Method and system for performing distributed deep-packet inspection
A method for deep-packet inspection of packets flowing through an end unit in a point-to-multipoint network. The method comprises classifying packet flows through the end unit using their flow-identification (ID) to determine which of the packet flows should be deep-packet inspected, wherein the packet flows include incoming packets received from a central unit and outgoing packets sent to the central unit of the point-to-multipoint network; duplicating packets determined to be deep-packet inspected; saving all duplicated packets in a memory; upon collection of a predefined number of duplicated packets belonging to a certain flow-ID, performing deep-packet processing based on at least one deep-packet inspection application; and saving the deep-packet processing results in the memory.
1. A method for deep-packet inspection (DPI) of packets received at an end-unit from among a plurality of end-units in a point-to-multipoint network, the plurality of end-units being coupled to a central unit, the method comprising:
classifying, by the end-unit, a packet received at the end-unit based on a flow-identification (ID) and a Media Access Control (MAC) address that the packet is received from to determine whether the packet should be deep-packet inspected;
duplicating in real-time at a traffic rate, by the end-unit, the packet and subsequent packets belonging to the flow-ID and the MAC address when the packet is determined to be deep-packet inspected;
saving, by a packet processor in the end-unit, the duplicated packet and the duplicated subsequent packets in a memory that is external to the end-unit;
transmitting, by the packet processor, the flow-ID and the MAC address, indexed to the memory, to a microprocessor in the end-unit;
upon collection of a predefined number of duplicated packets belonging to the flow-ID and the MAC address, retrieving by the microprocessor the predefined number of duplicated packets belonging to the flow-ID and the MAC address from the memory;
performing, by the end-unit, off-line deep-packet processing of the predefined number of duplicated packets based on a DPI application; and
saving, by the end-unit, deep-packet processing results in the memory.
2. The method of claim 1 , further comprising:
sending the deep-packet processing results to a database server that gathers deep-packet processing results from the plurality of end-units.
3. The method of claim 1 , wherein the flow-ID is from among a plurality of flow-IDs, and further comprising:
saving flow-IDs from among the plurality of flow-IDs that require DPI in a flow table.
4. The method of claim 1 , wherein the packet is not delayed by the DPI processing.
5. The method of claim 1 , wherein the DPI application comprises:
eavesdropping to the predefined number of duplicated packets.
6. The method of claim 1 , wherein the DPI application comprises:
detecting malicious attacks;
data mining;
network management services; or
censorship of the predefined number of duplicated packets.
7. The method of claim 6 , wherein the off-line deep-packet processing further comprises:
processing the predefined number of duplicated packets in any one of a communication Layer 2 through Layer 7 of an open system interconnection model (OSI) model.
8. The method of claim 1 , wherein the off-line deep-packet processing comprises:
processing a header or a payload portion of the predefined number of duplicated packets.
9. The method of claim 1 , wherein the point-to-multipoint network is a passive optical network (PON), and
wherein the end-unit is an optical network unit (ONU) of the PON.
10. The method of claim 1 , further comprising:
filtering in real-time at the traffic rate, by the end-unit, the packet and the subsequent packets when the packet is determined to be deep-packet inspected.
11. The method of claim 1 , further comprising:
determining the packet received at the end-unit is to be deep-packet inspected when the flow-ID is designated as requiring the DPI and the MAC address corresponds to a computing device that is designated as requiring the DPI.
12. A processing system, integrated in an end-unit of a plurality of end-units of a point-to-multipoint network, to perform deep-packet inspection (DPI) of packets received at the end-unit, the plurality of end-units coupled to a central unit, the processing system comprising:
a packet processor configured to:
classify a packet received at the end-unit based on a flow-identification (ID) and a Media Access Control (MAC) address that the packet is received from to determine whether the packet should be deep-packet inspected,
duplicate in real-time at a traffic rate the packet and subsequent packets belonging to the flow-ID when the packet is determined to be deep-packet inspected; and
store the duplicated packet and the duplicated subsequent packets in a memory; and
a microprocessor configured to:
receive, from the packet processor, the flow-ID and the MAC address, indexed to the memory;
retrieve, upon collection of a predefined number of duplicated packets belonging to the flow-ID and the MAC address, the predefined number of duplicated packets belonging to the flow-ID and the MAC address from the memory; and
perform, off-line deep-packet processing of the predefined number of duplicated packets based on a DPI application.
13. The processing system of claim 12 , further comprising:
a memory controller configured to allow the packet processor or the microprocessor to access the memory, wherein the memory is an external memory.
14. The processing system of claim 13 , wherein the packet processor is further configured to save the duplicated packet and the duplicated subsequent packets in the external memory.
15. The processing system of claim 14 , wherein the microprocessor is further configured to:
perform the off-line deep-packet processing on the saved duplicated packet and the saved duplicated subsequent packets, and
save deep-packet processing results in the external memory.
16. The processing system of claim 14 , wherein the packet processor is further configured to send deep-packet processing results to a database server that gathers deep-packet processing results for the plurality of end-units.
17. The processing system of claim 12 , wherein the flow-ID is from among a plurality of flow-IDs, and:
wherein flow-IDs from among the plurality of flow-IDs that require DPI are saved in a flow table maintained by the packet processor.
18. The processing system of claim 12 , wherein the DPI application comprises:
eavesdropping to the predefined number of duplicated packets;
detecting of malicious attacks;
data mining;
network management services; or
censorship of the predefined number of duplicated packets.
19. The processing system of claim 12 , wherein the DPI application comprises:
executable code programmed in a high-level programming language,
wherein the executable code is updated on-site to perform a modified DPI application, and
wherein the executable code is stored in a non-transitory computer readable medium accessed by the microprocessor.
20. The processing system of claim 12 , wherein the microprocessor is configured to process a header or a payload portion of the predefined number of duplicated packets,
wherein microprocessor is configured to process the predefined number of duplicated packets in any one of a communication Layer 2 through Layer 7 of an open system interconnection model (OSI) model.
21. The processing system of claim 12 , further comprising:
a second microprocessor configured to manage connections handled by the processing system;
a data-path bus configured to connect the packet processor and the microprocessor; and
a control-path bus configured to connect the packet processor and the second microprocessor.
22. The processing system of claim 21 , further comprising:
a Ethernet MAC adapter configured to interface with a plurality of subscriber devices; and
a passive optical network (PON) MAC adapter configured to process traffic according to a Gigabit PON (GPON), a Broadband PON (BPON), or an Ethernet PON (EPON).
23. The processing system of claim 12 , wherein the processing system is implemented within an optical network unit (ONU) of a passive optical network (PON).
24. The processing system of claim 12 , wherein the end-unit comprises:
an optical network unit (ONU), and
wherein the central unit comprises:
an optical line terminal (OLT).
25. The processing system of claim 12 , wherein the packet processor is further configured to determine the packet received at the end-unit is to be deep-packet inspected when the flow-ID is designated as requiring the DPI and the MAC address corresponds to a computing device that is designated as requiring the DPI.