Systems and methods for tracking and exporting flows in software with augmented processing in hardware

Patent metadata

Field	Value
Publication number	US-2023318948-A1
Application number	US-202318185921-A
Country	US
Kind code	A1
Filing date	Mar 17, 2023
Priority date	May 7, 2021
Publication date	Oct 5, 2023
Grant date	—

Abstract

Systems and methods are provided herein for using a network device's software (e.g., programs executed on a CPU) to maintain and export flow data while offloading network resource intensive tasks to the network device's hardware. This may be accomplished by a network device determining whether a new flow should be tracked using only the software table (e.g., table stored only on the CPU) of the network device or whether certain flow tracking tasks (e.g., counting/parsing) can be offloaded to a hardware table (e.g., counter table in a hardware flow cache) of the network device. The network device may use one or more conditions to determine whether the new flow should be tracked using the software table or by both the software and the hardware table. The conditions can relate to the characteristics of the new flow, resource information, prioritization of the new flow, etc.

First claim

What is claimed is:

1 . A method comprising:
receiving, by a network device, a new flow; determining, by the network device, characteristic data related to the new flow; determining, by the network device, resource information related to a hardware table of the network device; based on the characteristic data and the resource information, determining, by the network device, whether the new flow should be tracked using the hardware table; in response to determining that the new flow should be tracked using the hardware table, updating, by the network device, the hardware table to include an entry corresponding to the new flow; recording, by the hardware table of the network device, flow information related to the new flow, wherein the flow information is based on counting a plurality of data packets corresponding to the new flow; in response to determining that the new flow should not be tracked using the hardware table; recording, by a software table of the network device, flow information related to the new flow, wherein the flow information is based on counting a plurality of data packets corresponding to the new flow; and transmitting, by the network device, the flow information to a second network device.

2 . A method comprising:
receiving, by a network device, a new flow; determining, by the network device, characteristic data related to the new flow; determining, by the network device, resource information related to a hardware table of the network device; based on the characteristic data and the resource information, determining, by the network device, whether the new flow should be tracked using the hardware table; in response to determining that the new flow should be tracked using the hardware table, updating, by the network device, the hardware table to include an entry corresponding to the new flow; recording, by the hardware table of the network device, flow information related to the new flow, wherein the flow information is based on counting a plurality of data packets corresponding to the new flow; and transmitting, by the network device, the flow information to a second network device.

3 . The method of claim 2 , further comprising, in response to determining that the new flow should not be tracked using the hardware table, recording, by a software table of the network device, flow information related to the new flow, wherein the flow information is based on counting a plurality of data packets corresponding to the new flow.

4 . The method of claim 2 , wherein determining characteristic data related to the new flow further comprises:
determining an activity of the new flow; and determining if the activity of the new flow corresponds to a type of flow to be tracked using the hardware table of the network device.

5 . The method of claim 4 , wherein the type of flow to be tracked using the hardware table corresponds to flows that send a first number of packets during a period of time and the first number of packets is greater than a threshold number of packets.

6 . The method of claim 2 , wherein determining resource information related to the hardware table further comprises:
determining a number of flows installed in the hardware table; and comparing the number of flows installed in the hardware table to a threshold number of allotted flows.

7 . The method of claim 6 , further comprising, in response to determining that the number of flows installed in the hardware table exceeds the threshold number of allotted flows, recording, by a software table of the network device, flow information related to the new flow, wherein the flow information is based on counting a plurality of data packets corresponding to the new flow.

8 . The method of claim 2 , further comprising:
determining an amount of network resources being utilized by the network device; and based on the amount of network resources, characteristic data, and the resource information, determining, by the network device, whether the new flow should be tracked using the hardware table.

9 . The method of claim 8 , wherein receiving the new flow further comprises:
sampling, by the network device, a first packet according to a sampling rate; and determining, by the network device, that the first packet corresponds to the new flow.

10 . The method of claim 8 , wherein determining that the first packet corresponds to the new flow comprises:
determining a packet attribute related to the first packet; comparing the packet attribute to a plurality of entries in a software table of the network device, wherein one or more entries of the plurality of entries are associated with one or more packet attributes; and determining that no entries of the plurality of entries are associated with the packet attribute related to the first packet.

11 . The method of claim 2 , further comprising, monitoring, by the network device, the flow information periodically by scanning the hardware table after a first time period, wherein the scanning of the hardware table is in response to receiving a notification from the hardware table, wherein the notification is sent after a first time period and/or after a threshold number of data packets corresponding to the new flow are counted.

12 . An apparatus comprising:
control circuitry comprising a hardware table; and at least one memory including computer program code for one or more programs, the at least one memory and the computer program code configured to, with the control circuitry, cause the apparatus to perform at least the following:
receive a new flow;
determine characteristic data related to the new flow;
determine resource information related to the hardware table;
based on the characteristic data and the resource information, determine whether the new flow should be tracked using the hardware table;
in response to determining that the new flow should be tracked using the hardware table, update the hardware table to include an entry corresponding to the new flow;
record, by the hardware table of the network device, flow information related to the new flow, wherein the flow information is based on counting a plurality of data packets corresponding to the new flow; and
transmit the flow information to a network device.

13 . The apparatus of claim 12 , wherein the apparatus is further caused to, in response to determining that the new flow should not be tracked using the hardware table, record, by a software table of the network device, flow information related to the new flow, wherein the flow information is based on counting a plurality of data packets corresponding to the new flow.

14 . The apparatus of claim 12 , wherein the apparatus is further caused, when determining characteristic data related to the new flow to:
determine an activity of the new flow; and determine if the activity of the new flow corresponds to a type of flow to be tracked using the hardware table of the network device.

15 . The apparatus of claim 14 , wherein the type of flow to be tracked using the hardware table corresponds to flows that send a first number of packets during a period of time and the first number of packets is greater than a threshold number of packets.

16 . The apparatus of claim 12 , wherein the apparatus is further caused, when determining resource information related to the hardware table to:
determine a number of flows installed in the hardware table; and compare the number of flows installed in the hardware table to a threshold number of allotted flows.

17 . The apparatus of claim 16 , where

Assignees

• Arista Networks Inc

Inventors

• Labonte Francois
• Kamisetty Jeevan

Classifications

• H04L43/062 Primary

  related to network traffic · CPC title

• H04L47/2483 Primary

  involving identification of individual flows · CPC title

• H04L43/0852

  Delays · CPC title

• H04L43/0829

  Packet loss · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title