Accelerated processing of aggregate data flows in a network environment

Patent metadata

Field	Value
Publication number	US-9246825-B2
Application number	US-201414257098-A
Country	US
Kind code	B2
Filing date	Apr 21, 2014
Priority date	Jun 14, 2011
Publication date	Jan 26, 2016
Grant date	Jan 26, 2016

Abstract

At least one first frame of a first data flow is inspected by a general processing unit to associate the first data flow with an aggregate session, the aggregate session corresponding to a first set of aggregate data flows including the first data flow and at least one other data flow. Acceleration of the first data flow, by a network processing unit, can be authorized based on the inspection of the at least one first frame. Acceleration of the first data flow can be subject to at least a set of conditions including an aggregate trigger, the aggregate trigger defining that the acceleration of at least the first data flow be halted in response to an aggregate threshold amount of traffic being detected among the first set of aggregate data flows.

First claim

What is claimed is:

1. A method, comprising:
inspecting at least one particular frame of a data flow by a general processing unit;
determining that the data flow is associated with an aggregate session, the aggregate session corresponding to an aggregation of a plurality of data flows including the data flow;
identifying that a particular one of a plurality of aggregate object data records corresponds to the aggregate session, wherein the particular record comprises information describing characteristics of the aggregate session including an aggregate measurement of traffic of the plurality of data flows;
authorizing acceleration of the data flow by a network processing unit based, at least in part, on the inspection of the at least one particular frame and information included in the particular record,
wherein acceleration of the data flow is subject to an aggregate trigger defined for the aggregate session, the aggregate trigger defines that the acceleration of at least the data flow is to be halted in response to an aggregate threshold amount of traffic being detected among the plurality of data flows in excess of an aggregate threshold amount.

2. The method of claim 1 , wherein the general processing unit sends authorization of the acceleration of the data flow to the network processing unit, the authorization identifying a set of conditions including the aggregate trigger.

3. The method of claim 2 , wherein the set of conditions is generated, at least in part, using the general processing unit and based at least in part on the inspection of the particular frame.

4. The method of claim 1 , further comprising:
receiving, at the network processing unit, the particular frame of the data flow;
passing the at least one particular frame from the network processing unit to the general processing unit for inspection of the particular frame; and
receiving, at the network processing unit from the general processing unit, the set of conditions;
wherein acceleration of the data flow includes processing at least one subsequent frame in the data flow by the network processing unit to forward the at least one subsequent frame to at least one remote network node and bypassing processing of the subsequent frame by the general processing unit.

5. The method of claim 1 , wherein the aggregate traffic is based on a measurement of traffic of the received data flow and a measurement of traffic of at least one other data flow in the plurality of data flows.

6. The method of claim 5 , further comprising:
identifying that the particular aggregate object data record is associated with the aggregate session;
tracking, using the network processing unit, the measurement of traffic of the data flow; and
updating the particular aggregate object data record based on the tracked measurement of traffic of the data flow.

7. The method of claim 5 , wherein each aggregate object data record in the plurality of aggregate object data records corresponds to a respective aggregate session in a plurality of aggregate sessions, the plurality of aggregate sessions includes the aggregate session corresponding to the plurality of data flows, and the particular aggregate object data record is identified by the network processing unit using an aggregation identifier corresponding to the aggregate session.

8. The method of claim 5 , further comprising generating a first flow record for the data flow, wherein the network processing unit updates the particular aggregate object data record using data in the first flow record.

9. The method of claim 5 , further comprising:
receiving a particular subsequent frame in the data flow for accelerated processing by the network processing unit;
retrieving aggregate traffic data for the aggregate session from the particular aggregate object data record;
determining that the aggregate trigger is met based, at least in part, on receipt of the retrieved aggregate traffic data.

10. The method of claim 9 , further comprising decelerating the data flow in response to the trigger, wherein decelerating the data flow includes forwarding the particular subsequent frame to the general processing unit for inspection.

11. The method of claim 1 , wherein the aggregate trigger includes a buffer value for use in preventing an amount of data in excess of the aggregate threshold amount of traffic to be processed in data flows in the plurality of data flows.

12. The method of claim 1 , wherein at least one other data flow in the plurality of data flows is accelerated concurrently with acceleration of the data flow.

13. The method of claim 12 , wherein the other data flow is accelerated using the network processing unit.

14. The method of claim 13 , wherein accelerated data flows are to be halted in response to detecting the aggregate threshold amount of traffic being detected.

15. The method of claim 1 , wherein the aggregate trigger is at least one of a set of triggers including:
a time-based trigger and the aggregate amount of traffic corresponds to a measure of time; and
a volume-based trigger and the aggregate amount of traffic corresponds to a measure of traffic volume.

16. The method of claim 1 , wherein acceleration of the data flow includes acceleration of a particular sequence of frames in the data flow, the method further comprising using the general processing unit to inspect at least one other frame of the data flow, the other frame arriving subsequent to a final frame in the particular sequence of frames, wherein the other frame is processed to determine whether acceleration of another sequence of frames in the data flow, subsequent to the other frame, should be authorized.

17. The method of claim 1 , wherein frames of the data flow are to be processed by the network processing unit and are to bypass processing by the general processing unit during acceleration of the data flow.

18. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:
inspecting at least one particular frame of a data flow by a general processing unit;
determining that the data flow is associated with an aggregate session, the aggregate session corresponding to an aggregation of a plurality of data flows including the data flow;
identifying that a particular one of a plurality of aggregate object data records corresponds to the aggregate session, wherein the particular record comprises information describing characteristics of the aggregate session including an aggregate measurement of traffic of the plurality of data flows;
authorizing acceleration of the data flow by a network processing unit based, at least in part, on the inspection of the at least one particular frame and information included in the particular record,
wherein acceleration of the data flow is subject to an aggregate trigger defined for the aggregate session, the aggregate trigger defines that the acceleration of at least the data flow is to be halted in response to an aggregate threshold amount of traffic being detected among the plurality of data flows in excess of an aggregate threshold amount.

19. A system comprising:
at least one memory element for storing data;
a general processor configured to:
perform a set of inspection operations on frames of at least one received data flow;
determine that the received data flow is included in an aggregate session corresponding to a plurality data flows including the received data flow and at least one other data flow in addition to the received dat

Assignees

• Cisco Tech Inc

Inventors

• Jilani Imnaz Meher
• Clayton Kevin F
• Kalyanakrishnan Mahesh C
• Mackie Robert A
• Yeh Showen

Classifications

• H04L47/29

  using a combination of thresholds · CPC title

• H04L47/2416 Primary

  Real-time traffic · CPC title

• H04W24/08

  Testing, {supervising or monitoring} using real traffic · CPC title