Multi-phase IP-flow-based classifier with domain name and HTTP header awareness
An apparatus and method for classifying traffic data in a communication network based on IP flow. Traffic data in a communication network is monitored in order to detect an IP flow. A preliminary classification is assigned to the IP flow based on protocol information contained in its first packet. Subsequent packets within the IP flow are further monitored, and the IP flow is reclassified based, in part, on the domain name of the responding server. Web pages can also be classified, and monitored to determine their response time.
1. A method comprising
identifying, at a gateway, an IP flow from traffic data in a communication network, the IP flow including two or more packets having common transport level end points;
assigning a preliminary classification indicative of at least a priority to the IP flow based on protocol information contained in a first packet of the IP flow;
creating an entry in an IP flow cache which maintains information pertaining to all open IP flows;
consulting a cache including previous domain name and server IP address associations obtained from analysis of prior IP flow and/or UDP domain name lookups;
determining a domain name associated with a server end of the IP flow based on the consulting;
associating the domain name with the IP flow; and
assigning an initial classification indicative of at least a priority to the IP flow based, at least in part, on the domain name and an early classification cache lookup, wherein entries in the early classification cache are keyed either by a network identifier index, domain name, and server port number, or by a network identifier index, server domain, and server port number,
wherein the initial classification replaces the preliminary classification.
2. The method of claim 1 , wherein the preliminary classification is further based on the first packet's IP address, port number, size, one or more classification override rules, or a combination thereof.
3. The method of claim 1 , further comprising updating the cache based on the assigned initial classification.
4. The method of claim 1 , further comprising:
monitoring the IP flow to determine a size, arrival time, or both for packets arriving after assigning the initial classification; and
reclassifying the IP flow based, at least in part, on results of the monitoring and one or more classification override rules.
5. The method of claim 4 , wherein reclassifying the IP flow is only performed if a classification of the reclassified IP flow: differs from the initial classification, results in a higher priority classification than the initial classification, more accurately represents the IP flow, or a combination thereof.
6. The method of claim 4 , further comprising updating the cache based on the reclassified IP flow.
7. A gateway comprising
one or more processors configured to:
identify an IP flow from traffic data in a communication network, the IP flow including two or more packets having common transport level end points;
assign a preliminary classification indicative of at least a priority to the IP flow based on protocol information contained in a first packet of the IP flow;
create an entry in an IP flow cache which maintains information pertaining to all open IP flows;
consult a cache including previous domain name and server IP address associations obtained from analysis of prior IP flow and/or UDP domain name lookups;
determine a domain name associated with a server end of the IP flow based on the consulting;
associate the domain name with the IP flow; and
assign an initial classification indicative of at least a priority to the IP flow based, at least in part, on the domain name and an early classification cache lookup, wherein entries in the early classification cache are keyed either by a network identifier index, domain name, and server port number, or by a network identifier index, server domain, and server port number,
wherein the initial classification replaces the preliminary classification.
8. The gateway of claim 7 , wherein the preliminary classification is further based on the first packet's IP address, port number, size, one or more classification override rules, or a combination thereof.
9. The gateway of claim 7 , further comprising updating the cache based on the assigned initial classification.
10. The gateway of claim 7 , further comprising:
monitoring the IP flow to determine a size, arrival time, or both for packets arriving after assigning the initial classification; and
reclassifying the IP flow based, at least in part, on results of the monitoring and one or more classification override rules.
11. The gateway of claim 10 , wherein reclassifying the IP flow is only performed if a classification of the reclassified IP flow: differs from the initial classification, results in a higher priority classification than the initial classification, more accurately represents the IP flow, or a combination thereof.
12. The gateway of claim 10 , further comprising updating the cache based on the reclassified IP flow.