Apparatus, method, and software for analyzing network traffic in a service aware network
The present invention generally relates to a method for describing network events in a service aware network (“SAN”). In addition, the present invention relates to software that performs the method and has a programming model containing protocol libraries, abstract protocol messages declarations, and network events. The method and software enable a user to define basic as well as complex network events in the application, presentation, session, transport and/or network layers of a communication model, which result in internet protocol (“IP”) level triggers or other triggers. Such triggers will result in actions which may be applicable in all layers of a communication model up to the highest layer. As a result, the method and software allow a user to describe a hierarchy of high level network events through a hierarchy of lower level events. In addition, a development system and an apparatus which utilizes the method and software are also provided.
1. A method for high level event-based monitoring, classifying, and control of a network system, comprising:
defining an event that occurs in the network system corresponding to at least one of application, presentation, session, transport and network layers of a communication model;
defining a match instruction in an open programming language which is operative to identify packet traffic belonging to a specified peer-to-peer protocol, said match instruction accepting as an argument a protocol message associated with said specifies peer-to-peer protocol;
defining a concurrent operation via a concurrent instruction containing at least two sub-instructions which are concurrently executed until a sub-instruction is completed, such that the concurrent operation includes at least two other operations to be concurrently performed over the network system;
detecting said event;
responsively upon detecting said event, identifying packet traffic belonging to said specified peer-to-peer protocol according to said match instruction; and
controlling at least a portion of the network system based on said identifying packet traffic belonging to said specified peer-to-peer protocol, by executing said concurrent operation;
wherein said event is a download flow.
2. An apparatus for high level event-based monitoring, classifying, and control of a network system, comprising:
an interface coupled to the network system; and
a processor operative to:
detect a predefined event that occurs in the network system, corresponding to at least one of application, presentation, session, transport, and network layers of a communication model;
identify, responsively upon detecting said event, packet traffic belonging to a specified peer-to-peer protocol by executing a match instruction accepting as an argument a protocol message associated with said specified peer-to-peer protocol;
execute a concurrent instruction containing at least two sub-instructions which are concurrently executed until a sub-instruction is completed; and
control at least a portion of the network system when said packet traffic belonging to said specified peer-to-peer protocol is detected, by executing
said predetermined concurrent operation which includes at least two other operations to be concurrently performed over the network system;
wherein said event is a download flow.
3. A disk containing a software program with instructions for causing a processor to perform a routine, comprising:
defining an event that occurs in the network system corresponding to at least one of application, presentation, session, transport and network layers of a communication model;
defining a match instruction in an open programming language which is operative to identify packet traffic belonging to a specified peer-to-peer protocol, said match instruction accepting as an argument a protocol message associated with said specified peer-to-peer protocol;
defining a concurrent operation via a concurrent instruction containing at least two sub-instructions which are concurrently executed until a sub-instruction is completed, such that the concurrent operation includes at least two other operations to be concurrently performed over the network system;
detecting said event;
responsively upon detecting said event, identifying packet traffic belonging to said specified peer-to-peer protocol according to said match instruction; and
controlling at least a portion of the network system based on said identifying packet traffic belonging to said specified peer-to-peer protocol, by executing said concurrent operation;
wherein said event is a download flow.
4. A memory containing a software program with instructions for causing a processor to perform a routine, comprising:
defining an event that occurs in the network system corresponding to at least one of application, presentation, session, transport and network layers of a communication model;
defining a match instruction in an open programming language which is operative to identify packet traffic belonging to a specified peer-to-peer protocol, said match instruction accepting as an argument a protocol message associated with said specified peer-to-peer protocol;
defining a concurrent operation via a concurrent instruction containing at least two sub-instructions which are concurrently executed until a sub-instruction is completed, such that the concurrent operation includes at least two other operations to be concurrently performed over the network system;
detecting said event;
responsively upon detecting said event, identifying packet traffic belonging to said specified peer-to-peer protocol according to said match instruction; and
controlling at least a portion of the network system based on said identifying packet traffic belonging to said specified peer-to-peer protocol, by executing said concurrent operation;
wherein said event is a download flow.