Preconfigured filters, dynamic updates and cloud based configurations in a network access switch

Abstract

Methods and systems for providing a configuration file on a network access switch that may be configured by a third party. A third party remotely defines a set of filters for the network access switch, absolving the user of any responsibility to update or configure the filters on the device. The configuration files may be stored and accessed remotely in the cloud. The system and method also provide for a simple software interface to facilitate easy implementation of the filters stored in the configuration files.

Description

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to network access switch architectures, and more particularly, to a system that allows for the easy construction and updating of filters on a network access switch.

2. Description of the Related Art

Access switches are often used to assist in the monitoring of telecommunication links. Taps or span ports are used to feed traffic to Access Switches. The Access Switches then filter and direct the traffic to the correct monitoring devices such as intrusion detection systems (IDS) or traffic monitoring and analytical devices. Typical deployments are shown in FIG. 1.

Filters can be based on a number of different parameters such as protocol type (eg. UDP or TCP), destination or source addresses (be they layer 2 (MAC) or layer 3 (IP) addresses), and even specific bits within the payload data packets. Filters can also be assigned names chosen by users and which typically define the role of the filter, for example: “Voice over IP traffic on LAN port number 1.” End users can also construct complex logical Boolean filters based on the above parameters.

However, the construction of such complex filters can be both complex, tedious, time consuming and prone to errors. Once the filters have been defined they are typically stored in a “configuration file” that is stored within the firmware of a specific network Access Switch. Accordingly, there is a need in the art for simple, accurate construction of filters on network access switches.

Within the financial services industry there are particular challenges due to the large number of destination IP addresses used to define various traded instrument ranges within multicast data feeds that are published by major stock exchanges and execution venues. Major stock exchanges can have hundreds of IP addresses that are mapped to specific traded instruments. Different ranges can apply to production versus test feeds, and feeds originating from different data centers may also have multiple addresses. Companies who wish to set up their network Access Switches to filter on given financial instruments or for specific exchanges face significant logistical challenges in keeping track of all these parameters and ensuring that the filters are correctly defined. In addition it is not unusual for major stock exchanges to change their IP address ranges and their mappings to traded instruments on a regular basis. This again can cause logistical issues as these changes have to be tracked and then modifications made to the filters. Accordingly, there is a need in the art to reduce administration resources and costs with a network access switch that can simply track the changes to IP addresses made by major stock exchanges and execution venues.

BRIEF SUMMARY OF THE INVENTION

The present invention provides a method for defining a set of filters on a network access switch, comprising the steps of providing a network access switch having access to a configuration file for defining filters based on received data; limiting remote access to the configuration file to at least a single third party; receiving from the third party data defining a set of filters; and storing the data representing a set of filters within the configuration file.

According to another aspect, a user may not locally or remotely access the configuration file.

According to another aspect, the access switch has a second configuration file, and further comprises the steps of: receiving from the user data defining a set of filters; and storing the data representing a set of filters within the second configuration file.

According to another aspect, the third party is a manufacturer of the network access switch.

According to another aspect, the third party is a service provider.

According to another aspect the filter filters incoming network data based on trade type.

According to another aspect, the configuration file is stored on a remote server where it may accessible to the network access switch.

According to another aspect, the method further comprises the steps of providing a software interface to the network access switch; selecting a filter from set the filters stored within the configuration file with the software interface; and implementing the selected filter on the network access switch.

According to another aspect, the step of receiving occurs at a time of user's election.

According to another aspect, further comprising, after the step of limiting, the step of purchasing from the party data defining a set of filters.

According to an aspect, a system for filtering network traffic, comprising a network access switch having a configuration file, wherein the configuration file may be remotely accessed and programmed by at least a single third party to define a set of filters.

According to another aspect, a user of the network access switch may not access or program the configuration file.

According to another aspect, the system further comprises a second configuration file, wherein the configuration file may be accessed and programmed by a user to define a set of filters.

According to another aspect, the third party is the manufacturer of the network access switch.

According to another aspect, the third party is a service provider.

According to another aspect, the filter filters based on trade type.

According to another aspect, the configuration file is stored on a remote server.

According to another aspect, the system further comprises a software interface to the network access switch, wherein the software interface allows the user to select a filter from the set of filters to be implemented on the network access switch.

According to another aspect, the set of filters is purchased by a user.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S)

The present invention will be more fully understood and appreciated by reading the following Detailed Description in conjunction with the accompanying drawings, in which:

FIG. 1 is a typical deployment of a network access switch;

FIG. 2 is a schematic view of an embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

Referring now to the drawings, wherein like reference numerals refer to like parts throughout, there is seen in FIG. 2 a schematic of a new architecture for a network access switch according to an embodiment of the present invention. The new architecture provides two or more configuration files 12 to be located within network access switch 10. The first allows standard user defined filters. Configuration files 16 following the user defined filter, are made up of filters that are defined centrally by a third party and can be remotely updated from a central server. The first configuration file 14 can be thought of as a ‘private configuration file’, while the others are ‘public configuration files’. Public configuration files 16 are based around groups of closely associated filters. For example, ‘Financial Trading’, contains all filters associated with major stock exchange feeds and trading applications that use multicast or FIX messaging. ‘Voice and Video’ contains all filters associated with common applications with voice and video application monitoring.

Configuration files 12 contain all the relevant information for a user of network Access Switch 10 to readily define which traffic can be forwarded or blocked within a filter. The user may configure the filters by selecting from simple drop down menus or drag and drop type operations rather than composing complex technical filter expressions based on IP addresses or other parameters.

FIG. 2 also shows how configuration files 12 are related of the network Access Switch.

For example, if the Financial Trading Configuration file is loaded and the user wished to forward the NSYE BBO Production Line A Symbols A-C traffic, the user would select “NYSE_BBO_Production_LineA_Symbols_A-C_” in a drop down menu, rather than looking up the destination IP address of the multicast group associated with this feed in a large spreadsheet and then manually entering this as ip.dst==224.0.5.221 AND udp.port==8221.

All the required filter configuration data and logical Boolean constructs are located within public configuration files 16. Public configuration files 16 also contain the user-friendly names and relationships of the filtered objects as well as descriptions of them. Sophisticated filtering based on parameters that are relevant to the trading application can also be made, for example the filters may filter by trade type or instrument.

Although the user of the device may back up private configuration file 14 on a local backup 18, public configuration file 16 cannot be altered and adjusted by the end user. However, public configuration file 16 can be updated on a regular basis by an autonomous process controlled by either the manufacturer of the hardware or a third party service provider. Alternatively, to account for security concerns by some users, a semi manual process can be used whereby the end user manually loads new public configuration file 16.

End users can choose to store both types of their backup configuration files 12 locally, but there is little point in doing so for public configuration file 16 as these are available from either the supplier or a third party service provider. The ability to store private configuration files off site and accessible via the internet (as a cloud based service) is also possible.

Filters may also be sold by manufacturers or service providers, and purchased by end users.

Although most of the above examples concern financial services applications, this embodiment can also be used in other applications as well.

Claims

1. A method for defining filters on a network access switch, comprising: providing a network access switch that connects to at least one network tap and at least one span port, receives and filters traffic from the at least one network tap and span port, and directs the filtered traffic to network monitoring devices, the network access switch comprising a first configuration file for defining filters based on received data, wherein said filters in said first configuration file include filters for identifying and forwarding tapped traffic having destination Internet protocol (IP) addresses of multicast groups corresponding to real time traded instrument multicast data feeds of symbols and bid and ask quotes for alphabetic ranges of traded instruments published by stock exchanges and execution venues, and wherein the filters include a filter containing a destination IP address of a multicast group corresponding to one of the real time traded instrument feeds of symbols and bid and ask quotes for alphabetic ranges of traded instruments published by one of said stock exchanges or execution venues; andusing an autonomous process to update said filters within said first configuration file to track changes in mappings between said traded instruments and said IP addresses, the changes in the mappings including changes made by stock exchanges and execution venues in IP addresses associated with multicast data feeds published by the stock exchanges and execution venues, and wherein said network access switch uses said destination IP addresses to forward traffic to said multicast groups and wherein using said autonomous process to update said filters comprises providing a drop down menu having an identifier for a stock data feed mapped to a destination IP address of a multicast group, receiving selection of the identifier, and configuring the network access switch to forward traffic to the destination IP address of the multicast group.

2. The method of claim 1, wherein said filters in said first configuration file include filters that filter incoming network data based on trade type.

3. The method of claim 1, wherein said first configuration file is stored on a remote server where it is accessible to said network access switch.

4. The method of claim 1, further comprising: providing a software interface to said network access switch;selecting a filter from said filters stored within said first configuration file with said software interface; andimplementing said selected filter on said network access switch.

5. The method of claim 1, wherein said network access switch comprises a second configuration file manually updatable by an end user, and the method further comprises receiving, by the end user, data defining a set of filters and the receiving occurs at a time of said end user's election.

6. The method of claim 1, further comprising, limiting access to said filters in said first configuration file to a third party, and, after the limiting, purchasing from said third party data defining a set of filters.

7. A system for filtering network traffic, comprising: a network access switch that connects to at least one network tap and at least one span port, receives and filters traffic from the at least one network tap and span port, and directs the filtered traffic to network monitoring devices, the network access switch comprising:a first configuration file, wherein said first configuration file is remotely accessible and programmable to define a set of filters, wherein said filters in said first configuration file include filters for tapping and forwarding traffic having destination Internet protocol (IP) addresses of multicast groups corresponding to traded instrument multicast data feeds of symbols and bid and ask quotes for alphabetic ranges of traded instruments published by stock exchanges and execution venues,wherein said filters for tapping and forwarding traffic having destination IP addresses of multicast groups corresponding to traded instrument multicast data feeds of symbols and bid and ask quotes for alphabetic ranges of traded instruments published by stock exchanges and execution venues include a filter containing a destination IP address of a multicast group corresponding to one of the real time traded instrument feeds of symbols and bid and ask quotes for alphabetic ranges of traded instruments published by one of said stock exchanges or execution venues, and wherein said filters within said first configuration file are updatable using an autonomous process to track changes in said destination IP addresses of said multicast groups corresponding to real time traded instrument multicast data feeds of symbols and bid and ask quotes for alphabetic ranges of traded instruments published by stock exchanges and execution venues, the changes in the mappings including changes made by said stock exchanges and execution venues in said destination IP addresses of said multicast groups corresponding to said traded instrument multicast data feeds of symbols and bid and ask quotes for alphabetic ranges of traded instruments published by the stock exchanges and execution venues, and wherein said network access switch uses said destination IP addresses to forward traffic to said multicast groups and wherein using said autonomous process to update said filters comprises providing a drop down menu having an identifier for a stock data feed mapped to a destination IP address of a multicast group, receiving selection of the identifier, and configuring the network access switch to forward traffic to the destination IP address of the multicast group.

8. The system of claim 7, wherein said filters in said first configuration file include filters that filter incoming network data based on trade type.

9. The system of claim 7, wherein said first configuration file is stored on a remote server accessible to said network access switch.

10. The system of claim 7, further comprising a software interface to said network access switch, wherein said software interface allows an end user to select a filter from said set of filters in said first configuration file to be implemented on said network access switch.

11. The system of claim 7, wherein said network access switch comprises a second configuration file updatable by an end user, said second configuration file being accessible at a time of said end user's election.

12. The system of claim 7, wherein said set of filters in said first configuration file is purchased by a user.