Action based on advertisement indicator in network packet

Patent metadata

Field	Value
Publication number	US-11546235-B2
Application number	US-201616061431-A
Country	US
Kind code	B2
Filing date	Mar 8, 2016
Priority date	Mar 8, 2016
Publication date	Jan 3, 2023
Grant date	Jan 3, 2023

Abstract

Examples disclosed herein relate to performing an action based on an advertisement indicator is present in a network packet. In one example, a network packet identified by a network infrastructure device as matching criteria associated with a pre-identified request is received. A parameter within the network packet is identified. A rule is used to determine whether the parameter indicates that an advertisement indicator is present in a flow associated with the network packet. An action is performed based on whether the advertisement indicator is present in the network packet.

First claim

What is claimed is:

1. A network appliance facilitating a specialized networking service, the network appliance comprising:
processing circuitry;
an interface to receive a packet from a network device based on packet matching criteria associated with a pre-determined packet request type at an ingress port of the packet at the network device;
a parameter identification engine to identify a parameter associated with the packet request type in the packet, wherein the parameter indicates an association between the packet and an advertisement;
a rule engine to determine whether the parameter corresponds to an advertisement indicator for a data flow of the packet based on the ingress port and a rule specific to the ingress port, wherein the advertisement indicator indicates a likelihood of presence of the advertisement in the data flow; and
an enforcement engine to perform an action to the data flow based on presence of the advertisement indicator in the packet and a size of a piece of content associated with the advertisement.

2. The network appliance of claim 1 , wherein the packet is a domain name system (DNS) request and the parameter includes a domain name, wherein the rule compares the domain name to a list that includes domain names known to serve advertisements, and wherein the advertisement indicator is presence of the domain name on the list.

3. The network appliance of claim 2 , wherein the action includes a response to a requestor of the DNS request, and wherein the response indicates that the response is from a DNS server.

4. The network appliance of claim 1 , wherein the parameter includes a Uniform Resource Identifier (URI) in the packet, and wherein the advertisement indicator is the URI matching a pattern indicative of advertisements.

5. The network appliance of claim 4 , wherein the request is a Hypertext Transfer Protocol (HTTP) GET request or an HTTP CONNECT request.

6. The network appliance of claim 4 , wherein the action includes substituting web content for a resource associated with the URI.

7. The network appliance of claim 1 , further comprising:
a network device manager to determine a network device rule based on the rule,
wherein the action includes sending the network device rule to the network device, and
wherein the network device rule specifies a second action to be performed by the network device based on the advertisement indicator.

8. The network appliance of claim 1 , wherein the action includes denying a request in the packet and responding to a requestor of the packet with an indication that a resource for the request is unavailable.

9. A non-transitory machine-readable storage medium storing instructions that, if executed by a physical processing element of a software defined networking (SDN) controller, cause the SDN controller to:
receive a packet from a network device based on packet matching criteria associated with a pre-determined packet request type at an ingress port of the packet at the network device;
identify a parameter associated with the packet request type in the packet, wherein the parameter indicates an association between the packet and an advertisement;
determine whether the parameter corresponds to an advertisement indicator for a data flow of the packet based on the ingress port and a rule specific to the ingress port, wherein the advertisement indicator indicates a likelihood of presence of the advertisement in the data flow; and
perform an action to the data flow based on presence of the advertisement indicator in the packet and a size of a piece of content associated with the advertisement.

10. The non-transitory machine-readable storage medium of claim 9 , further comprising instructions that, if executed by the physical processing element, cause the SDN controller to:
determine a network device rule based on the rule, wherein the action further includes sending the network device rule to the network device, and wherein the network device rule specifies a second action to be performed by the network device based on the advertisement indicator.

11. The non-transitory machine-readable storage medium of claim 9 ,
wherein the packet is a domain name system (DNS) request and the parameter includes a domain name, wherein the rule compares the domain name to a list that includes domain names known to serve advertisements, and wherein the advertisement indicator is presence of the domain name on the list.

12. The non-transitory machine-readable storage medium of claim 9 , further comprising instructions that, if executed by the physical processing element, cause the SDN controller to:
identify a Uniform Resource Identifier (URI) in the parameter in the packet;
wherein the advertisement indicator is the URI matching a pattern indicative of advertisements.

13. The non-transitory machine-readable storage medium of claim 11 , wherein the action includes a response to a requestor of the DNS request, and wherein the response indicates that the response is from a DNS server.

14. The non-transitory machine-readable storage medium of claim 9 , wherein the action includes denying a request in the packet and responding to a requestor of the packet with an indication that a resource for the request is unavailable.

15. A network device, comprising:
processing circuitry;
a network interface to receive a packet from a remote device;
a request logic block to determine that the packet is associated with a pre-determined packet request type and received at an ingress port of the network device;
a parameter identification manager to identify a parameter associated with the packet request type in the packet, wherein the parameter indicates an association between the packet and an advertisement;
a rule logic block to determine whether the parameter corresponds to an advertisement indicator for a data flow of the packet based on the ingress port and a rule specific to the ingress port, wherein the advertisement indicator indicates a likelihood of presence of the advertisement in the data flow; and
an enforcement logic block to perform an action to the data flow based on presence of the advertisement indicator in the packet and a size of a piece of content associated with the advertisement.

16. The network device of claim 15 , wherein the packet is a domain name system (DNS) request and the parameter includes a domain name,
wherein the rule compares the domain name to a list that includes domain names known to serve advertisements, wherein the advertisement indicator is presence of the domain name on the list.

17. The network device of claim 15 , wherein the parameter includes a Uniform Resource Identifier (URI), in the packet, and wherein the advertisement indicator is the URI matching a pattern indicative of advertisements.

18. The network device of claim 16 , wherein the action includes a response to a requestor of the DNS request, and wherein the response indicates that the response is from a DNS server.

19. The network device of claim 15 , wherein the action includes denying a request in the packet and responding to a requestor of the packet with an indication that a resource for the request is unavailable.

20. The network appliance of claim 15 , further comprising an interface to receive a network device rule that specifies a second action to be performed based on the advertisement indicator.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Wackerly Shaun
• Wakumoto Shaun
• Lavigne Bruce E

Classifications

• H04L43/026

  using flow identification · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• G06Q30/0254

  based on statistics · CPC title

• H04L43/028 Primary

  by filtering · CPC title