Burst score
In one embodiment, a network device, includes at least one network interface port to serve as at least one ingress port for receiving network packets from a network and as at least one egress port for forwarding network packets to the network, a memory, control circuitry configured to monitor respective events in the network device, the respective events having respective event timestamps, and burst estimator logic to track respective rates of occurrence of ones of the events over respective time periods responsively to respective ones of the event timestamps, follow a maximum one of the rates of occurrence, store, in the memory, the maximum rate of occurrence, and find a measure of burstiness of the events responsively to the followed maximum rate of occurrence.
1. A network device, comprising:
at least one network interface port to serve as at least one ingress port for receiving first network packets from a network and as at least one egress port for forwarding second network packets to the network;
a memory;
control circuitry configured to monitor packet-related events in the network device, the packet-related events having respective event timestamps; and
burst estimator logic configured to:
track respective rates of occurrence of the packet-related events over respective time periods responsively to the respective event timestamps;
follow a maximum rate of occurrence of the respective rates of occurrence;
store, in the memory, the maximum rate of occurrence; and
find a measure of burstiness of the packet-related events responsively to the followed maximum rate of occurrence.
2. The network device according to claim 1 , wherein the measure of burstiness of the packet-related events is equal to the followed maximum rate of occurrence.
3. The network device according to claim 1 , wherein the burst estimator logic is configured to track a current rate of occurrence of the packet-related events over a current time period responsively to: a previous rate of occurrence of the packet-related events over a previous time period; and a time difference between a timestamp of a current packet-related event of the packet-related events and a timestamp of a previous packet-related event of the packet-related events.
4. The network device according to claim 3 , wherein the burst estimator logic is configured to store, in the memory, the current rate and the timestamp of the current packet-related event.
5. The network device according to claim 4 , wherein the burst estimator logic is configured to delete, from the memory, the timestamp of the previous packet-related event.
6. The network device according to claim 1 , wherein the burst estimator logic is configured to track a current rate of occurrence of the packet-related events over a current time period responsively to a previous rate of occurrence of the packet-related events over a previous time period plus a time difference between a timestamp of a current packet-related event of the packet-related events and a timestamp of a previous packet-related event of the packet-related events.
7. The network device according to claim 6 , wherein the burst estimator logic is configured to reduce the current rate of occurrence by a given factor.
8. The network device according to claim 7 , wherein the burst estimator logic is configured to store, in the memory, the current rate and the timestamp of the current packet-related event.
9. The network device according to claim 8 , wherein the burst estimator logic is configured to delete, from the memory, the timestamp of the previous packet-related event.
10. The network device according to claim 8 , wherein the burst estimator logic is configured to overwrite, in the memory, the timestamp of the previous packet-related event with the timestamp of the current packet-related event.
11. A networking method, comprising:
receiving first network packets from a network;
forwarding second network packets to the network;
monitoring packet-related events in a network device, the packet-related events having respective event timestamps;
tracking respective rates of occurrence of the packet-related events over respective time periods responsively to the respective event timestamps;
following a maximum rate of occurrence of the respective rates of occurrence;
storing the maximum rate of occurrence; and
finding a measure of burstiness of the packet-related events responsively to the followed maximum rate of occurrence.
12. The networking method according to claim 11 , wherein the measure of burstiness of the packet-related events is equal to the followed maximum rate of occurrence.
13. The networking method according to claim 11 , wherein the tracking includes tracking a current rate of occurrence of the packet-related events over a current time period responsively to: a previous rate of occurrence of the packet-related events over a previous time period; and a time difference between a timestamp of a current packet-related event of the packet-related events and a timestamp of a previous packet-related event of the packet-related events.
14. The networking method according to claim 13 , further comprising storing, in a memory, the current rate and the timestamp of the current packet-related event.
15. The networking method according to claim 14 , further comprising deleting, from the memory, the timestamp of the previous packet-related event.
16. The networking method according to claim 11 , wherein the tracking includes tracking a current rate of occurrence of the packet-related events over a current time period responsively to a previous rate of occurrence of the packet-related events over a previous time period plus a time difference between a timestamp of a current packet-related event of the packet-related events and a timestamp of a previous packet-related event of the packet-related events.
17. The networking method according to claim 16 , further comprising reducing the current rate of occurrence by a given factor.
18. The networking method according to claim 17 , further comprising storing, in a memory, the current rate and the timestamp of the current packet-related event.
19. The networking method according to claim 18 , further comprising deleting, from the memory, the timestamp of the previous packet-related event.
20. The networking method according to claim 18 , further comprising overwriting, in the memory, the timestamp of the previous packet-related event with the timestamp of the current packet-related event.
21. A software product, comprising a non-transient computer-readable medium in which program instructions are stored, which instructions, when read by a central processing unit (CPU), cause the CPU to:
monitor packet-related events in a network device, the packet-related events having respective event timestamps;
track respective rates of occurrence of the packet-related events over respective time periods responsively to the respective event timestamps;
follow a maximum rate of occurrence of the respective rates of occurrence;
store the maximum rate of occurrence; and
find a measure of burstiness of the packet-related events responsively to the followed maximum rate of occurrence.