Keysight Technologies, Inc.

Anue Systems, Inc.

Keysight Technologies Singapore (holdings) Pte. Ltd.

Ixia

Keysight Technologies Singapore (sales) Pte. Ltd.

Keysight Technologies Singapore Pte. Ltd.

Shardendu Pandey

Stefan Jan Johansson

Robin Lee O'Connor

Scott Walker Register

David W McGhee

Keith E Cheney

Jonathan Lee Harrod

Glenn Chagnot

Charles Albert Webb, Iii

Jonathan Glenn Stroud

Gregory S Hilton

Patricia A Abkowitz

Deepesh Arora

Alan Richard Schwenk

Bogdan Tenea

Cary J Wright

Bogdan Ţenea

Fred Strelzoff

Keith E Chaney

Jeffrey L Pochop, Jr

Salomon Noubieli Tatang

Jason Chia-Suan Wang

Scott Register

A method for selectively processing a packet flow using a flow inspection engine is disclosed. The method includes receiving, by at least one hardware data plane processor component in a network packet broker, a plurality of packets associated with a packet flow, and forwarding, by the at least one hardware data plane processor component to at least one flow inspection engine, a copy of at least a portion of one or more of the initial packets of the packet flow. The method further includes providing, by the at least one hardware data plane processor component to the at least one flow inspection engine, packet flow statistical data resulting from a high throughput processing of the plurality of packets by the at least one hardware data plane processor component and generating, by the at least one flow inspection engine, metadata records using the copy at least a portion of the of the one or more of the initial packets and the packet flow statistical data, wherein the at least one hardware data plane processor component generates the statistical data from the plurality of packets independent of any instruction from the at least one flow inspection engine.

Methods, systems, and computer readable media for selectively processing a packet flow using a flow inspection engine

A method for network flow metadata processing at a network packet broker is described herein. The method includes, receiving, as input at a network packet broker, network traffic flow data, aggregating the network traffic flow data over a predefined time period to generate Internet protocol (IP) flow feature vectors containing metadata parameters associated with one or more particular endpoint devices, and providing the IP flow feature vectors to a machine learning element in the network packet broker. The method further includes identifying, by the machine learning element, anomalies existing in the metadata parameters included in the IP flow feature vectors, and automatically configuring one or more filter elements in the network packet broker in response to detecting the identified anomalies of the IP flow feature vectors.

Methods, systems, and computer readable media for utilizing machine learning to automatically configure filters at a network packet broker

According to one method for control plane traffic filtering in a control and user plane separation (CUPS) environment, the method occurs at a network node implemented using at least one processor and at least one memory. The method includes receiving, from one or more sources, network location information associated with a first network location; receiving control plane messages for different network locations; filtering the control plane messages based on the network location information; and sending traffic including data from the filtered control plane messages to at least one network tool.

Methods, systems, and computer readable media for control plane traffic filtering in a control and user plane separation (CUPS) environment

Systems and methods are disclosed for subscriber sampling for network packet forwarding based upon unique subscriber identifiers. Control packets within input packets are processed to identify unique subscriber identifiers and related session identifiers, which are stored in records within a tracking table. Each input packet is analyzed to extract a session identifier and a unique subscriber identifier if present within the input packet. When a unique subscriber identifier is not present, the tracking table is accessed to determine a unique subscriber identifier associated with the session identifier extracted from the packet. The input packet is sampled based upon the unique subscriber identifier to determine whether or not to output the input packet as a sampled packet. The subscriber sampling can include hash-based sampling, dynamic function based sampling, and/or other subscriber/call based sampling methods. Sampled packets are forwarded to egress port(s) for further processing.

Subscriber sampling for network packet forwarding based upon unique subscriber identifiers

Systems and methods provide concurrent security processing for multiple network security tools. An input packet is received at a network packet forwarding system from a network packet source, and the network packet forwarding system concurrently sends an output packet based upon the input packet to multiple security tools. Return packets are received based upon the output packet from the security tools after their respective security processing. Once return packets are received from each of the security tools, the network packet forwarding system forwards a secure packet to a packet destination. If a timeout occurs before all return packets are received, the network packet forwarding system can assume that the original packet was unsafe and discard information stored for the input packet. If security tools are configured to modify packets, these modifications can also be tracked.

Concurrent security processing of network packets by multiple in-line network security tools

The subject matter described herein includes methods, systems, and computer readable media for correlating, load balancing and filtering tapped GTP and non-GTP packets. One method for correlating, load balancing and filtering tapped GTP and non-GTP packets includes receiving GTP packets tapped from a plurality of GTP network tap points. The method further includes receiving non-GTP packets tapped from at least one non-GTP network tap point. The method further includes correlating GTP packets with non-GTP packets for a particular subscriber. The method further includes forwarding the GTP packets and non-GTP packets correlated for the particular subscriber to a network monitoring tool.

Correlating tapped general packet radio service (GPRS) tunneling protocol (GTP) and non-GTP packets for a subscriber's session for load balancing and filtering monitored traffic in a mobile network

Latency-based timeouts are used for concurrent security processing by multiple in-line network security tools. A network system forwards secure network packets to the tools and uses latency-based timeouts with respect to the return of processed packets from the tools. Initially, the network system measures processing latencies for the tools and sets at least one timeout threshold based upon the processing latencies. The network system then receives an input packet from a network source, generates a timestamp, concurrently sends an output packet to the tools based upon the input packet, tracks return packets from the tools, and determines whether a timeout has occurred with respect to the timeout threshold based upon a difference between the timestamp and a current timestamp. If a timeout does not occur, a secure packet is forwarded to a network destination. If a timeout does occur, return packet tracking for the input packet is ended.

Latency-based timeouts for concurrent security processing of network packets by multiple in-line network security tools

Signature-based latency extraction systems and related methods are disclosed for network packet communications. Disclosed embodiments generate packet signatures (e.g., hash values) for packets received with respect to points within a network packet communication system. For each received packet, its packet signature is compared to packet signatures stored for previously received packets. If no match is found, the packet signature and a timestamp associated with the newly received packet are stored within one or more packet data tables. If a match is found, then the difference between the timestamp associated with the newly received packet and a timestamp stored with the matching packet signature are used to determine a latency value. The latency values can then be used to determine a variety of latency-related parameters for the network infrastructure being measured, and classification information can also be used to generate latency-related histograms. A variety of embodiments can be implemented.

Signature-based latency extraction systems and related methods for network packet communications

Traffic differentiator systems for network devices and related methods are disclosed that determine difference packets from multiple packet streams. Some embodiments are configured to receive two streams of packets with one stream being a processed version of another stream and then to determine difference packets within a lookup time window that is, for example, associated with a processing time for the second stream to be a processed version of the first stream. Difference packets within a lookup time window can also be determined for packets received within a single combined stream of packets. Difference packets and/or related statistical information is then output for additional processing, as desired. The streams of packets can be associated with ingress and egress packets for a network device, and the difference packets and related statistical information can be used to determine packets that are removed, added, and/or modified by the network device.

Traffic differentiator systems for network devices and related methods

Systems and methods are disclosed for mobile user identification and tracking for load balancing in packet processing systems. Packet processing systems, such as network tool optimizer (NTO) systems, are configured to receive packets associated with multiple mobile users, to extract user identification information from the packets, to store identity binding information for the mobile users, to track changes in identification information for mobile users within a communication system by analyzing control information within packets for the communication system, and to forward packets to one or more tool ports associated with the packet processing system. The packet processing systems disclosed thereby allow for user packets to be identified and sent to the same load-balanced network tool, even though the user identification information changes over time within the communication system. The disclosed embodiments are useful for a wide variety of mobile and/or non-mobile communication systems and related communication protocols.

Mobile user identification and tracking for load balancing in packet processing systems

Systems and methods are disclosed for modifying network packets to use unrecognized headers/fields for packet classification and forwarding in packet processing systems, such as network tool optimizer (NTO) devices. The packet modifications described allow standard switch or routing integrated circuits (ICs) to process, classify, and forward packets based upon data that is not typically recognized by the hardware capabilities of the standard packet routing circuitry for packet processing. Input packets are modified so that unrecognized data becomes recognized data for purposes of packet processing, classification, and forwarding by the packet routing circuitry. These modifications are then removed after packets are processed to reform the original packets. The original packets are then provided to destination devices based upon packet classification and forwarding control information. As such, packet processing, classification, and forwarding is provided in packet processing systems using headers/fields that are not supported for processing by standard switch or routing integrated circuits (ICs).

Systems and methods for modifying network packets to use unrecognized headers/fields for packet classification and forwarding

Systems and methods are disclosed for in-line removal of duplicate network packets in network packet streams operating at high speeds (e.g., 1-10 Gbps and above). A hash generator applies at least one hash algorithm to incoming packets to form one or more different hash values. The packet deduplication systems and methods then use the one or more hash values for each incoming packet to identify data stored for previously received backs and use the identified data to determine if incoming packets are duplicate packets. Duplicate packets are then removed from the output packet stream thereby reducing duplicate packets for downstream processing. A deduplication window can further be utilized to limit the amount of data stored for previous packets based upon one or more parameters, such as an amount of time that has passed and/or a number of packets for which data has been stored. These parameters can also be selected, configured and/or adjusted to achieve desired operational objectives.

Growing community of inventors

Cedar Park, TX, United States of America

Shardendu Pandey