Traffic monitor using leaky bucket with variable fill
An integrated circuit monitors the most active traffic flow rates on a communications network by using a leaky bucket model having a variable fill rate. As a switch receives packets, the packet identifications are sampled. A sampled packet identification is compared to record identifications in a table of identifications. If the sampled and record identifications match, an activity value for the packet identification is increased by an amount inversely proportional to an activity value associated with the record identification. If the sampled and record identifications do not match, the activity value is decreased. Record identifications are removed from the table when the activity value decreases to a specified level. New sampled identifications are added to the table if empty records exist.
1. A communications network device comprising:
a sampler, wherein
the sampler is configured to produce a sampled signal characteristic by virtue of being configured to sample a signal characteristic;
a comparator, wherein
the comparator is configured to compare the sampled signal characteristic and a record characteristic, and
the record characteristic is stored in a table of record characteristics; and a controller, wherein
the controller is configured to
increase an activity value, if the comparator indicates that the sampled characteristic and the record characteristic match, and
decrease the activity value, if the comparator indicates that the sampled characteristic and the record characteristic do not match, and
the activity value corresponds to the record characteristic.
2. The device of claim 1 , further comprising:
a port, wherein
the port is configured to receive a first communications signal from a source; and
a second port, wherein
the second port is configured to transmit a second communications signal to a destination,
the activity value is increased by an amount, and
the amount is dependent on the activity value.
3. The device of claim 2 , wherein
the signal characteristic is address information, and
the address information is within a packet.
4. The device of claim 2 , further comprising:
if the activity value has a specified value, the controller is configured to make the sampled signal characteristic a record characteristic in the table of record characteristics.
5. The device of claim 2 , further comprising:
if the activity value corresponding to a particular record characteristic reaches a specified value, the controller is configured to remove particular record characteristic from the table of record characteristics.
6. The device of claim 2 , wherein
the number of records in the table of record characteristics corresponds to the rate at which the sampler samples the signal characteristic.
7. The device of claim 1 , further comprising:
if the activity value is increased,
if the activity value has a first value, the controller is configured to increase the activity value by a first amount, and
if the activity value has a second value, the controller is configured to increase the activity value by a second amount, wherein the first value is less than the second value, and the first amount is greater than the second amount.
8. A device for monitoring network activity comprising:
a sampler, wherein
the sampler is configured to produce a sampled signal characteristic by virtue of being configured to sample a signal characteristic;
a comparator, wherein
the comparator is configured to compare the sampled signal characteristic and a record characteristic, and
the record characteristic is stored in a table of record characteristics; and a controller, wherein
the controller is configured to
increase an activity value, if the comparator indicates that the sampled characteristic and the record characteristic match, and
decrease the activity value, if the comparator indicates that the sampled characteristic and the record characteristic do not match, and
the activity value corresponds to the record characteristic.
9. The device of claim 8 , wherein
the activity value is increased by an amount, and
the amount is dependent on the activity value.
10. The device of claim 8 , wherein
the signal characteristic is address information, and
the address information is within a packet.
11. The device of claim 8 , wherein
the controller is further configured to make the sampled signal characteristic a record characteristic in the table of record characteristics, if the activity value has a specified value.
12. The device of claim 8 , wherein
the controller is further configured to remove a particular record characteristic from the table of record characteristics, if the activity value corresponding to the particular record characteristic reaches a specified value.
13. The device of claim 8 , wherein
when the activity value has a first value it is increased by a greater amount than when the activity value has a second value, the first value being less than the second value.
if the controller increases the activity value,
if the activity value has a first value, the controller is further configured to increase the activity value by a first amount, and
if the activity value has a second value, the controller is further configured to increase the activity value by a second amount, wherein
the first value is less than the second value, and
the first amount is greater than the second amount.
14. The device of claim 8 , wherein
the number of records in the table of record characteristics corresponds to the rate at which the sampler samples the signal characteristic.
15. A computer program product comprising a computer-readable storage medium and instructions, wherein the instructions are encoded in the computer-readable storage medium, the instructions are configured to be executed by a processor of a computer system, and the instructions are configured to implement a method comprising:
sampling a signal characteristic to produce a sampled signal characteristic;
comparing the sampled signal characteristic and a record characteristic, wherein the record characteristic is stored in a table of record characteristics; and
if the comparing indicates that the sampled characteristic and the record characteristic match,
increasing an activity value, and
if the comparing indicates that the sampled characteristic and the record characteristic do not match,
decreasing the activity value, wherein
the activity value corresponds to the record characteristic.
16. The computer program product of claim 15 , further comprising:
increasing the activity value by an amount, wherein
the amount is dependent on the activity value.
17. The computer program product of claim 15 , wherein
if the activity value has a specified value, making the sampled signal characteristic a record characteristic in the table of record characteristics.
18. The computer program product of claim 15 , wherein
if the activity value corresponding to a particular record characteristic reaches a specified value, removing particular record characteristic from the table of record characteristics.
19. The computer program product of claim 15 , wherein
if the activity value is increased,
if the activity value has a first value, increasing the activity value by a first amount, and
if the activity value has a second value, increasing the activity value by a second amount, wherein
the first value is less than the second value, and
the first amount is greater than the second amount.
20. The computer program product of claim 15 , wherein
the number of records in the table of record characteristics corresponds to the rate at which the process samples the signal characteristic.
21. The computer program product of claim 15 , wherein
the signal characteristic is address information, and
the address information is within a packet.
22. A method comprising:
sampling at a sampler a signal characteristic to produce a sampled signal characteristic;
comparing at a comparator the sampled signal characteristic and a record characteristic, wherein the record characteristic is stored in a table of record characteristics; and
if the comparing indicates that the sampled characteristic and the record characteristic match, increasing an activity value, and
if the comparing indicates that the sampled characteristic and the record characteristic do not match, decreasing the activity value, wherein
the activity value corresponds to the record characteristic.
23. The method of claim 22 , wherein
increasing the activity value by an amount, wherein
the amount is dependent on the activity value.
24. The method of claim 22 , wherein
the signal characteristic is address information, and
the address information is within a packet.
25. The method of claim 22 , wherein
if the activity value has a specified value, making the sampled signal characteristic a record characteristic in the table of record characteristics.
26. The method of claim 22 , wherein
if the activity value corresponding to a particular record characteristic reaches a specified value, removing particular record characteristic from the table of record characteristics.
27. The method of claim 22 , wherein
if the activity value is increased,
if the activity value has a first value, increasing the activity value by a first amount, and
if the activity value has a second value, increasing the activity value by a second amount, wherein
the first value is less than the second value, and
the first amount is greater than the second amount.
28. The method of claim 22 , wherein
the number of records in the table of record characteristics corresponds to the rate at which the process samples the signal characteristic.