Data and control plane architecture including server-side triggered flow policy mechanism
View Patent ↗A data and control plane architecture for network devices. An example system architecture includes a network processing unit implementing one or more data plane operations, and a network device operably coupled to the network processing unit that implements a control plane. In a particular implementation, the network processing unit is configured to process network traffic according to a data plane configuration, and sample selected packets to the network device. The network device processes the sampled packets and adjusts the data plane configuration responsive to the sampled packets. In particular implementations, the control plane and data plane implement a server-side triggered policy caching mechanism that allows for previous classification policy decisions made for previous data flows to be applied to subsequent new flows.
1. An apparatus comprising
a control plane; and
a network processing unit that:
selectively samples received packets of the respective data flows to the control plane;
maintains a flow database of flow information entries, each comprising one or more policies and indexed by a hash of one or more data flow attributes comprising one or more client-side attributes and one or more server-side attributes;
maintains a triggering cache of flow information entries, comprising a plurality of cached classification policies and indexed by a hash of one or more server-side attributes and no client-side attributes;
matches packets of respective data flows to flow information entries in the flow database based on respective client-side and server-side attributes; else match packets of new respective data flows to flow information entries in the triggering cache based on the one or more server-side attributes and not based on the one or more client-side attributes;
applies the one or more policies to received packets of respective data flows that match corresponding flow information entries in the triggering cache or the flow database, otherwise apply one or more default policies to received packets of respective data flows according to a current data plane configuration;
wherein the control plane
processes packets sampled by the network processing unit; and
transmits control messages to the network processing unit identifying one or more policies for the respective data flows;
wherein one or more of the control messages include indications causing the data plane to add flow information entries in the flow database, and store the one or more policies in the triggering cache in association with the one or more server-side attributes.
2. The apparatus of claim 1 wherein the one or more server-side attributes comprise an IP address and a port number.
3. The apparatus of claim 1 wherein the one or more client-side attributes comprises a first network address and a first port number and the one or more server-side attributes comprises a second network address and a second port number, and wherein the one or more data flow attributes of the flow database further comprise a protocol identifier.
4. The apparatus of claim 1 wherein one or more of the control messages include indications causing the data plane to store network application identifiers in the triggering cache in association with the one or more server-side attributes.
5. The apparatus of claim 4 wherein one or more of the control messages include indications causing the data plane to use the default policy for data flows matching the server-side attributes in the control messages.
6. The apparatus of claim 4 wherein the data plane transmits to the control plane the one or more network application identifiers stored in the triggering cache in response to data flows matched to corresponding flow information entries in the triggering cache.
7. The apparatus of claim 2 wherein the one or more policies is further associated with one or more additional attributes.
8. The apparatus of claim 7 wherein the one or more additional attributes comprise a protocol identifier.
9. The apparatus of claim 1 wherein the network processing unit samples connection-initiating packets of respective data flows to the control plane.
10. The apparatus of claim 1 wherein the network processing unit samples the initial packets of respective data flows to the control plane.
11. The apparatus of claim 1 wherein the network processing unit samples connection-terminating packets of respective data flows to the control plane.
12. The apparatus of claim 1 wherein the network processing unit periodically samples packets of respective data flows to the control plane.
13. The apparatus of claim 1 wherein the control plane classifies the respective data flows based on the sampled packets; identify one or more policies for the respective data flows; and provide the identified policies for the respective data flows in the control messages transmitted to the network processing unit.
14. The apparatus of claim 13 wherein the control plane determines whether one or more policies in respective control messages are to be cached.
15. The apparatus of claim 1 wherein the control plane is a network application traffic management unit.
16. The apparatus of claim 1 wherein the control plane is transmits control messages controlling sampling of received packets of data flows by the network processing unit.
17. The apparatus of claim 1 wherein the one or more policies include partition identifiers for respective data flows.
18. The apparatus of claim 1 wherein the control plane transmits control messages indicating an overload condition; and wherein the network processing unit discontinues sampling of received packets responsive to a control message indicating an overload condition.
19. The apparatus of claim 1 wherein the control plane transmits control messages indicating an overload condition; and wherein the network processing unit
samples packets to the control plane at a first sampling rate;
discontinues sampling of received packets responsive to a control message indicating an overload condition; and
resumes sampling of packets at a sampling rate less than the first sampling rate.
20. The apparatus of claim 19 wherein the network processing unit increases the sampling rate until receipt of a control message indicating an overload condition.
21. The apparatus of claim 1 wherein the control plane-transmits control messages identifying a bad host; and wherein the network processing unit selectively discards received packets associated with the bad host.
22. The apparatus of claim 1 wherein the control plane is housed in a first enclosure, and the network processing unit is external to the first enclosure.
23. The apparatus of claim 1 wherein the control plane transmits retransmission request messages identifying one or more objects referenced in control messages transmitted from the control plane for which it has no configuration information.
24. An apparatus comprising
a control plane; and
a network processing unit:
selectively samples received packets of respective data flows to the control plane;
maintains a flow database of flow information entries each indexed by hashes of one or more data flow attributes including one or more client-side attributes and one or more server-side attributes;
maintains a triggering cache of flow information entries, comprising a plurality of cached classification policies, one or more cached network application identifiers and indexed by a hash of one or more server-side attributes and no client-side attributes;
matches packets of respective data flows to flow information entries in the flow database based on respective client-side and server-side attributes; else match packets of new respective data flows to flow information entries in the triggering cache based on the one or more server-side attributes and not based on the one or more client-side attributes;
conditionally attaches network application identifiers in the sampled packets responsive to received packets of respective data flows that match corresponding flow information entries in the triggering cache;
wherein the control plane
processes packets sampled by the network processing unit; and
transmits control messages to the network processing unit including one or more network application identifiers for the respective data flows;
wherein one or more of the control messages include indications causes the data plane to add flow information entries in the flow database, and store the one or more network application identifiers in the triggering cache in association with the one or more server-side attributes.
25. An apparatus, comprising
a memory;
one or more processors;
one or more network interfaces; and
a firmware application comprising instructions causes the one or more processors to:
selectively sample received packets of the respective data flows to a control plane;
maintain a flow database of flow information entries, each comprising one or more policies and indexed by a hash of one or more data flow attributes comprising one or more client-side attributes and one or more server-side attributes;
maintain a triggering cache of flow information entries, comprising a plurality of cached classification policies and indexed by a hash of one or more server-side attributes and no client-side attributes;
match packets of respective data flows to flow information entries in the flow database based on respective client-side and server-side attributes; else match packets of the respective data flows to flow information entries in the triggering cache based on the one or more server-side attributes and not based on the one or more client-side attributes;
apply the one or more cached policies to respective data flows that match corresponding flow information entries in the triggering cache, otherwise apply one or more policies to received packets of respective data flows according to a current data plane configuration;
change the data plane configuration responsive to control messages received from the control plane identifying one or more policies to be applied to respective data flows; and
responsive to control messages including caching indications, store the one or more policies in the triggering cache in association with the values of the one or more server-side attributes.
26. The apparatus of claim 25 wherein the apparatus further comprises a packet parsing logic circuit parsing received packets into one or more attribute values.
27. The apparatus of claim 25 wherein the firmware samples connection-initiating packets of respective data flows to the control plane.
28. The apparatus of claim 25 wherein the firmware samples connection-terminating packets of respective data flows to the control plane.
29. The apparatus of claim 25 wherein the firmware periodically samples packets of respective data flows to the control plane.
30. An apparatus comprising
a memory;
one or more processors;
one or more network interfaces; and
a control plane application, stored in the memory, comprising instructions causing the one or more processors to:
receive one or more sampled packets of respective data flows from a network processing unit;
classify the respective data flows based on the sampled packets;
identify one or more policies for the respective data flows; and
transmit control messages including the identified policies for the respective data flows to the network processing unit, wherein one or more of the control messages include indications causing the network processing unit to cache a plurality of classification policies in a triggering cache in association with one or more server-side attributes and no client-side attributes, and store the one or more policies in a flow information database in association with a hash of a tuple of flow attributes comprising a client side network address, a client side port number, a server-side network address, and a server-side port number and a protocol identifier.
31. The apparatus of claim 30 wherein the control plane application identifies network applications for the respective data flows, and wherein one or more of the control messages include indications causing the data plane to store network application identifiers in the triggering cache in association with the one or more server-side attributes.
32. The apparatus of claim 31 wherein one or more of the control messages cause the data plane to return a network application identifier for sampled packets matching the triggering cache, but to apply a default policy to the packets.
33. A method comprising
receiving one or more packets of a first data flow, wherein the first data flow is identified relative to one or more client-side attributes and one or more server-side attributes;
matching the first data flow to a traffic classification, wherein the traffic classification maps to a plurality of classification policies;
storing the server-side attributes, but not the client-side attributes, of the first data flow and the plurality of classification policies in a triggering cache;
storing the one or more client-side attributes and the one or more server-side attributes of the first data flow in a flow information database in association with the plurality of classification policies; and
applying the a plurality of classification policies in the triggering cache to subsequent data flows having server-side attributes that match the server-side attributes of the first data flow, if the client-side attributes and the server-side attributes of the data flow do not match an entry in the flow information database.