Heuristic network traffic classification using byte-distributions
A network device has counters that are configured to generate for a plurality of byte positions in a specified portion of data packets, a count indicative of a correspondence of a value found at the byte position corresponding to a rule such that occurrences of predetermined byte values in the plurality of byte positions may be counted. A packet classifier is configured to receive from the counters a number of byte values corresponding to the rules and to classify data packets based on the analysis.
1. A network device, comprising:
a packet ingress configured to receive data packets transmitted on a network;
a plurality of counters, ones of the counters being configured to generate for corresponding one or more byte positions that are located in predetermined portions of the data packets, a count indicative of a number of occurrences in which bytes in the plurality of byte positions have a predetermined byte value; and
a packet classifier configured to receive from the counters the counts of occurrences of the byte values and to classify data packets based on the counts.
2. The network device according to claim 1 , wherein the packet classifier is further configured to apply a quality of service to the data packets based on the classification.
3. The network device according to claim 1 , wherein the packet classifier is further configured to drop packets based on the classification.
4. The network device according to claim 1 , wherein the packet classifier is further configured to classify the data packets in accordance with a determination whether the data packets are associated with an open systems interconnection (OSI) model layer 7 application.
5. The network device according to claim 1 , wherein packet classifier is further configured to classify the data packets at contiguous and predetermined positions.
6. The network device according to claim 1 , wherein each of the plurality of counters is further configured to count byte values at respectively different specified portions of each data packet, of the data packets, based on a reconfigurable configuration specifying a portion of interest in the data packet.
7. The network device according to claim 1 , wherein the plurality of counters are hardware components that are configured to exactly count the occurrences of bytes having the respective byte values.
8. A method of operating a network device, comprising:
receiving, at a network device, data packets transmitted on a network;
generating with a plurality of counters, for corresponding one or more byte positions that are located in predetermined portions of the data packets, a count indicative of a number of occurrences in which bytes in the plurality of byte positions have a predetermined byte value;
receiving from the counters, at a classifier, the counts of occurrences of the byte values; and
classifying the data packets based on the counts.
9. The method of claim 8 , further comprising, at the classifier, applying a quality of service to bytes based on the classification.
10. The method of claim 8 , further comprising dropping packets, at the classifier, based on the classification.
11. The method of claim 8 , wherein the classification by the packet classifier determines whether the data packets are associated with an open systems interconnection (OSI) model layer 7 application.
12. The method of claim 8 , wherein the predetermined byte positions are set by the classifier such that at least one of the predetermined portions of the data packets is contiguous.
13. The method of claim 8 , further comprising reconfiguring, by the plurality of counters, a range of byte locations of at least one of the predetermined portions to be counted from among the data packets.
14. The method of claim 8 , wherein hardware components perform the counting of the occurrences of predetermined byte values in the plurality of byte positions.