Zero copy packet buffering using shadow sends
View Patent ↗Packets in an intrusion prevention system are inspected by a deep packet inspection engine. A packet may be queued for transmission onto an output queue and transmitted over a network while deep packet inspection is still being performed on the packet. Such simultaneous inspection processing and transmission may be implemented using two ownership bits for the packet, one to indicate “ownership to process” and one to indicate “ownership to send,” instead of the single ownership bit that is used in conventional systems. Furthermore, the packet may be inspected, queued onto the output queue, and transmitted without making a copy of the packet within the deep packet inspection engine. These techniques enable the inspection latency, and therefore the overall transmission latency, of packets to decrease, thereby improving the overall performance of the intrusion prevent system.
1. A method comprising:
(A) receiving a packet over a network;
(B) performing deep packet inspection on the packet;
(C) queuing the packet for transmission over a network while deep packet inspection is being performed on the packet;
before (B), assigning processing ownership of the packet to deep packet inspection means;
before (C), assigning transmission ownership of the packet to output means,
wherein (B) comprises performing deep packet inspection on the packet using the deep packet inspection means, and
wherein assigning processing ownership of the packet comprises modifying a first value of a first field in the packet and wherein assigning transmission ownership of the packet comprises modifying a second value of a second field in the packet.
2. The method of claim 1 , further comprising:
(D) transmitting the packet over the network while deep packet inspection is being performed on the packet.
3. The method of claim 1 , further comprising:
(D) determining whether a predetermined criterion associated with the packet is satisfied; and
(E) performing (C) if the predetermined criterion is satisfied.
4. The method of claim 3 , wherein (D) comprises determining whether deep packet inspection has been performed on the packet for longer than a predetermined amount of time.
5. The method of claim 1 , wherein (C) comprises queuing the packet for transmission over the network without copying the packet.
6. The method of claim 1 , wherein the first field comprises a first bit and wherein the second field comprises a second bit.
7. The method of claim 1 , wherein queuing the packet for transmission over a network comprises queuing the packet in an output queue for transmission of the packet from the output queue over the network.
8. The method of claim 7 , wherein the output queue is a hardware output queue.
9. A non-transitory computer readable storage medium on which is embedded machine readable instructions, said machine readable instructions, when executed, implementing a method of deep packet inspection, said machine readable instructions comprising computer readable code to:
receive a packet over a network;
perform deep packet inspection on the packet;
queue the packet for transmission over a network while deep packet inspection is being performed on the packet;
prior to perform the deep packet inspection on the packet, modify a first value of a first field in the packet to indicate that the deep packet inspection is performed on the packet; and
prior to queue the packet for transmission, modify a second value of a second field in the packet to indicate that the packet is queued in an output queue for transmission.
10. A network device comprising:
a hardware output queue; and
a deep packet inspection engine to:
perform deep packet inspection on a packet received over a network; and
queue the packet in the output queue for transmission over the network while deep packet inspection is being performed on the packet,
wherein prior to performing the deep packet inspection on the packet, the deep packet inspection engine modifies a first value of a first field in the packet to indicate that the deep packet inspection is performed on the packet, and
wherein the prior to queuing the packet for transmission, the deep packet inspection engine modifies a second value of a second field in the packet to indicate that the packet is queued in the output queue for transmission.