Cisco Technology, Inc.

Assi Abramovitz

Ofer Weill

Doron Oz

Alon Maor

Doron Jacoby

In one embodiment, a data packet is received at a network device. A layer-2 identification (L2ID) value is identified for the received data packet based on a destination address and a label stack of the received data packet. The L2ID value is specific to an application associated with the data packet. A 6-tuple is created that includes the L2ID value. The received data packet is classified using the 6-tuple. Deep packet inspection (DPI) services are performed based on the classification of the received data packet. The DPI services apply a set of one or more application-level policies to the received data packet. The received data packet is forwarded from the network device toward a destination.

Method and apparatus for self-learning of VPNS from combinations of unidirectional tunnels in MPLS/VPN networks

A technique is provided for implementing deep-packet inspection (DPI) services in a MPLS/VPN configured computer network. The technique employs a novel self-learning algorithm that analyzes data packets belonging to different unidirectional tunnels in the MPLS/VPN network and determines whether the analyzed data packets transport data in the same VPN. If so, the unidirectional tunnels containing the analyzed data packets are associated with a common layer-2 identification (L2ID) value. Unlike conventional flow-classification procedures, the inventive technique classifies a data packet by first associating the data packet with a L2ID value and then classifying the packet as belonging to a particular data flow based on a novel 6-tuple consisting of a conventional 5-tuple plus the packet's L2ID value. Because unidirectional tunnels corresponding to the same application data flow transport data packets having the same set of 6-tuple values, DPI services can apply application-level policies to classified data packets consistent with their 6-tuple flow classifications.

Method and apparatus for self-learning of VPNS from combination of unidirectional tunnels in MPLS/VPN networks

In one embodiment, flows are monitored that are open for a length of time until ending by either a distinct ending or by being silent longer than a configured aging timer (wherein a silent flow is a 'zombie flow'). In response to each first flow ending, a total flow time value may be increased by a length of time that first flow was open, and in response to each second flow ending by aging, a zombie flow time value may be increased by the aging timer. A ratio of zombie flows at a particular time in the computer network that will be ended by aging may be estimated as the zombie flow time value divided by the total flow time value. Also, in other embodiments, a capacity improvement, performance hit, and accuracy hit may be predicted based on a new aging timer value.

Growing community of inventors

Tel Aviv, Israel

Assi Abramovitz