Apparatus and method for network traffic classification and policy enforcement
View Patent ↗A machine has a bus, an input port connected to the bus to receive inbound network traffic, an output port connected to the bus to convey outbound network traffic and a processor complex connected to the bus. The processor complex is configured as a pipeline with individual processor cores assigned individual network traffic processing tasks. The pipeline includes a first set of processor cores to construct network traffic trees characterizing the inbound network traffic and the outbound network traffic. Each network traffic tree characterizes traffic type and traffic rate. A second set of processor cores enforces network traffic policies utilizing the network traffic trees. The network traffic policies apply traffic rate control by traffic type for the inbound network traffic and the outbound network traffic.
1. A machine, comprising:
a bus;
an input port connected to the bus to receive inbound network traffic;
an output port connected to the bus to convey outbound network traffic; and
a processor complex connected to the bus, the processor complex configured as a pipeline with individual processor cores assigned individual network traffic processing tasks, the pipeline including:
a first set of processor cores to construct a first network traffic tree characterizing the inbound network traffic and a second network traffic tree characterizing the outbound network traffic, where the first and second network traffic trees characterize at least one traffic type and at least one traffic rate, and where the first and second network traffic trees are different from each other with respect to at least one traffic type or at least one traffic rate, and
a second set of processor cores to enforce network traffic policies utilizing the first and second network traffic trees constructed by the first set of processor cores, where the network traffic policies:
enforce traffic rate control by traffic type on the inbound network traffic and the outbound network traffic; and
enforce a burst rate and a priority class per network traffic flow.
2. The machine of claim 1 wherein the first set of processor cores includes a first processor core to process the inbound network traffic and a second processor core to process the outbound network traffic.
3. The machine of claim 1 wherein the second set of processor cores includes a third processor core to enforce traffic rate control on the inbound network traffic and a fourth processor core to enforce traffic rate control on the outbound network traffic.
4. The machine of claim 1 wherein traffic type includes a traffic category and a set of applications corresponding to the traffic category.
5. The machine of claim 1 wherein the traffic type includes an enterprise location.
6. The machine of claim 1 wherein the traffic type includes an enterprise group.
7. The machine of claim 1 wherein the network traffic policies further enforce a guaranteed traffic rate.
8. The machine of claim 1 further comprising lock-free queues between the first set of processor cores and the second set of processor cores.
9. The machine of claim 8 wherein a lock-free queue is configured to receive input from a single processor core of the first set of processor cores and supply output to a single processor core of the second set of processor cores.
10. The machine of claim 8 further comprising a feedback queue to receive input from a single processor core of the second set of processor cores and supply output to a single processor core of the first set of processor cores.
11. The machine of claim 8 wherein a first processor core of the first set of processor cores allocates a network packet and a second processor core of the second set of processor cores de-allocates the network packet and writes a message to a lock-free queue for consumption by the first processor core.
12. The machine of claim 1 wherein each processor core of the first set of processor cores has a timer wheel.
13. The machine of claim 1 wherein each processor core of the first set of processor cores is configured so that each network connection is assigned to a single thread.
14. The machine of claim 1 wherein each processor core of the second set of processor cores is configured so that network packets belonging to the same partition are assigned to a single thread.
15. A method, comprising:
receiving, by an input port connected to a bus, inbound network traffic;
conveying, by an output port connected to the bus, outbound network traffic;
constructing a first network traffic tree characterizing the inbound network traffic and a second network traffic tree characterizing the outbound network traffic, where the first and second network traffic trees characterize at least one traffic type and at least one traffic rate, and where the first and second network traffic trees are different from each other with respect to at least one traffic type or at least one traffic rate,
enforcing, by a second set of processor cores, network traffic policies utilizing the first and second network traffic trees constructed by the first set of processor cores, where the network traffic policies:
enforce traffic rate control by traffic type on the inbound network traffic and the outbound network traffic; and
enforce a burst rate and a priority class per network traffic flow; and
wherein a processor complex connected to the bus is configured as a pipeline with individual processor cores assigned individual network traffic processing tasks, the pipeline including the first set of processor cores and the second set of processor cores.
16. The method of claim 15 , wherein the first set of processor cores includes a first processor core and a second processor core, and further comprising:
processing, by the first processor core, the inbound network traffic; and
processing, by the second processor core, the outbound network traffic.
17. The method of claim 15 , further comprising implementing lock-free queues between the first set of processor cores and the second set of processor cores.
18. A system, comprising:
a bus;
an input port connected to the bus to receive inbound network traffic;
an output port connected to the bus to convey outbound network traffic;
a router connected to at least one of the input port and the output port, where the router is configured to communicate with the internet;
a switch connected to at least one of the input port and the output port, where the switch is configured to communicate with a local area network; and
a processor complex connected to the bus, the processor complex configured as a pipeline with individual processor cores assigned individual network traffic processing tasks, the pipeline including:
a first set of processor cores to construct a first network traffic tree characterizing the inbound network traffic and a second network traffic tree characterizing the outbound network traffic, where the first and second network traffic trees characterize at least one traffic type and at least one traffic rate, and where the first and second network traffic trees are different from each other with respect to at least one traffic type or at least one traffic rate, and
a second set of processor cores to enforce network traffic policies utilizing the first and second network traffic trees constructed by the first set of processor cores, where the network traffic policies:
enforce traffic rate control by traffic type on the inbound network traffic and the outbound network traffic; and
enforce a burst rate and a priority class per network traffic flow.
19. The system of claim 18 , wherein the first set of processor cores includes a first processor core to process the inbound network traffic and a second processor core to process the outbound network traffic.
20. The system of claim 18 , further comprising lock-free queues between the first set of processor cores and the second set of processor cores.