determined for the packet data.
In at least some embodiments, the incoming data stream is split by a network controller that can be, for example, a high performance 1 Gigabit (G) and/or 10 G Ethernet capture card, into multiple data streams (e.g., channels, sub-channels). Splitting the incoming data stream into multiple streams allows parallel processing of the data using, for example, multiple CPUs. In at least some embodiments, the incoming packet data stream is split into sub-channels based on information contained in each packet. In at least some embodiments, the incoming packet data stream is split into sub-channels based on a set of user defined filter criteria (e.g., extended by Berkeley Packet Filters (BPFs) syntax) allowing for increased parallelization and a decrease in processing capacity required to handle increased data rates.
In at least some embodiments, as packets come into a capture card, each packet is tagged for the information including at least one of which port it came in on, which server filters it matches, destined for region A, B or C, and hash of the packets IP address, as described in further detail below. In at least some embodiments, based on this information the packet is routed to a sub-channel that is assigned to at least one of a unique processing core and a process to process and/or analyze.
In at least some embodiments, the filter is a network traffic filter that is generated based on a set of enhanced Berkeley Packet Filters (BPFs) to segment network traffic into different regions, with each region receiving a different level or analysis, as described in further detail below. In at least some embodiments, each packet processed by a network analyzing system is compared against a set of BPFs. Based on the filter that is matched, a packet is assigned to a single region in a memory, as described in further detail below.
Various embodiments and aspects of the inventions will be described with reference to details discussed below, and the accompanying drawings will illustrate the various embodiments. The following description and drawings are illustrative of the invention and are not to be construed as limiting the invention. Numerous specific details are described to provide a thorough understanding of various embodiments of the present invention. It will be apparent, however, to one skilled in the art, that embodiments of the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring embodiments of the present invention. Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. The appearances of the phrase “in one embodiment” in various places in the specification do not necessarily refer to the same embodiment.
Unless specifically stated otherwise, it is appreciated that throughout the description, discussions utilizing terms such as “processing” or “computing” or “calculating” or “determining” or “displaying” or the like, refer to the action and processes of a data processing system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.
Embodiments of the present invention can relate to an apparatus for performing one or more of the operations described herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a machine (e.g.; computer) readable storage medium, such as, but is not limited to, any type of disk, including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), erasable programmable ROMs (EPROMs), electrically erasable programmable ROMs (EEPROMs), magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a bus.
The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required machine-implemented method operations. The required structure for a variety of these systems will appear from the description below.
In addition, embodiments of the present invention are not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of embodiments of the invention as described herein.
Generally, a network refers to a collection of computers and other hardware components interconnected to share resources and information. Networks may be classified according to a wide variety of characteristics, such as the medium used to transport the data, communications protocol used, scale, topology, and organizational scope. Communications protocols define the rules and data formats for exchanging information in a computer network, and provide the basis for network programming. Well-known communications protocols include Ethernet, a hardware and link layer standard that is ubiquitous in local area networks, the Internet protocol (IP) suite, which defines a set of protocols for internetworking, i.e. for data communication between multiple networks, as well as host-to-host data transfer e.g., Transmission Control Protocol (TCP), and application-specific data transmission formats, for example, Hypertext Transfer Protocol (HTTP), a User Datagram Protocol (UDP), Voice over Internet Protocol (VoIP). Methods and apparatuses to split incoming data into a plurality of sub-channels described herein can be used for any of networks, protocols, and data formats.
As shown in
While
It will be apparent from this description that aspects of the present invention may be embodied, at least in part, in software. That is, the techniques may be carried out in a computer system or other data processing system in response to its processor, such as a microprocessor, executing sequences of instructions contained in a memory, such as ROM 107, volatile RAM 105, non-volatile memory 106, or a remote storage device. In various embodiments, hardwired circuitry may be used in combination with software instructions to implement the present invention. Thus, the techniques are not limited to any specific combination of hardware circuitry and software nor to any particular source for the instructions executed by the data processing system. In addition, throughout this description, various functions and operations are described as being performed by or caused by software code to simplify description. However, those skilled in the art will recognize what is meant by such expressions is that the functions result from execution of the code by one or more processing units 103, e.g., a microprocessor, and/or a microcontroller.
A machine readable medium can be used to store software and data which when executed by a data processing system causes the system to perform various methods of the present invention. This executable software and data may be stored in various places including for example ROM 107, volatile RAM 105, and non-volatile memory 106 as shown in
Thus, a machine readable medium includes any mechanism that provides (i.e., stores and/or transmits) information in a form accessible by a machine (e.g.; a computer, network device, cellular phone, personal digital assistant, manufacturing tool, any device with a set of one or more processors, etc.). For example, a machine readable medium includes recordable/non-recordable media (e.g., read only memory (ROM); random access memory (RAM); magnetic disk storage media; optical storage media; flash memory devices; and the like.
The methods of the present invention can be implemented using a dedicated hardware (e.g., using Field Programmable Gate Arrays (FPGAs), or Application Specific Integrated Circuit (ASIC) or shared circuitry (e.g., microprocessors or microcontrollers under control of program instructions stored in a machine readable medium). The methods of the present invention can also be implemented as computer instructions for execution on a data processing system, such as system 100 of
Generally, a FPGA is an integrated circuit designed to be configured by a customer or a designer after manufacturing. The FPGA configuration is generally specified using a hardware description language (HDL). FPGAs can be used to implement a logical function.
FPGAs typically contain programmable logic components (“logic blocks”), and a hierarchy of reconfigurable interconnects to connect the blocks. In most FPGAs, the logic blocks also include memory elements, which may be simple flip-flops or more complete blocks of memory.
In at least some embodiments, a network processing unit, such as network processing unit 302, reads the data to be analyzed off the network. The network processing unit is configured to look at the data and depending on certain characteristics, the network processing unit writes data to process sub-channels, which in the end, end up in different segments within a memory architecture of the system. In at least some embodiment, different processors or cores are assigned to the different memory segments so that each core or processor has its own data set to work with.
As shown in
In at least some embodiments, network processing unit 302 is configured to receive a packet via one of network interfaces, e.g., network interfaces 304, 305, 306, and 307. In at least some embodiments, each logical channel of memory structure 303 can be mapped to corresponding one or more network interfaces. For example, the logical channel assigned to section 308 can be mapped to network interface 304, the logical channel assigned to section 309 can be mapped to network interface 305, the logical channel assigned to section 310 can be mapped to network interface 307, and the logical channel assigned to section 311 can be mapped to network interface 306. Many combinations are possible. The number and size of memory sections is variable depending on need and network traffic rates.
In at least some embodiments, a logical channel is mapped to a single network interface. In at least some embodiments, a logical channel is mapped to multiple network interfaces. In at least some embodiments, at least one of the logical channels is mapped to a single network interface, and at least one of the logical channels is mapped to multiple network interfaces.
In at least some embodiments, the network processing unit 302 is configured to determine a network interface of the packet. The processing unit 302 is further configured to determine a memory section based on the network interface and packet content filter criteria.
As shown in
In at least some embodiments, each logical region, such as each of regions 312, 313, and 314, is mapped to a network traffic filter. In at least some embodiments, the network traffic filter is one of a plurality of filters stored in a memory of the data processing system. In at least some embodiments, a Berkley Packet Filter (BPF) provides a standard syntax that is used to specify the network traffic filter. In at least some embodiments, a custom interpreter of BPF strings is used to provide a standard mechanism (programming API) for configuring the hardware of the network unit, such as network unit 302. In at least some embodiments, user criteria are defined using a BPF and then the BPF containing the user criteria is translated to configure the hardware. In at least some embodiments, the user defined criteria indicate a protocol associated with the packet, a server for the packet, a network interface, and what a user requests to do with the packet, for example, analyze, capture, or both. In at least some embodiments, the user defined criteria specify a range of IP addresses, a range of port numbers, a range of protocols, and the like. In at least some embodiments, the user defined criteria indicate the logic regions in memory.
In at least some embodiments, network traffic filters are set up to point to corresponding logic regions in a memory. For example, if a packet comes in and matches a filter that filter will provide a tag that would correlate to a specific region in memory. In at least some embodiments the filter is configured to provide a tag that specifies one of at least three regions A, B and C. In one embodiment, the network unit, such as network unit 302 has two to four interfaces through which Ethernet traffic comes in, and each of the interfaces is mapped to one of up to four logical channels, depending upon how many ports the network unit has. For example, if the network processing unit 302 has four ports, these ports can be mapped up to four logical channels. In at least some embodiments, a hash value in the packet report is created by the network unit, such as network processing unit 302, that points to a sub-region within the logical region. In at least some embodiments, up to three hash bits on the packet report can point to up to eight different process sub-regions. In at least some embodiments, the logical channels, logical regions, and sub-regions are combined to create a number of sub-channels to route the packet by the network unit, such as network processing unit 302. In at least some embodiments, a number of process sub-channels depends on a configuration. A number of sub-channels can be, for example, from 1 to 48 depending on the configuration, e.g., a memory configuration, hash bits used, a number of logical channels, and a number of network interfaces defined per logical channel. The filters can be defined to work against all network interfaces or any particular network interface depending on a configuration.
In at least some embodiments the sub region count, is configurable to be, for example, one, two, four or eight. In at least some embodiments, a network unit, such as network processing unit 302 analyzes information in the IP packet header to determine a hash by using which the network unit can then extract hash bits, for example three bits, which can steer the packet to a corresponding sub region of region A to write these data to. In at least some embodiments, the filter specifies the logical region, the interface to which the packet comes on and user conditions. In at least some embodiments, the network unit, such as network processing unit 302 determines a sub region to which to steer the packet based on a count of sub-regions.
In at least some embodiments, fields 503, 504, 505 include pointers into the packet for key features, for example, a source IP address, a destination IP address, a source port number, a destination port number, a protocol, and other packet key features. In at least some embodiments, the hash value is calculated and added to field 506, for example, by network processing unit 302.
In at least some embodiments, the hash value calculated based on the header fields includes the packet source and destination IP addresses, protocol, TCP/UDP source and destination port numbers, or any combination thereof. In at least some embodiments, the hash value is calculated based on numerical order of the IP addresses such that data to and from IP addresses of a particular protocol will produce the same hash, so that IP “conversations” will be routed to the same sub-channel. In at least some embodiments, a hash value indicates to which sub-channel the packet needs to be sent.
In at least some embodiments, the hash value includes a hash value of the packet's IP address. In at least some embodiments, network processing unit 302 is configured to compare the received packet data against a network traffic filter stored in a memory (e.g., in data structure 400). In at least some embodiments, the filter having the data that match to the data of the packet is selected from the plurality of filters stored in a memory (e.g., in data structure 400) for routing the packet to a process sub-channel in a memory. In at least some embodiments, network processing unit 302 is configured to route the received packet to a process sub-channel in a memory based on comparing, as described in further detail below. In at least some embodiments, network processing unit 302 is configured to determine a hash value. In at least some embodiments, network processing unit 302 is configured to select the process sub-channel based on the determined hash value, as described in further detail below.
Network unit 701 is configured to route a packet to one of the logical regions, such as regions A, B and C that are selected based on user criteria, and other information contained in the packet, as described above. As shown in
As shown in
In the foregoing specification, embodiments of the invention have been described with reference to specific exemplary embodiments thereof. It will be evident that various modifications may be made thereto without departing from the broader spirit and scope of the embodiments of the invention. The specification and drawings are, accordingly, to be regarded in an illustrative sense rather than a restrictive sense.
