Packet load shedding
View Patent ↗Methods, apparatuses and systems directed to enhanced packet load shedding mechanisms implemented in various network devices. In one implementation, the present invention enables a selective load shedding mechanism that intelligently discards packets to allow or facilitate management access during DoS attacks or other high traffic events. In one implementation, the present invention is directed to a selective load shedding mechanism that, while shedding load necessary to allow a network device to operate appropriately, does not attempt to control traffic flows, which allows for other processes to process, classify, diagnose and/or monitor network traffic during high traffic volume periods. In another implementation, the present invention provides a packet load shedding mechanism that reduces the consumption of system resources during periods of high network traffic volume.
1. A method, comprising
storing packets received at a network interface in a packet buffer;
maintaining a first data structure for storing pointers to packets in the packet buffer;
maintaining a second data structure for storing pointers to packets read from the first data structure;
the network interface reading, responsive to receiving a packet at the network interface, the packet in the packet buffer and storing a pointer to the packet in the first data structure;
the network interface further discarding received packets when the first data structure is full;
monitoring the number of packets based on the pointers stored in the first data structure; and
reading a limited number of packet pointers from the first data structure to the second data structure based on a read limit corresponding to the at least one network interface.
2. The method of claim 1 further comprising
adjusting the read limit for at least one of the network interface based on observed aggregate packet load across the network interfaces.
3. The method of claim 1 wherein the first data structure is a ring.
4. The method of claim 1 wherein the second data structure is a queue.
5. The method of claim 1 further comprising
processing the packets for which pointers are stored in the second data structure.
6. A method enabling a selective load shedding mechanism, comprising
storing packets received at a network interface in a packet buffer;
maintaining a first data structure for storing pointers to packets in the packet buffer;
maintaining a second data structure for storing pointers to packets read from the first data structure;
the network interface reading, responsive to receiving a packet at the network interface, the packet in the packet buffer and storing a pointer to the packet in the first data structure;
reading a limited number of packet pointers from the first data structure to the second data structure based on a read limit corresponding to the at least one network interface;
monitoring the number of received packets based on the pointers stored in a buffer the first data structure relative to a threshold value; and
the network interface further discarding received packets when the first data structure is full, wherein further discarding the received packets comprises:
if the number of received packets stored in the first data structure exceeds the threshold value, then
selectively discarding subsequently received packets based on the observed behavior of the source or destination hosts identified in the packets, wherein the observed behavior comprises a number of flows associated with either the source or destination host.
7. The method of claim 6 wherein the number of flows comprises a number of new flows within a given time interval.
8. The method of claim 6 further comprising
if the number of received packets stored in the first data structure exceeds a second threshold value, then
randomly discarding subsequently received packets.
9. The method of claim 6 further comprising
if the number of received packets stored in the first data structure exceeds a second threshold value, then
passing subsequently received packets directly onto the destination host without higher level processing.
10. A method enabling a selective load shedding mechanism, comprising
storing packets received at a network interface in a packet buffer;
maintaining a first data structure for storing pointers to packets in the packet buffer;
maintaining a second data structure for storing pointers to packets read from the first data structure;
the network interface reading, responsive to receiving a packet at the network interface, the packet in the packet buffer and storing a pointer to the packet in the first data structure;
reading a limited number of packet pointers from the first data structure to the second data structure based on a read limit corresponding to the at least one network interface;
monitoring the number of received packets based on the pointers stored in a buffer the first data structure;
monitoring the data flows corresponding to the source hosts relative to at least one attribute;
the network interface further discarding received packets when the first data structure is full, wherein further discarding the received packets comprises:
if the number of received packets stored in the buffer first data structure exceeds a threshold value, then
selectively discarding received packets based on the at least one attribute associated with the source hosts identified in the received packets, wherein the at least one attribute comprises a number of current flows.
11. The method of claim 10 wherein the number of flows comprises a number of flows within a given time interval.
12. The method of claim 10 further comprising
if the number of received packets stored in the first data structure exceeds a second threshold value, then
randomly discarding subsequently received packets.
13. The method of claim 10 further comprising
if the number of received packets stored in the first data structure exceeds a second threshold value, then
passing subsequently received packets directly onto the destination host without higher level processing.
14. The method of claim 10 wherein the at least one attribute further comprises the number of packets received in a given time interval.
15. The method of claim 10 wherein the at least one attribute further comprises the number of bytes received in a given time interval.