Apparatus and method for staged traffic classification among terminal and aggregation nodes of a broadband communications system
View Patent ↗A system architecture and methods for data traffic flow classification are provided. An initial traffic class is assigned to a data flow as a current traffic classification, where the initial traffic class is based static traffic classification method(s) applied with respect to an initial packet of the data flow. A predetermined number of further packets of the data flow, subsequent to the initial packet, are analyzed based on predetermined factor(s), and a traffic class based on the analysis of the further packets is determined. The traffic class based on the analysis of the further packets is assigned as the current traffic classification of the data flow. Data indicating a traffic class for the data flow (based on a dynamic traffic classification method) is received, and the traffic class based on the dynamic traffic classification method is assigned as the current traffic classification of the data flow.
1. A method comprising:
assigning, by an initial client node of a data flow over a communications network, an initial traffic class as a current traffic classification of the data flow, wherein the initial client node is co-located with, or situated within a local network of, an application device from which the data flow originated, and wherein the initial traffic class is based on one or more static traffic classification methods applied with respect to one or more initial packets of the data flow;
receiving, by the initial client node, traffic classification information regarding the data flow from a remote downstream node of the data flow, wherein the remote downstream node is remotely located from the initial client node in that it is not co-located with the initial client node and is not within a local network of the initial client node, and wherein the traffic classification information is based on a dynamic analysis of further data packets of the traffic flow by the downstream node, beyond the one or more initial packets upon which the initial traffic class was based; and
updating, by the initial client node, the current traffic classification of the data flow based on the received traffic classification information, if the information indicates a different traffic class than the initial traffic class.
2. The method of claim 1 , wherein the static traffic classification methods comprise one or more of a multi-field (MF) classification method and a differentiated services (DiffServ) traffic classification method.
3. The method of claim 1 , wherein the traffic classification information is based on a deep packet inspection (DPI) analysis of the respective packets of the data flow.
4. The method of claim 1 , further comprising the following steps performed prior to the receipt of the traffic classification information from the downstream node:
analyzing, by the initial client node of the data flow, a number of subsequent packets of the data flow, based on one or more predetermined factors, and determining an intermediate traffic class based on the analysis of the number of further packets; and
updating the current traffic classification of the data flow based on the determination of the intermediate traffic class, if the determined intermediate traffic class differs from the initial traffic class.
5. The method of claim 4 , wherein, when the intermediate traffic class differs from the initial traffic class, the current traffic classification of the data flow is updated to the intermediate traffic class only if the intermediate traffic class reflects a higher priority classification as compared to the initial traffic class.
6. The method of claim 4 , further comprising:
determining whether the intermediate traffic class reflects a more accurate classification as compared to the initial traffic class; and
wherein the current traffic classification of the data flow is updated to the intermediate traffic class only if it is determined that the intermediate traffic class reflects a more accurate classification as compared to the initial traffic class.
7. The method of claim 4 , wherein the one or more predetermined factors comprise one or more of packet size, port association, throughput, pacing, and burstiness.
8. The method of claim 4 , wherein the one or more predetermined factors comprises packet size.
9. The method of claim 8 , wherein the analysis of the subsequent packets is based on a statistical analysis of data packet sizes with respect to one or more application protocols.
10. The method of claim 4 , wherein a start of packet flow indicator identifies a packet within the data flow from which the analysis of the subsequent packets is to begin.
11. The method of claim 4 , wherein the number of subsequent packets is based on a flexible set of configurable rules based on one or more of host applications and communications sessions targeted for classification.
12. An apparatus of an initial client node of a data flow over a communications network, comprising:
a data traffic processor, operating at the initial client node, configured to analyze one or more initial packets of the data flow based on one or more static traffic classification methods, and to assign an initial traffic class as a current traffic classification of the data flow based on the one or more static traffic classification methods applied with respect to the one or more initial packets of the data flow, wherein the initial client node is co-located with, or situated within a local network of, an application device from which the data flow originated; and
wherein the data traffic processor is further configured to receive, from a remote downstream node of the data flow, traffic classification information regarding the data flow, wherein the remote downstream node is remotely located from the initial client node in that it is not co-located with the initial client node and is not within a local network of the initial client node, and wherein the traffic classification information is based on a dynamic analysis of respective further data packets of the traffic flow by the downstream node, beyond the one or more initial packets upon which the initial traffic class was based, and to update the current traffic classification of the data flow based on the received traffic classification information, if the information indicates a different traffic class than the initial traffic class.
13. The apparatus of claim 12 , wherein the static traffic classification methods comprise one or more of a multi-field (MF) classification method and a differentiated services (DiffServ) traffic classification method.
14. The apparatus of claim 12 , wherein the traffic classification information is based on a deep packet inspection (DPI) analysis of the respective packets of the data flow.
15. The apparatus of claim 12 , wherein the data traffic processor is further configured to perform the following functions prior to the receipt of the traffic classification information from the downstream node:
analyze a number of subsequent packets of the data flow, based on one or more predetermined factors, and determine an intermediate traffic class based on the analysis of the number of further packets; and
update the current traffic classification of the data flow based on the determination of the intermediate traffic class, if the determined intermediate traffic class differs from the initial traffic class.
16. The apparatus of claim 15 , wherein, when the intermediate traffic class differs from the initial traffic class, data traffic processor is configured to update the current traffic classification of the data flow to the intermediate traffic class only if the intermediate traffic class reflects a higher priority classification as compared to the initial traffic class.
17. The apparatus of claim 15 , wherein the data traffic processor is further configured to:
determine whether the intermediate traffic class reflects a more accurate classification as compared to the initial traffic class; and
update the current traffic classification of the data flow to the intermediate traffic class only if it determines that the intermediate traffic class reflects a more accurate classification as compared to the initial traffic class.
18. The apparatus of claim 15 , wherein the one or more predetermined factors comprise one or more of packet size, port association, throughput, pacing, and burstiness.
19. The apparatus of claim 15 , wherein the one or more predetermined factors comprises packet size.
20. The apparatus of claim 19 , wherein the analysis of the subsequent packets is based on a statistical analysis of data packet sizes with respect to one or more application protocols.
21. The apparatus of claim 15 , wherein a start of packet flow indicator identifies a packet within the data flow from which the analysis of the subsequent packets is to begin.
22. The apparatus of claim 15 , wherein the number of subsequent packets is based on a flexible set of configurable rules based on one or more of host applications and communications sessions targeted for classification.