Method for caching lookups based upon TCP traffic flow characteristics
View Patent ↗The classification system of a network device includes a cache in which a mapping between predefined characteristics of TCP/IP packets and associated actions are stored in response to the first “Frequent Flyer” packet in of a session. Selected characteristics from subsequent received packets of that session are correlated with the predefined characteristics and the stored actions are applied to the received packets if the selected characteristics and the predefined characteristics match, thus reducing the processing required for subsequent packets. The packets selected for caching may be data packets. For mismatched characteristics, the full packet search of the classification system is used to determine the action to apply to the received packet.
1. A method of classifying packets in a communications network comprising acts of:
(a) receiving packets in a network device;
(b) determining data packets present in received packets and identifying which packets are frequent flyer packets by:
(i) providing a cache in which predefined characteristics of packets and actions associated with selected ones of the predefined characteristics are stored;
(ii) for each data packet so determined, correlating selected characteristics of said each data packet with the predefined characteristics in said cache;
(iii) for each data packet with selected characteristics matching one of the predefined characteristics imposing on said each data packet the action associated with said one of the predefined characteristics, wherein the packets include TCP/IP packets, and wherein the determining act further includes the acts of:
(c) examining control bits in the TCP header;
(i) if selected ones of said control bits are set to a first state, examining a length field in the IP header to determine its value;
(ii) multiplying a value in the data offset field in the TCP header by 4; and
(iii) subtracting the result of the multiplication from the value in the length field; and
(d) updating contents of the cache at times that correspond to an expected burst interval of packets identified as frequency flyer packets.
2. The method of claim 1 wherein the first state includes logical “0”.
3. The method of claim 1 wherein the selected ones of said control bits include SYN, FIN and RST.