Cisco Technology, Inc.

Tefcros Anthias

Sandeep Kumar

Ricky Keangpo Ho

Sunil Potti

Kollivakkam Raghavan

Saravanakumar Rajendran

Alex Yiu-Man Chan

Karempudi V Ramarao

Pravin Singhal

Subramanian Srinivasan

Yi Jin

Stephen Cho

Nitesh Trikha

Praveen Joshi

Raj K De Datta

Christopher Wiborg

Yuquan Jiang

Steve Phillips

Subramanian N Iyer

Parley Van Oleson

Rahul Tripathi

Christopher R Wiborg

A method is disclosed for high-speed processing of structured application messages in a network device. According to one aspect, a network device receives a set of message classification rules that have been prepared beforehand by a system administrator or customer. The system analyzes the message classification rules to determine what part(s) of the message are necessary to classify a message according to the message classification rules. This allows the system to consider only the relevant parts of the message and ignore the rest of the message. The system extracts the portion of the message necessary for classifying the message and classifies the message using the values of the extracted information and the message classification rules. A unique sequence of operations is implied by the message classification and those operations must then be applied to the message.

Method and apparatus for high-speed processing of structured application messages in a network device

A method is disclosed for performing message payload processing functions in a network element on behalf of an application. According to one aspect, a network element intercepts data packets comprising network layer or transport layer headers having an address of a destination which destination differs from the network element. The network element determines whether information contained in layer 2-4 headers of the data packet satisfies specified criteria. If the information satisfies the specified criteria, the network element directs the data packets to a blade of the network element that performs processing based on an application layer message at least partially contained in the data packets. If the information does not satisfy the specified criteria, the network element forwards the data packets towards the destination without sending them to the blade.

Performing message payload processing functions in a network element on behalf of an application

A network infrastructure element such as a router or switch performs transparent and optimized validation of XML schemas of XML payloads received in the network element. The network element comprises logic for receiving and storing one or more validation scope rules that define a portion of an extensible markup language (XML) schema for validation; receiving and storing the XML schema; receiving over the network an application-layer message comprising one or more of the packets; identifying a particular XML element in an XML payload of the application-layer message, wherein the particular XML element is within the portion of the XML schema defined in the one or more validation scope rules; determining whether the particular XML element conforms to the XML schema; and performing a responsive action based on whether the particular XML element conforms to the XML schema.

XML message validation in a network infrastructure element

A method is disclosed by which network elements such as packet routers and packet switches guarantee the delivery of application layer messages within a network. According to one aspect, a first network element retrieves an application layer message from a source message queue, adds a message identifier to the application layer message, encapsulates the application layer message into data packets, and sends the data packets toward a destination application. A second network element intercepts the data packets, determines the application layer message from payload portions of the data packets, determines the message identifier from the application layer message, stores the application layer message in a destination message queue, generates an acknowledgement message that contains the message identifier, and sends the acknowledgement message toward a source application. The first network element intercepts the acknowledgement message and concludes that the application layer message within the matching message identifier was successfully delivered.

Guaranteed delivery of application layer messages by a network element

A method is disclosed for generating a network topology representation based on inspection of application messages at a network device. According to one aspect, a network device receives a request packet, routes the packet to the destination, and extracts and stores correlation information from a copy of the request packet. When the network device receives a response packet, it examines the contents of a copy of the response packet using context-based correlation rules and matches the response packet with the appropriate stored request packet correlation information. It analyzes recorded correlation information to determine application-to-application mapping and calculate application response times. Another embodiment inserts custom headers that contain information used to match a response packet with a request packet into request packets.

Method and apparatus for generating a network topology representation based on inspection of application messages at a network device

A method is disclosed for performing message payload processing functions in a network element on behalf of an application. According to one aspect, a network element receives user-specified input that indicates a particular message classification. The network element also receives one or more data packets. Based on the data packets, the network element determines that an application layer message, which is collectively contained in payload portions of the data packets, matches the particular message classification. The network element processes at least a portion of the message by performing, on behalf of the application to which the message is directed, and relative to at least the portion of the message, one or more actions that are (a) specified in the user-specified input and (b) associated with the particular message classification.

Custom or user-defined application program extensions may be loaded into a network infrastructure element such as a router or switch without restarting the device. For example, a network element has program extensibility logic operable for receiving one or more user program extensions that comprise logic operable to interface with the application program and perform message processing functions or protocol processing functions that are not in the application program; installing the one or more user program extensions without restarting the apparatus; receiving one or more packets representing an application message; selecting a particular one of the user program extensions based on a protocol associated with the message; loading the particular one of the user program extensions; executing business logic of the application program associated with the received message; and invoking a function of the particular one of the user program extensions in response to a call in the business logic.

Dynamically adding application logic and protocol adapters to a programmable network element

A network element such as a router or switch provides application-level quality of service for application-layer messages processed in the network element, using application QoS logic which when executed by the one or more processors is operable to cause receiving an application-layer message; matching one or more attributes of the application-layer message to the message classification rules; determining a message classification of the application-layer message based on the matching; selecting one of the network-level QoS values using the mapping and based on the determined message classification; and marking a network-level header of the application-layer message using the selected QoS value. As a result, attributes of application messages at OSI Layer 5, 6, or 7 can be used to determine how to mark packets of the messages with QoS values at OSI Layer 2, 3 or 4, integrating application-level concepts of order and priority into network-layer QoS mechanisms.

Applying quality of service to application messages in network elements

A method is disclosed for reducing the sizes of application layer messages in a network element such as a network switch or router. According to one aspect, the network element receives data packets and determines an original application layer message that is collectively contained in payload portions of the data packets. The network element compresses the original application layer message into a compressed message, and sends the compressed message toward an application that is hosted on a device other than the network element. According to another aspect, the network element receives data packets and determines a compressed message that is collectively contained in payload portions of the data packets. The network element decompresses the compressed message into an original application layer message, and sends the original application layer message toward an application that is hosted on a device other than the network element. Compressed messages consume less network bandwidth.

Reducing the sizes of application layer messages in a network element

A method is disclosed for interpreting an application message at a network element using sampling and heuristics. Using this method, a network element such as a router can determine, based solely on a data packet's packet headers, whether the network element ought to invest the time and processing power required to inspect and interpret the data packet's payload portion, or whether the network element can send the data packet toward the data packet's destination without inspecting and interpreting the data packet's payload portion. According to one aspect, while in a sampling state, the network element determines shared packet header characteristics possessed by packet headers of all data packets that require application layer message inspection. While in a processing state, the network element forgoes application layer message inspection relative to data packets whose packet headers do not possess the shared packet header characteristics. The network element alternates between the states.

Interpreting an application message at a network element using sampling and heuristics

Techniques are provided for performing security functions on a message payload in a network element. According to one aspect, a network element receives one or more data packets. The network element performs a security function on at least a portion of an application layer message that is contained in one or more payload portions of the one or more data packets. According to another aspect, a network element receives a first request that is destined for a first application. The network element sends, to a second application that sent the first request, a second request for authentication information. The network element receives the authentication information and determines whether the authentication information is valid. If the authentication information is not valid, then the network element prevents the first request from being sent to the first application.

Growing community of inventors

Los Altos, CA, United States of America

Tefcros Anthias