WO2016175957A1 - Signature-based latency extraction systems and related methods for network packet communications - Google Patents
Signature-based latency extraction systems and related methods for network packet communications Download PDFInfo
- Publication number
- WO2016175957A1 WO2016175957A1 PCT/US2016/024449 US2016024449W WO2016175957A1 WO 2016175957 A1 WO2016175957 A1 WO 2016175957A1 US 2016024449 W US2016024449 W US 2016024449W WO 2016175957 A1 WO2016175957 A1 WO 2016175957A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- packet
- latency
- signature
- packets
- received
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 68
- 238000004891 communication Methods 0.000 title claims abstract description 60
- 238000000605 extraction Methods 0.000 title abstract description 65
- 239000000872 buffer Substances 0.000 claims description 54
- 230000032683 aging Effects 0.000 claims description 51
- 230000004044 response Effects 0.000 claims description 33
- 238000001514 detection method Methods 0.000 claims description 12
- 238000012545 processing Methods 0.000 description 88
- 238000010586 diagram Methods 0.000 description 18
- 238000004422 calculation algorithm Methods 0.000 description 14
- 230000008901 benefit Effects 0.000 description 11
- 230000008569 process Effects 0.000 description 9
- 230000006870 function Effects 0.000 description 8
- 238000013500 data storage Methods 0.000 description 6
- 238000007726 management method Methods 0.000 description 5
- 238000005259 measurement Methods 0.000 description 5
- 108091006595 SLC15A3 Proteins 0.000 description 4
- 102100021485 Solute carrier family 15 member 3 Human genes 0.000 description 4
- 238000004458 analytical method Methods 0.000 description 4
- 101100138677 Arabidopsis thaliana NPF8.1 gene Proteins 0.000 description 3
- 101100031674 Arabidopsis thaliana NPF8.3 gene Proteins 0.000 description 3
- 101150059273 PTR1 gene Proteins 0.000 description 3
- 101100262635 Saccharomyces cerevisiae (strain ATCC 204508 / S288c) UBR1 gene Proteins 0.000 description 3
- 101100235787 Schizosaccharomyces pombe (strain 972 / ATCC 24843) pim1 gene Proteins 0.000 description 3
- 238000003491 array Methods 0.000 description 3
- 230000001934 delay Effects 0.000 description 3
- 239000000284 extract Substances 0.000 description 3
- 101150114015 ptr-2 gene Proteins 0.000 description 3
- 238000012360 testing method Methods 0.000 description 3
- 101000609957 Homo sapiens PTB-containing, cubilin and LRP1-interacting protein Proteins 0.000 description 2
- 101150109471 PID2 gene Proteins 0.000 description 2
- 102100039157 PTB-containing, cubilin and LRP1-interacting protein Human genes 0.000 description 2
- 208000034953 Twin anemia-polycythemia sequence Diseases 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 239000000835 fiber Substances 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000006855 networking Effects 0.000 description 2
- 235000008694 Humulus lupulus Nutrition 0.000 description 1
- 241000596871 Ixia Species 0.000 description 1
- 230000002411 adverse Effects 0.000 description 1
- 238000007635 classification algorithm Methods 0.000 description 1
- 125000004122 cyclic group Chemical group 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000004513 sizing Methods 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
- 238000009827 uniform distribution Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0852—Delays
- H04L43/087—Jitter
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0852—Delays
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/12—Network monitoring probes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/026—Capturing of monitoring data using flow identification
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/04—Processing captured monitoring data, e.g. for logfile generation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0852—Delays
- H04L43/0864—Round trip delays
Definitions
- This invention relates to network packet communication systems and, more particularly, to latency measurements for network packet communications.
- Certain network communication systems utilize network packets for network communications. It is often desirable to monitor network traffic associated with these packet-based networks. To meet these monitoring needs, copies of network packets can be forwarded to diagnostic network monitoring tools. Packets are often forwarded using network hubs, test access ports (TAPs), and/or switched port analyzer (SPAN) ports available on network switch systems. For example, certain network switch systems produced by Cisco Systems include SPAN ports to which traffic on the switches is mirrored. Other techniques can also be used to extract copies of network packets being communicated within a network packet communication system.
- Another technique to measure latency due to packet delay is to send special timing packets (e.g., pings) and to measure delay associated with special timing response packets through timestamps added to the timing packets and the timing response packets.
- PTP Precision Time Protocol
- NTP Network Time Protocol
- packet signatures e.g., hash values
- packet signatures For each received packet, its packet signature is compared to packet signatures stored for previously received packets. If no match is found, the packet signature and a timestamp associated with the newly received packet are stored within one or more packet data tables. If a match is found, then the difference between the timestamp associated with the newly received packet and a timestamp stored with the matching packet signature are used to determine a latency value associated with the newly received packet. The resulting latency values can be stored within a latency data table.
- this latency data table can also be serialized such that it provides an ordered sequence of latency values based upon when packets are received by a reference port. Sequence pointers for the latency data table can be generated and used to provide this sequential ordering. Received packets can also be tagged with port identifiers (e.g., port numbers) for input ports that receive packets, and these port identifiers can be stored and used during signature matching for received packets.
- the latency values can be used to determine latency-related parameters for the network infrastructure being measured, such as average latency, minimum latency, maximum latency, packet delay variation or jitter, and/or other latency-related parameters.
- Classification information can also be generated for the received packets, and this classification information can be used to generate and update latency-related histograms for the received packets based upon common classifications.
- the received packets can also represent request/response packet pairs associated with one or more applications operating within the network packet communication system, and the resulting latency values can represent network/application level delay.
- Other variations can also be implemented, and related systems and methods can be utilized, as well.
- a method to measure network packet latency including receiving packets at a first input port associated with a first point within a network packet communication system, receiving packets at a second input port associated with a second point within the network packet communication system, and for each received packet the method includes generating a packet signature or the packet, comparing the packet signature to packet signatures stored in a signature table, storing the packet signature within the signature table along with a timestamp associated with the received packet if a signature match is not found, and determining a latency value for the received packet based upon a timestamp associated with the received packet and a timestamp associated with the matching packet signature within the signature table if a signature match is found.
- the method includes generating hash values as the packet signatures for the received packets, the hash values being based upon selected portions of the received packets.
- the packets received at the input ports include timestamps.
- the method includes generating a timestamp for each packet when the packet is received at the first input port or the second input port.
- the received packets include request packets and response packets associated with the request packets, and matching packet signatures are configured to pair a response packet to its associated request packet.
- the method includes storing the latency values in a latency table and using the stored latency values to determine one or more latency related parameters for the network packet communication system.
- the method includes selecting one of the input ports as a reference port, generating sequence pointers for the latency table based upon an order in which packets are received at the reference port, and using the sequence pointers to order the latency values stored in the latency table.
- the method can include using the ordered latency values within the latency table to determine one or more latency related parameters for the network packet communication system.
- the one or more latency related parameters can include packet delay variation.
- the method includes storing a port identifier associated with the received packet along with the hash value and the timestamp if a signature match is not found, and a latency value is determined if a signature match is found only if a port identifier associated with the received packet does not match a port identifier stored for the matching packet within the signature table.
- the method includes storing the packet signature for each received packet within an aging buffer, and after a detection time window, removing the packet signature from the aging buffer. In further embodiments, the method includes comparing each removed packet signature to packet signatures within the signature table and removing any matching packet signature and related timestamp from the signature table. In still further embodiments, the method includes relying upon a size of the aging buffer to determine when packet signatures are removed from the aging buffer. In additional embodiments, the method includes storing the timestamp associated with each packet signature in the aging buffer, and using the timestamp associated with each packet signature to determine when each packet signature is removed from the aging buffer.
- the method includes classifying each packet based upon contents of the packet to generate a packet classification, and using the packet classification to update histogram information about packets having a common packet classification. Still further, the histogram information can include latency information based upon the latency values.
- a system to measure latency for network packets including a first input port configured to receive packets associated with a first point within a network packet communication system, a second input port configured to receive packets associated with a second point within the network packet communication system, one or more packet signature generators configured to generate a packet signature for each received packet, a signature table configured to store packet signatures and timestamps, and a latency processor configured to compare the packet signature for each received packet to packet signatures stored in the signature table, to store the packet signature within the signature table along with a timestamp associated with the received packet if a signature match is not found, and to determine a latency value for the received packet based upon a timestamp associated with the received packet and a timestamp associated with the matching packet signature within the signature table if a signature match is found.
- the one or more packet signature generators include one or more hash generators configured to generate hash values as the packet signatures for the received packets, the hash values being based upon selected portions of the received packets.
- the latency processor is configured to obtain timestamps from the packets received at the input ports.
- the system includes one or more timestamp generators configured to generate a timestamp for each packet received at the first input port or the second input port.
- the received packets include request packets and response packets associated with the request packets, and matching packet signatures are configured to pair a response packet to its associated request packet.
- the latency processor is further configured to store the latency values in a latency table and to determine one or more latency related parameters for the network packet communication system based upon the stored latency values.
- one of the input ports is a reference port
- the latency processor is further configured to generate sequence pointers based upon an order in which packets are received at the reference port and to use the sequence pointers to order the latency values stored in the latency table.
- the latency processor can be further configured to use the ordered latency values within the latency table to determine one or more latency related parameters for the network packet communication system.
- the one or more latency related parameters can include packet delay variation.
- the latency processor is further configured to store a port identifier associated with the received packet along with the hash value and the timestamp if a signature match is not found, and the latency processor is further configured to determine a latency value if a signature match is found only if a port identifier associated with the received packet does not match a port identifier stored for the matching packet within the signature table.
- the system includes an aging buffer
- the latency processor is further configured to store the packet signature for each received packet within the aging buffer and to remove the packet signature from the aging buffer after a detection time window.
- the latency processor is further configured to compare each removed packet signature to packet signatures within the signature table and to remove any matching packet signature and related timestamp from the signature table.
- a size of the aging buffer is configured to determine when packet signatures are removed from the aging buffer.
- the latency processor is further configured to store the timestamp associated with each packet signature in the aging buffer and to use the timestamp associated with each packet signature to determine when each packet signature is removed from the aging buffer.
- the system includes a classification engine configured to generate a packet classification for each packet based upon contents of the packet and to use the packet classification to update histogram information about packets having a common packet classification.
- the histogram information can include latency information based upon the latency values.
- FIG. 1 is a block diagram of an example embodiment for a network packet communications environment including a signature-based latency extraction processing system.
- FIG. 2 is a block diagram of an example embodiment for a signature-based latency extraction processing system that receives and processes packets streams to determine latency and latency-related information associated with packets communicated through network infrastructure.
- FIG. 3A is a process flow diagram of an example embodiment for operation of the latency extraction processing system of FIG. 2 where sequence pointers are stored in a packet signature table.
- FIG. 3B is a process flow diagram of an example embodiment for operation of the latency extraction processing system of FIG. 2 where port identifiers are stored in a packet signature table.
- FIG. 3C is a process flow diagram of an example embodiment for operation of the aging buffer within the latency extraction processing system of FIG. 2.
- FIG. 4 is a block diagram of an example embodiment where the packet traffic being measured represents request/response packet pairs associated with a network application operating within the network packet communication system.
- FIG. 5 is a diagram of an example embodiment for a product configuration as well as external connections for an example latency extraction processing system.
- FIG. 6A is a block diagram of an example embodiment for a virtual machine (VM) host hardware system that creates a virtual environment for a virtual latency extraction processing system.
- VM virtual machine
- FIG. 6B is a block diagram of an example embodiment for a server system including multiple VM environments that host VM platforms implementing one or more latency extraction processing systems as well as other virtual components or devices. Detailed Description of the Invention
- Signature-based latency extraction systems and related methods are disclosed for network packet communications.
- the disclosed embodiments generate packet signatures (e.g., hash values) for packets received with respect to points within a network packet communication system. For each received packet, its packet signature is compared to packet signatures stored for previously received packets. If no match is found, the packet signature and a timestamp associated with the newly received packet are stored within one or more packet data tables. If a match is found, then the difference between the timestamp associated with the newly received packet and a timestamp stored with the matching packet signature are used to determine a latency value associated with the newly received packet. The resulting latency values can be stored within a latency data table.
- packet signatures e.g., hash values
- this latency data table can also be serialized such that it provides an ordered sequence of latency values based upon when packets are received by a reference port. Sequence pointers for the latency data table can be generated and used to provide this sequential ordering. Received packets can also be tagged with port identifiers (e.g., port numbers) for input ports that receive packets, and these port identifiers can be stored and used during signature matching for received packets.
- the latency values can be used to determine latency-related parameters for the network infrastructure being measured, such as average latency, minimum latency, maximum latency, packet delay variation or jitter, and/or other latency-related parameters.
- Classification information can also be generated for the received packets, and this classification information can be used to generate and update latency-related histograms for the received packets based upon common classifications.
- the received packets can also represent request/response packet pairs associated with one or more applications operating within the network packet communication system, and the resulting latency values can represent network/ application level delay.
- Other variations can also be implemented, as desired, and related systems and methods can be utilized, as well.
- the disclosed embodiments provide non-intrusive techniques that measure network latency for packets traveling through network infrastructure by identifying matching packets through packet signatures (e.g., packet hash values) generated for packets received with respect to points within the network packet communication system. Once two matching packets are identified, latency is determined by comparing a first timestamp generated for the packet received at a first point within the network to a second timestamp generated for the packet received at a second point within the network.
- the timestamps can be generated, for example, using one or more high precision timestamp generators.
- the packet signatures and timestamps are stored in a packet signature table, and classification and other desired packet related data can also be stored within one or more additional packet data tables.
- a latency processor determines if the packet signature already exists in the packet signature table. If a match for the packet signature is not found, the packet signature is stored within packet signature table along with the timestamp. If a match for the packet signature is found, latency is determined by comparing the timestamp for the received packet with the timestamp stored in the packet signature table for the matching packet.
- the packet signature and timestamps for received packets can also be stored within an aging buffer (e.g., first-in-first-out (FIFO) buffer). This aging buffer can be sized, for example, such that it stores the packet signatures for a duration that exceeds the maximum expected latency for the network infrastructure being measured.
- FIFO first-in-first-out
- timestamps can also be stored within the aging buffer and used to cause data within the aging before to be aged out and removed from the aging buffer.
- Packet signatures and timestamp data can also be removed from the packet signature table when a packet signature ages out of the aging buffer if a matching packet signature still exists within the packet signature table.
- the resulting latency values for matching packets and other packet related information are stored in one or more latency, classification, and/or other data tables, and this latency and related packet information can be used for additional processing, as desired.
- the packet extraction processing system can be implemented as one or more virtual machines operating within virtual environments hosted by one or more processing devices. A wide variety of variations can also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
- FIG. 1 is a block diagram of an example embodiment 100 for a network packet communication system environment. Packets 102 and packets 112 associated with one or more packet flows are communicated through network infrastructure 110. As described herein, the latency extraction processing system 120 determines network latency and related information associated with the network infrastructure 110 by performing signature-based analysis of packets 102 and packets 112. For the embodiment depicted, a first network TAP (test access port) 104 receives packets 102 and non- intrusively generates copies of these packets. The first TAP 104 can also generate a timestamp associated with receipt of each packet using a timestamp generator 106, although the timestamp generator 106 can also be included within the latency extraction processing system 120 as described herein.
- a first network TAP test access port
- the first TAP 104 can also generate a timestamp associated with receipt of each packet using a timestamp generator 106, although the timestamp generator 106 can also be included within the latency extraction processing system 120 as described herein.
- the resulting packets (PKT1) and related timestamps (TS) are output as a first packet data stream 108 to the latency extraction processing system 120.
- a second network TAP (test access port) 114 receives packets 112 and non-intrusively generates copies of these packets.
- the second TAP 114 can also generate a timestamp associated with receipt of each packet using a timestamp generator 116, although the timestamp generator 116 can also be included within the latency extraction processing system 120 as described herein.
- the resulting packets (PKT2) and related timestamps (TS) are output as a second packet data stream 118 to the latency extraction processing system 120.
- the network infrastructure 110 can be one or more network connected devices that are configured to communicate network packets, and the network infrastructure can also include one or more virtual machines operating within a virtualization layer for a virtual processing system. Further, it is noted that the network packet communications can also include wired, wireless, or wired and wireless network communications.
- the network tap points 104/114 can cover a single network hop or multiple network hops such that a variety of latency measurements can be made with respect to a network packet communication system by adjusting the tap points 104/114 and thereby the network infrastructure 110 being measured for latency.
- the latency extraction processing system 120 receives the first packet data stream 108 and the second packet data stream 118 and generates latency values 136 based upon a comparison of packet signatures 132 generated for packets within these streams 108/118 and timestamps 134 related to these packets.
- One or more packet signature generators 122 generate the packet signatures 132 associated with packets for these incoming packets from streams 108/118.
- one or more hash generators can be used as the packet signature generators 122, and these hash generators can generate hash values as the packet signatures.
- the latency processor 124 which can include one or more processing devices, stores the packet signatures 132 and timestamps 134 associated with received packets from streams 108/118 within one or more packet data tables 130 until matching packets are found. When the latency processor 124 identifies matching packets within the streams 108/118 based upon comparisons of packet signatures 132, the latency processor 124 then uses differences between related timestamps within timestamps 134 to determine latency values 136 for these matching packets with respect to the network infrastructure 110. The latency extraction processing system 120 can also determine, generate, and store other data 138 associated with the received packets within streams 108/118.
- This latency data 136 and other data 138 can then be used for further processing and/or analysis of the network communications by the latency extraction processing system 120, or this data 136/138 can be communicated to one or more additional processing systems for further processing and/or analysis, as desired.
- FIG. 2 is a block diagram of an example embodiment for a latency extraction processing system 120 that receives and processes the packets streams 108/118 to measure latency and to collect related information associated with the packets communicated through the network infrastructure 110.
- the latency extraction processing system 120 includes input ports 202/212, hash generators 122A/122B, classification engines 206/216, a latency processor 124, and packet data tables 130 that include a hash table 220, a latency data table 230, and classification tables 240.
- the timestamp generators 106 and 116 can be included within the latency extraction processing system 120, if desired, instead of relying upon timestamp generators in the first and second TAPS 104/114 to generate timestamps for the received packets.
- the hash generators 122A/122B are used for this example embodiment to implement the packet signature generator(s) 122 shown in FIG. 1.
- the hash generators 122A/122B are depicted as two separate hash generators, the hash generators 122A/122B can also be implemented as a single hash generator that generates hash values for both packet streams 108/118.
- classification engines 206/216 are depicted as two separate classification engines, the classification engines 206/216 can also be implemented as a single classification engine that generates classification data for both packet streams 108/118.
- timestamp generators 106/116 are depicted as two separate timestamp generators, the timestamp generators 106/116 can also be implemented as a single timestamp generator that generates timestamps for both packet streams 108/118.
- latency processor 124 is depicted as a single processor, the latency processor 124 can also be implemented using multiple processing devices, if desired. Other variations could also be implemented.
- the first packet data stream 108 and its related timestamps are received by input port 202.
- the first packet stream 108 can include first packets (PKT1) and related timestamps (TS) from the first TAP 104, although other techniques and devices could also be used to provide the first packet stream and related timestamps.
- PKT1 first packets
- TS related timestamps
- a hash generator 122 A is coupled to the input port 202 and generates hash values 204 for the packets within the first packet data stream 108.
- a classification engine 206 is also coupled to the input port 202 and generates classification information and other packet related data associated with the packets within the first data stream 108.
- the classification engine 206 can be configured to use data from one or more fields within each packet to generate a classification pointer (CL-PTR) for the packet that classifies the packet.
- CL-PTR classification pointer
- Each packet can be classified, for example, by the data type of packet (e.g., audio, video, and/or other data type), by the session or flow associated with the packet (e.g., voice call, email, web services, and or other session/flow types), and/or by other packet related information.
- the classification engine 206 then outputs packet data 208, such as a classification pointer (CL-PTR) and/or other packet data (PKT DATA), to the latency processor 124.
- the hash value 204 and the timestamp (TS) 207 for each packet are also received by the latency processor 124.
- the second packet data stream 118 and its related timestamps are received by input port 212.
- the second packet stream 118 can include second packets (PKT2) and related timestamps (TS) from the second TAP 114, although other techniques and devices could also be used to provide the second packet stream and related timestamps.
- PKT2 second packets
- TS related timestamps
- a hash generator 122B is coupled to the input port 212 and generates hash values 214 for the packets within the second packet data stream 118.
- a classification engine 216 is also coupled to the input port 212 and generates classification information and other packet related data associated with the packets within the second data stream 118.
- the classification engine 216 can be configured to use data from one or more fields within each packet to generate a classification pointer (CL-PTR) for the packet that classifies the packet.
- CL-PTR classification pointer
- Each packet can be classified, for example, by the data type of packet (e.g., audio, video, and/or other data type), by the session or flow associated with the packet (e.g., voice call, email, web services, and/or other session/flow types), and or by other packet related information.
- the classification engine 216 then outputs packet data 218, such as a classification pointer (CL-PTR) and or other packet data (PKT DATA), to the latency processor 124.
- the hash value 214 and the timestamp (TS) 217 for each packet are also received by the latency processor 124.
- the latency processor 124 compares the packet signatures, which are hash values 204/214 for the embodiment of FIG. 2, to previously stored packet signatures and determines latency for matching packet signatures based upon differences between respective timestamps associated with the matching packet signatures. As described in more detail below, the latency processor 124 stores hash values 132, timestamps 134, and sequence pointers 222 in a hash table 220 as packets are received within the packet streams 108/118. In particular, latency processor 124 stores hash values 132 as represented by the hash values (HI, H2, H3 ... HN) in data records within the hash table 220.
- the timestamps 134 associated with these packets are also stored along with the hash values 132 as represented the timestamps (TS 1, TS2, TS3 ... TSN) in hash table 220.
- Sequence pointers (PTR1, PTR2, PTR3 ... PTRN) 222 are also generated and stored in hash table 220 for each stored hash value 132 and timestamp 134 packet.
- the sequence pointers 222 are used to point to and reference latency records within the latency data table 230.
- latency values (LI, L2, L3, ... LN) 136 are determined for matching packets based upon differences in timestamp values, the latency values 136 are stored within a latency record based upon the sequence pointers 222.
- the valid bits (VI, V2, V3 ... VN) 232 for the latency records are initially set to "invalid” states (e.g., logic 0) and are subsequently changed to "valid” states (e.g. , logic 1) when valid latency values are determined after matching packet hashes are found.
- the latency processor 124 compares hash values for newly received packets within packet streams 108/118 to hash values stored in the hash table 220 for previously received packets to identify matching packets. If the hash values match, the latency processor 124 treats the newly received packet as a match to the previously received packet and determines latency associated with the matching packets based upon the difference between the timestamps associated with the matching packet hash values. In particular, if a match is found, the latency processor 124 compares the timestamp for the newly received packet with the timestamp stored within the reference data table 220 for the matching packet.
- the difference value represents the latency for the packet as it traveled through the network infrastructure 110, and this difference value is stored as the latency value 136 within the record of the latency data table 230 pointed to by the sequence pointer 222 for the matching packet hash value within hash table 220. For example, if the hash 204/214 for a newly received packet matches the third hash value P3 in table 220, the associated timestamp TS3 is compared to the timestamp for this newly received packet. The difference value between these two timestamps is then stored as the latency value 136 in the record within the latency data table 230 pointed to by the sequence pointer PTR3.
- the latency value is written as value L2 into the latency data table 230 when the match is found, and the associated valid bit V2 is also set to its "valid" state.
- sequence pointers (PTR1, PTR2, PTR3 ... PTRN) are stored as data 222.
- port identifiers PID1, PID2, PD3 ... PIDN
- sequence pointers PTR1, PTR2, PTR3 ... PTRN
- port identifiers and sequence pointers can both be stored with the hash table 220, and other packet related data can also be stored in the hash table 220, if desired, while still taking advantage of the signature-based latency extraction techniques described herein.
- the latency values 136 stored within the latency data table 230 can be used to generate a variety of latency related information for the packets traveling through the network infrastructure 110.
- the latency values 136 can be used to determine minimum latency, maximum latency, average latency, latency variation (often called jitter), and/or other latency related parameters for packets traveling through the network infrastructure 110.
- latency refers to a measure of delay between when a packet or a packet pair (e.g., request/response packets) appears in time at two different points in a network communication system, such as the difference in time between when a packet appears at the first TAP 104 and the second TAP 114 in FIG.
- the timestamps generated by the timestamp generators 106/116 are configured to provide an accurate time representation of when a given packet is seen at a given point in network communication system, such as when received by the TAPS 104/114 or by the input ports 202/212.
- the timestamp generators 106/116 can also be configured to lock to an accurate time source, such as a GPS (Global Positioning System) clock and/or to a network master clock source, such as one made available through PTP (Precision Time Protocol) or NTP (Network Time Protocol) communications. Other variation can also be implemented.
- the latency processor 124 can also use an aging buffer 250 to store packet data for a selected amount of time within a detection time window.
- the latency processor 124 can store the hash values (HI, H2, H3 ... HN) for the received packets within streams 108/118 within aging buffer 250 (e.g., a first-in-first-out (FIFO) buffer).
- FIFO first-in-first-out
- the detection time window can be determined, for example, through the size of the aging buffer 250.
- the aging buffer 250 can be sized such that it stores the packet hashes for a duration that exceeds the maximum expected latency for the network infrastructure being measured (e.g., 50-100 milliseconds, although other durations could also be used). Further, timestamps (Tl, T2, T3 ... TN) can also be stored within the aging buffer 250 and can be used by the latency processor 124 to determine when a detection time window has passed for packet data such that this aged-out data should be removed.
- timestamps Tl, T2, T3 ... TN
- the latency processor 124 can also cause matching hash values and related timestamps to be removed from the hash table 220 when packet data ages out of the aging buffer 250 if a matching hash value still exists within the hash table 220, for example, after the packet data has been stored with the aging buffer for a predetermined threshold amount of time (e.g. , 50- 100 milliseconds, although other thresholds could also be used).
- a predetermined threshold amount of time e.g. , 50- 100 milliseconds, although other thresholds could also be used.
- the latency processor 124 can also use one or more classification data table(s) 240 to store additional information concerning received packets and matched packets. For example, packet counts for received packets having a particular classification can be stored in classification tables 240 along with packet byte counts for packets contents and/or other packet related data and statistics. As a further example, the classification pointers (CL-PTRs) generated by the classification engines 206/216 can be used to generate latency histograms with respect to packets having common classifications. The classification engines 206/216, for example, can extract data from a set of desired fields within each packet and can then apply one or more classification algorithms to this set of data to generate classification data for packet identification purposes.
- CL-PTRs classification pointers
- Classification hash algorithms can also be applied to the data to compress the amount of information being processed.
- the classification pointers can be generated using data from one or more different fields within each packet.
- a classification pointer (CL-PTR) can be generated for each packet based upon a 5-tuple including source IP (Internet Protocol) address, source port number, destination IP address, destination port number, and network protocol.
- Other techniques could also be used to generate one or more classification pointers.
- Other histograms and or packet parameters can also be generated and stored within the classification tables 240, as desired, with respect packet related data. Other variations could also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
- a maximum (MAX) latency value can be tracked by comparing each new latency value with a previous maximum detected latency value. If the new latency value is greater than the previous maximum latency value, the new latency value is kept as the maximum latency value. If the new latency value is not greater than the previous maximum latency value, the previous maximum latency value is kept as the maximum latency value.
- a minimum (MIN) latency value can be tracked by comparing each new latency value with a previous minimum detected latency value.
- the new latency value is kept as the minimum latency value. If the new latency value is not less than the previous minimum latency value, the previous minimum latency value is kept as the minimum latency value. Further, rather than keeping the maximum (MAX) and minimum (MIN) values as each new latency value is detected, the maximum/minimum latency values can also be determined by analyzing the latency values stored within the latency data table 230 to determine maximum and/or minimum values within the latency data table 230. In addition, an average latency value can also be tracked by dividing the sum of all detected latency values by the number of latency values detected.
- the average latency value can be kept as each new latency value is determined and/or can be determined by analyzing the latency values stored in the latency data table 230.
- Other latency related parameters can also be determined, as desired, and classification data stored in the classification tables 240 can also be used for latency related determinations.
- Other variations can also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
- hash table 220 in the example embodiment of FIG. 2 is implemented as a single hash table.
- hash table 220 could also be implemented as two or more different hash tables.
- a hash table could be associated with each input port 202/212.
- the latency processor 124 when a packet is received at one port, the latency processor 124 is configured to perform a look up within the hash table associated with the other port. The packet data (e.g. , hash and timestamp) can then be stored within the port's hash table if the look up operation does not find a matching packet hash value in the other hash table. Further, the latency processor 124 can be also be distributed such that its functions are split among multiple different latency processors.
- the timestamp generators 106/116, the hash generators 122A/122B, the classification engines 206/216, and/or the latency processor 124 can be distributed geographically such that one or more of the functions described for these components are performed at different geographic locations. This geographic distribution can be implemented, for example, to improve accuracy of measurements such as by locating the timestamp generators 106/116 at the same geographic location as the TAPs 104/114 that generate the copy of the packets being measured.
- the TAPs 104/114 can also be implemented as other devices or components that are configured to generate copies of packet traffic within a network packet communication path.
- switched port analyzer (SPAN) ports on network switches can be used to generate copies of packets being communicated through a network switch.
- the TAPs 104/114 or other packet extraction devices or components can also be located at the same geographic location as the latency extraction processing system 120 or can be remotely located depending upon the network infrastructure 110 being measured.
- one or more packet tunnel protocols can be also be used to forward packets from the TAPs 104/114 or other packet extraction devices or components to the latency extraction processing system 120.
- tags can be added to extracted packets that can be used to identify and classify the packets during later processing.
- latency calculations can be based upon one or more classification parameters associated with the packets and/or tags associated with the packets. These parameters can include, for example, source IP address, destination IP address, source port number, destination port number, network protocol, application, and or other parameter associated with the packet and/or its tag.
- a 5-tuple tag can be used to classify the packet, and this 5-tuple tag can include the source IP address, the destination IP address, the source port, the destination port, and a protocol value. Latency calculations and histograms can then be generated and updated based upon latency values and this classification information.
- the hash generators 122A/122B can be configured to generate hash values based upon one or more hash algorithms that are applied to data within each packet.
- the resulting hash values or keys are used to provide the packet signatures 132, and these hash values or keys effectively reduce the size of the packets (e.g., 128 bytes) to smaller data values (e.g., 32 bits) that can still be used to identify different packets.
- Any desired hash algorithm could be used.
- a hash algorithm is configured to disregard certain fields, such as a TTL (time-to-live) field, that are likely to change as a packet traverses one or more networking devices.
- a source/destination IP (Internet Protocol) addresses may or may not change depending upon networking device(s) and their capabilities and policies. Further, some packets may have Network Address Translation (NAT) applied, and other packets will not have such NAT applied.
- NAT Network Address Translation
- By generating hash values based upon selected portions of the packet that are expected to remain unchanged e.g., source/destination IP addresses, source/destination ports, network protocol
- the resulting hash values can remain consistent for packets as they travel through network infrastructure 110 even if other portions of the packet are modified.
- the disclosed embodiments are able to measure latency for network packets, even if they are modified by network infrastructure 110, by matching packet signatures (e.g., hash values) and by then comparing timestamps associated with matching packet signatures.
- the hash generators 122A/122B are also preferably configured to apply hash algorithms having uniform distribution characteristics such that resulting hash values are generated with even distributions across the range of possible hash values. Further, it is desirable that the hash algorithms generate different hash values for data strings that are different but similar so that similar but different data strings can be distinguished. Other considerations can also be used to select the hash algorithms. It is further noted that SHA-1, MD5, FNV (Fowler-Noll-Vo), and MurmurHash are known algorithms for generating hash values based upon selected input parameters. It is further noted that large cryptographic hash algorithms, such as MD5, may be difficult to utilize for the embodiments described herein because they tend to be complex and slow algorithms.
- PRBS pseudo-random binary sequence
- CRC cyclic redundancy check
- other cyclical polynomial computations e.g. , Reed Solomon
- PRBS pseudo-random binary sequence
- CRC cyclic redundancy check
- Non-cryptographic hash algorithms can also be used to provide hash values.
- a non-cryptographic MurmurHash-type hash algorithm can be used and can be split into multiple 16-bit hash processes that execute in parallel followed by a final series of mixing steps. The mixing steps can be operated at 200 MHz or above, if desired, to generate resulting hash values, such as 32-bit hash values.
- Other variations, hash algorithms, and combinations of has algorithms can also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
- the latency processor 124, the timestamp generators 106/116, the hash generators 122A/122B, and/or classification engines 206/216 can be implemented using one or more processing devices including controllers, microcontrollers, microprocessors, hardware accelerators, configurable logic devices (e.g., field programmable gate arrays), and/or other processing devices. Further, the one or more processing devices can be configured to execute instructions stored in a non-transitory tangible computer-readable medium to perform the functions described herein. In addition, one or more packet data table(s) 130 can be implemented as any desired non-transitory tangible computer-readable medium.
- Such computer readable mediums include, for example, data storage devices, FLASH memory, random access memory, read only memory, programmable memory devices, reprogrammable storage devices, hard drives, floppy disks, DVDs, CD-ROMs, and/or any other non-transitory data storage mediums.
- the latency extraction processing system 120 can also be implemented as one or more virtual machine (VM) platforms operating within a virtual processing environment hosted by one or more host processing systems.
- VM virtual machine
- the network communications can be based upon any desired protocol or combination of protocols including Ethernet protocols, multi-protocol label switching (MPLS) protocols, FibreChannel (FC) protocols and/or any other desired communication protocol that can be used for packet-based network communications.
- MPLS multi-protocol label switching
- FC FibreChannel
- Other implementations could also be used while still taking advantage of the signature-based latency extraction techniques described herein.
- FIG. 3A is a process flow diagram of an example embodiment 300 for operation of the latency extraction processing system 120 as described with respect to the example embodiment of FIG. 2 where sequence pointers are stored as data 222 in the hash table 220.
- a packet is first received in block 302.
- a timestamp (TS) is extracted from the packet data or generated for the packet in block 304.
- the packet is classified in block 306 to generate a classification pointer (CL-PTR).
- a hash value (H) is also generated in block 308 for the packet using contents of the packet.
- Flow passes to block 310 where the timestamp (TS) and the hash value (H) are stored in the aging buffer 250.
- a latency value for the received packet can also be set to an "invalid" state until a valid latency has been measured.
- a determination is made whether a matching hash value exists within the hash table 220.
- classification tables 240 are updated using the classification pointer (CL-PTR), the latency value (L), and other packet data, depending upon the additional classification and other data being collected for the received packets that match previously received packets.
- the valid bit in the latency table 230 is also then set to a "valid" state.
- the matching timestamp (TSM) and hash value (HM) for the matching packet data within the hash table 220 are removed from the hash table 220 along with the sequence pointer 222 stored for that packet data within the hash table 220. From block 322, flow passes back to block 302.
- sequence pointers 222 the valid latency values 136 stored within latency table 230 will be in sequential order as received at the port designated as the reference port.
- new sequence pointers are generated for records within the latency table 230 upon receipt of packets at the reference port through the operation of determination block 326. If the packet was not received at the reference port, then block 328 is reached where packet data for that packet is not stored in the hash table 220 or the aging buffer 250.
- blocks 330 and 336 will be reached where a new sequence pointer for the latency table 230 is obtained and is stored along with the timestamp (TS) and hash value (H) within the hash table 220.
- TS timestamp
- H hash value
- blocks 330 and 336 will be reached where a new sequence pointer for the latency table 230 is obtained and is stored along with the timestamp (TS) and hash value (H) within the hash table 220.
- TS timestamp
- H hash value
- the resulting latency values 136 stored in latency table 230 will be in sequential order as packets are received at the input port 202/212 that was designated as the reference port. This sequential ordering is useful in determining certain latency related parameters such as packet delay variation or jitter for received packets. This sequential ordering can also be used for other purposes, as desired. It is noted that either input port 202/212 can be designated as the reference port. Other variations could also be implemented.
- FIG. 3B is a process flow diagram of an example embodiment 370 for operation of the latency extraction processing system 120 as described with respect to the example embodiment of FIG. 2 where port identifiers (IDs), such as port numbers, are stored as data 222 in the hash table 220.
- the port IDs (PID1, PID2, PD3 ... PIDN) represent an indication of which input port 202/212 received the incoming packet.
- Blocks 302, 304, 306, 308, 310, and 312 are the same as for embodiment 300 of FIG. 3A. However, other blocks are changed as sequence pointers are no longer tracked.
- Embodiment 370 can be used, for example, where delay variation or jitter is not being tracked and or for other applications where the sequence of received packets is not being tracked or needed for the latency related information being generated.
- classification tables 240 are updated using the classification pointer (CL-PTR), the latency value (L), and other packet data, depending upon the additional classification and other data being collected for the received packets that match previously received packets.
- Flow passes to block 392 where the latency data is updated with the latency value (L). For example, where only minimum, maximum, and average latency values are being tracked, these values are updated with the new latency value (L) before it is discarded.
- the latency value (L) can also be stored in a latency data table 230 for later analysis, if desired. From block 392, flow passes to block 394 where the matching timestamp (TSM) and hash value (HM) for the matching packet data within the hash table 220 are removed from the hash table 220 along with the port ID stored for that packet data within the hash table 220. From block 394, flow passes back to block 302.
- TSM matching timestamp
- HM hash value
- FIG. 3C is a process flow diagram of an example embodiment 350 for operation of the aging buffer 250.
- a determination is made whether a time out event has occurred for a record with the aging buffer 250. For example, this time out event can occur after a detection time window has passed for a particular packet data record within the aging buffer 250.
- this time out determination that the detection time window has passed can be made by the latency processor 124, for example, by analyzing timestamps stored along with hash values within the aging buffer 205.
- This time out determination that the detection time window has passed can also be made by sizing the aging buffer 250 such that records will cycle out of the buffer after an amount of time that would exceed an expected maximum time for latency within the network infrastructure 110. Other techniques could also be used to determine when a detection time window has passed.
- FIG. 4 is a block diagram of an example embodiment 400 where the packet traffic being measured represents request packets 102 and response packets 112 associated with a network application 402 operating with the network communication system.
- request packets 102 which are generated by requesting network devices, travel through network infrastructure 110 and are received by the network application 402.
- the network application 402 then generates response packets 112 that travel back through the network infrastructure 110 and are ultimately received by the requesting devices.
- the first TAP 104 extracts request packets and provides the first packet data stream 108 to the latency extraction processing system 120.
- the second TAP 114 extracts response packets and provides the second packet data stream 118 to the latency extraction processing system 120.
- a single network TAP or other packet extraction device/component can be used to provide copies of both the request packets 102 and the response packets 112 to the latency extraction processing system 120.
- timestamps can also be generated for each of the received packets.
- the latency extraction processing system 120 uses the packet signatures 132, such as hash values generated based upon contents of the request packets 102 and the response packets 112, to match the response packets 112 to corresponding request packets 102. Latency associated with the request/response exchange can then be determined, as described above, using the timestamps associated with the response/request packets 102/112.
- the latency extraction processing system 120 measures bi-directional latency for the request/response packets 102/112.
- the packet signatures 132 e.g., hash values
- the packet flow of requests and the packet flow of responses can be paired. Once paired through matching packet signatures, their respective timestamps are used to determine request response latency within the network communication system.
- the packet signatures 132 are used to pair the request packets and the response packets based upon one or more sets of fields within the packets.
- One or more packet classification engines 208/218 can also be used to help identify request response packet pairs.
- one or more hash generators 122A/122B can also be used to generate hash values as the packet signatures based upon the selected fields within the packets, and the hash values are stored along with timestamps for received packets. Response packets are then paired with request packets based upon a look up for the hash value of each response packet with respect to stored hash values for request packets. Once this match has been found, a latency value can be determined based upon the timestamps associated with the request response packets. For the embodiment 400, this latency represents network delays and application level delays for the request response exchange. These latency measurements for request response exchanges can be used for a variety of purposes to improve operations of the network communication system.
- sizes for one or more packet buffers within the network communication system can be adjusted based upon the network/application level latency measurements to provide better quality-of-service (QoS) for applications operating within the packet network packet communication system.
- QoS quality-of-service
- Other variations could also be implemented while still taking advantage of the signature-based latency extraction techniques described herein
- FIG. 5 is a diagram of an example embodiment for a product configuration as well as external connections for an example latency extraction processing system 120.
- the latency extraction processing system 120 includes a housing 550 having external connections for a variety of connector types.
- Ethernet port connectors 552 can be provided (e.g., Ethernet ports 1-24), and fiber optic connectors 554 can be provided for fiber optic connector modules.
- a display screen, such a back-lit LCD (liquid crystal display) screen 557 can also be included for displaying information related to the latency extraction processing system 120.
- Direct navigation controls 558 can also be included, for example, for navigating management menus displayed in screen 557.
- a separate management network port can also be provided, for example, on the back of housing 550.
- This management network port can provide a control and management network interface for the latency extraction processing system 120.
- circuitry for the latency extraction processing system 120 including circuit boards and power supply circuitry, can be mounted within the housing 550. Other variations can also be implemented while still taking advantage of the embodiments described herein.
- the latency extraction processing system 120 can also be implemented as one or more virtual machine (VM) platforms within a virtual processing environment hosted by one or more processing devices.
- FIGS. 6A-B provide example embodiments of virtual environments.
- one or more of the components within embodiment 100 of FIG. 1, including the latency extraction processing system 120 or components of the latency extraction processing system 120 can be virtualized such that they operate as one or more VM platforms within a virtual processing environment.
- Virtual resources can be made available, for example, through processors and/or processing cores associated with one or more server processing systems or platforms (e.g., server blades) used to provide software processing instances or VM platforms within a server processing system.
- a virtual machine (VM) platform is an emulation of a processing system that is created within software being executed on a VM host hardware system.
- VM virtual machine
- the VM platforms can be configured to perform desired functions that emulate processing systems, such as one or more of the components of the latency extraction processing system 120.
- FIG. 6A is a block diagram of an example embodiment for a virtual machine (VM) host hardware system 600 that communicates with a network 614 such as a network packet communication system.
- the VM host hardware system 600 includes a central processing unit (CPU) 602 that runs a VM host operating system 620.
- An interconnect bridge 608 couples the CPU 602 to additional circuitry and devices within the VM host hardware system 600.
- a system clock 612, a network interface card (NIC) 604, a data storage system 610 (e.g. , memory) and other hardware (HAV) 606 are coupled to the CPU 602 through the interconnect bridge 608.
- the system clock 612 and the storage system 610 can also have a direct connections to the CPU 602.
- Other hardware elements and variations can also be provided.
- the VM host hardware system 600 also includes a hypervisor 622 that executes on top of the VM host operating system (OS) 620.
- This hypervisor 622 provides a virtualization layer including one or more VM platforms that emulate processing systems, such as the latency extraction processing system 120 described above, and that provide related processing resources.
- each of the VM platforms 120A, 120B, 120C ... can be configured to have one or more virtual hardware resources associated with it, such as virtualized ports 624A, a virtualized processor 626A, virtualized processing engines 628A, and/or other virtualized resources.
- the VM host hardware system 600 hosts each of the VM platforms 120A, 120B, 120C ...
- the hypervisor 622 provides a management and control virtualization interface layer for the VM platforms 120A-C. It is further noted that the VM host operating system 620, the hypervisor 622, and the VM platforms 120A-C as well as the related virtualized hardware resources can be implemented, for example, using computer-readable instructions stored in a non-transitory data storage medium that are accessed and executed by one or more processing devices, such as the CPU 602, to perform the functions for the VM host hardware system 600.
- the VM platforms 120A, 120B, 120C ... can include virtual components for the components described for the latency extraction processing system 120 with respect to embodiment in FIG. 2 above. Further, the VM platforms 120A, 120B, 120C ... can implement the functions described with respect to the embodiments described above. In such embodiments, all of the components of the latency extraction processing system 120 are include within each VM platform 120A, 120B, 120C ..., and the packets provided to these VM platforms 120A, 120B, 120C ... could be passed through one or more external and/or virtual load balancers to distribute the packets from one or more TAPs 104/114 that provide packet data from the network 614. Further, as indicated below, virtual TAPs could also be used.
- one or more of the individual components of the latency extraction processing system 120 can also be separately virtualized, as desired, while still taking advantage of the signature-based latency extraction techniques described herein.
- the virtual ports represented by 624 A can be shared by all of the VM platforms 120 A, 120B, 120C ..., and a virtual load balancer within the virtualization layer provided by hypervisor 622 can be used to distribute packet data.
- a load balancer can be used such that packets within a common flow are distributed to the same VM platform 120A, 120B, 120C ... so that they can be processed together.
- Other variations can also be implemented.
- FIG. 6B is a block diagram of an example embodiment for a server system 650 including multiple VM processing environments 654 and 656 that host VM platforms implementing one or more latency extraction processing systems 120A-D as well as two or more network TAPs 104/114.
- a number of processing system platforms 670 such as blade servers that each include one or more VM host hardware systems 600 of FIG. 6A, are connected to an external network communication system through connections 651 and to each other through a router or switch 652.
- the processing system platforms 670 are configured into three nominal groups as indicated by nodes 671, 673, and 675. The processing system platforms 670 within each group are managed together to provide virtual processing resources as part of the network communication system.
- one group 672 of processing system platforms 670 is used to host a VM environment 654 that includes virtual machine (VM) platforms operating to provide the latency extraction processing system 120A, 120B ... 120C, respectively.
- One other group 674 of processing system platforms 670 is used to host a VM environment 656 that includes virtual machine (VM) platforms operating to provide latency extraction processing system 120D and first and second TAPs 104/114, respectively.
- VM virtual machine
- other groupings of processing system platforms 670 can also be used, or all of the processing system platforms 670 can be managed individually or as a single unit.
- each of the VM platforms 120A-D can receive streams of packets 108/118 from points within the network 614.
- Each of the VM platforms 120A-D can also receive streams of packets 108/118 from virtual points within the VM environments 654/656 as represented in embodiment 650 by virtual TAPs 104/114 and virtual packet streams 108/118 within VM environment 656.
- there can be multiple different virtual TAPs 104/114 and a virtual load balancer 658 can be used to distribute packet data to the different VM platforms 120A-D.
- the virtual load balancer 658 can be configured to distribute packets such that packets within a common flow are distributed to the same VM platform 120A-D so that they can be processed together.
- the VM platforms 120A-C within VM environment 654 can receive packet streams from the external network as represented by connections 651 , from the virtual load balancer 658, and/or directly from the virtual TAPs 104/114, as desired.
- the VM platform 120D within VM environment 656 can receive packet streams from the external network as represented by connections 651, from the virtual load balancer 658, and/or directly from the virtual TAPs 104/114, as desired.
- the VM environments 654/656 can also be configured to communicate with each other as well as with other processing systems or virtual environments within server system 650 or the external network 614.
- the processing system platforms 670 can be connected to each other by a high-speed communication backbone. Other variations could also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
- processing devices e.g., central processing units (CPUs), controllers, microcontrollers, microprocessors, hardware accelerators, processors, programmable integrated circuitry, FPGAs (field programmable gate arrays), ASICs (application specific integrated circuits), and/or other processing devices
- CPUs central processing units
- microcontrollers microprocessors
- hardware accelerators processors
- processors programmable integrated circuitry
- FPGAs field programmable gate arrays
- ASICs application specific integrated circuits
- one or more of the operations, tasks, functions, or methodologies described herein can be implemented, for example, as software, firmware and/or other program instructions that are embodied in one or more non-transitory tangible computer- readable mediums (e.g., data storage devices, flash memory, random access memory, read only memory, programmable memory devices, reprogrammable storage devices, hard drives, floppy disks, DVDs, CD-ROMs, and/or any other tangible data storage medium) and that are executed by one or more processing devices (e.g.,
- CPUs central processing units
- controllers microcontrollers
- microprocessors hardware accelerators
- processors programmable integrated circuitry
- FPGAs field programmable gate arrays
- ASICs application specific integrated circuits
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Data Mining & Analysis (AREA)
Abstract
Signature-based latency extraction systems and related methods are disclosed for network packet communications. Disclosed embodiments generate packet signatures (e.g., hash values) for packets received with respect to points within a network. For each received packet, its packet signature is compared to packet signatures stored for previously received packets. If no match is found, the packet signature and a timestamp associated with the newly received packet are stored within one or more packet data tables. If a match is found, then the difference between the timestamp associated with the newly received packet and a timestamp stored with the matching packet signature are used to determine a latency value. The latency values can then be used to determine a variety of latency-related parameters for the network infrastructure being measured, and classification information can also be used to generate latency-related histograms. A variety of embodiments can be implemented.
Description
PCT Patent Application for
SIGNATURE-BASED LATENCY EXTRACTION SYSTEMS AND RELATED METHODS FOR NETWORK PACKET COMMUNICATIONS
Applicant: IXIA
Inventors: Shardendu Pandey and Scott Register
Related Applications
[0001] This PCT application claims priority to the following pending application: U.S. Patent Application Serial Number 14/699,056, filed April 29, 2015, and entitled "SIGNATURE-BASED LATENCY EXTRACTION SYSTEMS AND RELATED METHODS FOR NETWORK PACKET COMMUNICATIONS," which is hereby incorporated by reference in its entirety.
Technical Field of the Invention
[0002] This invention relates to network packet communication systems and, more particularly, to latency measurements for network packet communications.
Background
[0003] Certain network communication systems utilize network packets for network communications. It is often desirable to monitor network traffic associated with these packet-based networks. To meet these monitoring needs, copies of network packets can be forwarded to diagnostic network monitoring tools. Packets are often forwarded using network hubs, test access ports (TAPs), and/or switched port analyzer (SPAN) ports available on network switch systems. For example, certain network switch systems produced by Cisco Systems include SPAN ports to which traffic on the switches is mirrored. Other techniques can also be used to extract copies of network packets being communicated within a network packet communication system.
[0004] When packets pass through one or more network devices within network infrastructure, packets will experience delay associated with their communication path. Network latency is a representation of this packet delay. One problem with current packet network communication systems is that latency has increased due to exponential growth in demand for network communication bandwidth as compared to actual bandwidth that is available within the system. It is often desirable, therefore, to measure latency within a network communication system. One technique to measure
network latency due to packet delays caused by network infrastructure is to add timestamps to the packets as they traverse various points in network. However, this direct-timestamp method is intrusive and can itself add latency to existing packets streams by increasing the amount of data being communicated. Another technique to measure latency due to packet delay is to send special timing packets (e.g., pings) and to measure delay associated with special timing response packets through timestamps added to the timing packets and the timing response packets. PTP (Precision Time Protocol) and NTP (Network Time Protocol) are communication protocols that use such special timing packets. These timing-packet techniques, however, are also intrusive and can adversely affect network bandwidth because the number of packets being communicated within the network are increased.
Summary of the Invention
[0005] Signature-based latency extraction systems and related methods are disclosed for network packet communications. The disclosed embodiments generate packet signatures (e.g., hash values) for packets received with respect to points within a network packet communication system. For each received packet, its packet signature is compared to packet signatures stored for previously received packets. If no match is found, the packet signature and a timestamp associated with the newly received packet are stored within one or more packet data tables. If a match is found, then the difference between the timestamp associated with the newly received packet and a timestamp stored with the matching packet signature are used to determine a latency value associated with the newly received packet. The resulting latency values can be stored within a latency data table. Further, this latency data table can also be serialized such that it provides an ordered sequence of latency values based upon when packets are received by a reference port. Sequence pointers for the latency data table can be generated and used to provide this sequential ordering. Received packets can also be tagged with port identifiers (e.g., port numbers) for input ports that receive packets, and these port identifiers can be stored and used during signature matching for received packets. The latency values can be used to determine latency-related parameters for the network infrastructure being measured, such as average latency, minimum latency, maximum latency, packet delay variation or jitter, and/or other latency-related parameters. Classification information can also be generated for the received packets, and this classification information can be used to generate and update latency-related histograms for the received packets based upon common classifications. The received packets can also represent request/response packet pairs associated with one or more applications operating within the network packet communication system, and the resulting latency values can represent network/application level delay. Other variations can also be implemented, and related systems and methods can be utilized, as well.
[0006] For one embodiment, a method to measure network packet latency is disclosed including receiving packets at a first input port associated with a first point within a network packet communication system, receiving packets at a second input port associated with a second point within
the network packet communication system, and for each received packet the method includes generating a packet signature or the packet, comparing the packet signature to packet signatures stored in a signature table, storing the packet signature within the signature table along with a timestamp associated with the received packet if a signature match is not found, and determining a latency value for the received packet based upon a timestamp associated with the received packet and a timestamp associated with the matching packet signature within the signature table if a signature match is found.
[0007] In additional embodiments, the method includes generating hash values as the packet signatures for the received packets, the hash values being based upon selected portions of the received packets. In further embodiments, the packets received at the input ports include timestamps. In still further embodiments, the method includes generating a timestamp for each packet when the packet is received at the first input port or the second input port. In other embodiments, the received packets include request packets and response packets associated with the request packets, and matching packet signatures are configured to pair a response packet to its associated request packet.
[0008] In further embodiments, the method includes storing the latency values in a latency table and using the stored latency values to determine one or more latency related parameters for the network packet communication system. In sill further embodiments, the method includes selecting one of the input ports as a reference port, generating sequence pointers for the latency table based upon an order in which packets are received at the reference port, and using the sequence pointers to order the latency values stored in the latency table. In addition, the method can include using the ordered latency values within the latency table to determine one or more latency related parameters for the network packet communication system. Still further, the one or more latency related parameters can include packet delay variation.
[0009] In still further embodiments, the method includes storing a port identifier associated with the received packet along with the hash value and the timestamp if a signature match is not found, and a latency value is determined if a signature match is found only if a port identifier associated with the received packet does not match a port identifier stored for the matching packet within the signature table.
[0010] In additional embodiments, the method includes storing the packet signature for each received packet within an aging buffer, and after a detection time window, removing the packet signature from the aging buffer. In further embodiments, the method includes comparing each removed packet signature to packet signatures within the signature table and removing any matching packet signature and related timestamp from the signature table. In still further embodiments, the method includes relying upon a size of the aging buffer to determine when packet signatures are removed from the aging buffer. In additional embodiments, the method includes storing the timestamp associated with
each packet signature in the aging buffer, and using the timestamp associated with each packet signature to determine when each packet signature is removed from the aging buffer.
[0011] In further embodiments, the method includes classifying each packet based upon contents of the packet to generate a packet classification, and using the packet classification to update histogram information about packets having a common packet classification. Still further, the histogram information can include latency information based upon the latency values.
[0012] For another embodiment, a system to measure latency for network packets is disclose including a first input port configured to receive packets associated with a first point within a network packet communication system, a second input port configured to receive packets associated with a second point within the network packet communication system, one or more packet signature generators configured to generate a packet signature for each received packet, a signature table configured to store packet signatures and timestamps, and a latency processor configured to compare the packet signature for each received packet to packet signatures stored in the signature table, to store the packet signature within the signature table along with a timestamp associated with the received packet if a signature match is not found, and to determine a latency value for the received packet based upon a timestamp associated with the received packet and a timestamp associated with the matching packet signature within the signature table if a signature match is found.
[0013] In additional embodiments, the one or more packet signature generators include one or more hash generators configured to generate hash values as the packet signatures for the received packets, the hash values being based upon selected portions of the received packets. In further embodiments, the latency processor is configured to obtain timestamps from the packets received at the input ports. In still further embodiments, the system includes one or more timestamp generators configured to generate a timestamp for each packet received at the first input port or the second input port. In other embodiments, the received packets include request packets and response packets associated with the request packets, and matching packet signatures are configured to pair a response packet to its associated request packet.
[0014] In further embodiments, the latency processor is further configured to store the latency values in a latency table and to determine one or more latency related parameters for the network packet communication system based upon the stored latency values. In still further embodiments, one of the input ports is a reference port, and the latency processor is further configured to generate sequence pointers based upon an order in which packets are received at the reference port and to use the sequence pointers to order the latency values stored in the latency table. In addition, the latency processor can be further configured to use the ordered latency values within the latency table to determine one or more
latency related parameters for the network packet communication system. Still further, the one or more latency related parameters can include packet delay variation.
[0015] In still further embodiments, the latency processor is further configured to store a port identifier associated with the received packet along with the hash value and the timestamp if a signature match is not found, and the latency processor is further configured to determine a latency value if a signature match is found only if a port identifier associated with the received packet does not match a port identifier stored for the matching packet within the signature table.
[0016] In additional embodiments, the system includes an aging buffer, and the latency processor is further configured to store the packet signature for each received packet within the aging buffer and to remove the packet signature from the aging buffer after a detection time window. In further embodiments, the latency processor is further configured to compare each removed packet signature to packet signatures within the signature table and to remove any matching packet signature and related timestamp from the signature table. In still further embodiments, a size of the aging buffer is configured to determine when packet signatures are removed from the aging buffer. In additional embodiments, the latency processor is further configured to store the timestamp associated with each packet signature in the aging buffer and to use the timestamp associated with each packet signature to determine when each packet signature is removed from the aging buffer.
[0017] In further embodiments, the system includes a classification engine configured to generate a packet classification for each packet based upon contents of the packet and to use the packet classification to update histogram information about packets having a common packet classification. Still further, the histogram information can include latency information based upon the latency values.
[0018] Different or additional features, variations, and embodiments can be implemented, if desired, and related systems and methods can be utilized, as well.
Description of the Drawings
[0019] It is noted that the appended drawings illustrate only example embodiments of the invention and are, therefore, not to be considered limiting of its scope, for the invention may admit to other equally effective embodiments.
[0020] FIG. 1 is a block diagram of an example embodiment for a network packet communications environment including a signature-based latency extraction processing system.
[0021] FIG. 2 is a block diagram of an example embodiment for a signature-based latency extraction processing system that receives and processes packets streams to determine latency and latency-related information associated with packets communicated through network infrastructure.
[0022] FIG. 3A is a process flow diagram of an example embodiment for operation of the latency extraction processing system of FIG. 2 where sequence pointers are stored in a packet signature table.
[0023] FIG. 3B is a process flow diagram of an example embodiment for operation of the latency extraction processing system of FIG. 2 where port identifiers are stored in a packet signature table.
[0024] FIG. 3C is a process flow diagram of an example embodiment for operation of the aging buffer within the latency extraction processing system of FIG. 2.
[0025] FIG. 4 is a block diagram of an example embodiment where the packet traffic being measured represents request/response packet pairs associated with a network application operating within the network packet communication system.
[0026] FIG. 5 is a diagram of an example embodiment for a product configuration as well as external connections for an example latency extraction processing system.
[0027] FIG. 6A is a block diagram of an example embodiment for a virtual machine (VM) host hardware system that creates a virtual environment for a virtual latency extraction processing system.
[0028] FIG. 6B is a block diagram of an example embodiment for a server system including multiple VM environments that host VM platforms implementing one or more latency extraction processing systems as well as other virtual components or devices.
Detailed Description of the Invention
[0029] Signature-based latency extraction systems and related methods are disclosed for network packet communications. The disclosed embodiments generate packet signatures (e.g., hash values) for packets received with respect to points within a network packet communication system. For each received packet, its packet signature is compared to packet signatures stored for previously received packets. If no match is found, the packet signature and a timestamp associated with the newly received packet are stored within one or more packet data tables. If a match is found, then the difference between the timestamp associated with the newly received packet and a timestamp stored with the matching packet signature are used to determine a latency value associated with the newly received packet. The resulting latency values can be stored within a latency data table. Further, this latency data table can also be serialized such that it provides an ordered sequence of latency values based upon when packets are received by a reference port. Sequence pointers for the latency data table can be generated and used to provide this sequential ordering. Received packets can also be tagged with port identifiers (e.g., port numbers) for input ports that receive packets, and these port identifiers can be stored and used during signature matching for received packets. The latency values can be used to determine latency-related parameters for the network infrastructure being measured, such as average latency, minimum latency, maximum latency, packet delay variation or jitter, and/or other latency-related parameters. Classification information can also be generated for the received packets, and this classification information can be used to generate and update latency-related histograms for the received packets based upon common classifications. The received packets can also represent request/response packet pairs associated with one or more applications operating within the network packet communication system, and the resulting latency values can represent network/ application level delay. Other variations can also be implemented, as desired, and related systems and methods can be utilized, as well.
[0030] In operation, the disclosed embodiments provide non-intrusive techniques that measure network latency for packets traveling through network infrastructure by identifying matching packets through packet signatures (e.g., packet hash values) generated for packets received with respect to points within the network packet communication system. Once two matching packets are identified, latency is determined by comparing a first timestamp generated for the packet received at a first point within the network to a second timestamp generated for the packet received at a second point within the network. The timestamps can be generated, for example, using one or more high precision timestamp generators. The packet signatures and timestamps are stored in a packet signature table, and classification and other desired packet related data can also be stored within one or more additional packet data tables. For each received packet, a latency processor determines if the packet signature already exists in the packet signature table. If a match for the packet signature is not found, the packet signature is stored within packet signature table along with the timestamp. If a match for the packet
signature is found, latency is determined by comparing the timestamp for the received packet with the timestamp stored in the packet signature table for the matching packet. The packet signature and timestamps for received packets can also be stored within an aging buffer (e.g., first-in-first-out (FIFO) buffer). This aging buffer can be sized, for example, such that it stores the packet signatures for a duration that exceeds the maximum expected latency for the network infrastructure being measured. Further, timestamps can also be stored within the aging buffer and used to cause data within the aging before to be aged out and removed from the aging buffer. Packet signatures and timestamp data can also be removed from the packet signature table when a packet signature ages out of the aging buffer if a matching packet signature still exists within the packet signature table. The resulting latency values for matching packets and other packet related information, such as packet classification information, are stored in one or more latency, classification, and/or other data tables, and this latency and related packet information can be used for additional processing, as desired. In further embodiments, the packet extraction processing system can be implemented as one or more virtual machines operating within virtual environments hosted by one or more processing devices. A wide variety of variations can also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
[0031] FIG. 1 is a block diagram of an example embodiment 100 for a network packet communication system environment. Packets 102 and packets 112 associated with one or more packet flows are communicated through network infrastructure 110. As described herein, the latency extraction processing system 120 determines network latency and related information associated with the network infrastructure 110 by performing signature-based analysis of packets 102 and packets 112. For the embodiment depicted, a first network TAP (test access port) 104 receives packets 102 and non- intrusively generates copies of these packets. The first TAP 104 can also generate a timestamp associated with receipt of each packet using a timestamp generator 106, although the timestamp generator 106 can also be included within the latency extraction processing system 120 as described herein. The resulting packets (PKT1) and related timestamps (TS) are output as a first packet data stream 108 to the latency extraction processing system 120. Similarly, a second network TAP (test access port) 114 receives packets 112 and non-intrusively generates copies of these packets. The second TAP 114 can also generate a timestamp associated with receipt of each packet using a timestamp generator 116, although the timestamp generator 116 can also be included within the latency extraction processing system 120 as described herein. The resulting packets (PKT2) and related timestamps (TS) are output as a second packet data stream 118 to the latency extraction processing system 120. It is noted that the network infrastructure 110 can be one or more network connected devices that are configured to communicate network packets, and the network infrastructure can also include one or more virtual machines operating within a virtualization layer for a virtual processing system. Further, it is noted that the network packet communications can also include wired, wireless, or wired and
wireless network communications. In addition, the network tap points 104/114 can cover a single network hop or multiple network hops such that a variety of latency measurements can be made with respect to a network packet communication system by adjusting the tap points 104/114 and thereby the network infrastructure 110 being measured for latency.
[0032] As described in more detail below, the latency extraction processing system 120 receives the first packet data stream 108 and the second packet data stream 118 and generates latency values 136 based upon a comparison of packet signatures 132 generated for packets within these streams 108/118 and timestamps 134 related to these packets. One or more packet signature generators 122 generate the packet signatures 132 associated with packets for these incoming packets from streams 108/118. As one example, one or more hash generators can be used as the packet signature generators 122, and these hash generators can generate hash values as the packet signatures. The latency processor 124, which can include one or more processing devices, stores the packet signatures 132 and timestamps 134 associated with received packets from streams 108/118 within one or more packet data tables 130 until matching packets are found. When the latency processor 124 identifies matching packets within the streams 108/118 based upon comparisons of packet signatures 132, the latency processor 124 then uses differences between related timestamps within timestamps 134 to determine latency values 136 for these matching packets with respect to the network infrastructure 110. The latency extraction processing system 120 can also determine, generate, and store other data 138 associated with the received packets within streams 108/118. This latency data 136 and other data 138 can then be used for further processing and/or analysis of the network communications by the latency extraction processing system 120, or this data 136/138 can be communicated to one or more additional processing systems for further processing and/or analysis, as desired.
[0033] FIG. 2 is a block diagram of an example embodiment for a latency extraction processing system 120 that receives and processes the packets streams 108/118 to measure latency and to collect related information associated with the packets communicated through the network infrastructure 110. For the example embodiment depicted, the latency extraction processing system 120 includes input ports 202/212, hash generators 122A/122B, classification engines 206/216, a latency processor 124, and packet data tables 130 that include a hash table 220, a latency data table 230, and classification tables 240. As indicated above, the timestamp generators 106 and 116 can be included within the latency extraction processing system 120, if desired, instead of relying upon timestamp generators in the first and second TAPS 104/114 to generate timestamps for the received packets. It is also noted that the hash generators 122A/122B are used for this example embodiment to implement the packet signature generator(s) 122 shown in FIG. 1. Although the hash generators 122A/122B are depicted as two separate hash generators, the hash generators 122A/122B can also be implemented as a single hash generator that generates hash values for both packet streams 108/118. Further, although the
classification engines 206/216 are depicted as two separate classification engines, the classification engines 206/216 can also be implemented as a single classification engine that generates classification data for both packet streams 108/118. Similarly, although the timestamp generators 106/116 are depicted as two separate timestamp generators, the timestamp generators 106/116 can also be implemented as a single timestamp generator that generates timestamps for both packet streams 108/118. Further, although the latency processor 124 is depicted as a single processor, the latency processor 124 can also be implemented using multiple processing devices, if desired. Other variations could also be implemented.
[0034] The first packet data stream 108 and its related timestamps are received by input port 202. As shown in FIG. 1, the first packet stream 108 can include first packets (PKT1) and related timestamps (TS) from the first TAP 104, although other techniques and devices could also be used to provide the first packet stream and related timestamps. A hash generator 122 A is coupled to the input port 202 and generates hash values 204 for the packets within the first packet data stream 108. A classification engine 206 is also coupled to the input port 202 and generates classification information and other packet related data associated with the packets within the first data stream 108. For example, the classification engine 206 can be configured to use data from one or more fields within each packet to generate a classification pointer (CL-PTR) for the packet that classifies the packet. Each packet can be classified, for example, by the data type of packet (e.g., audio, video, and/or other data type), by the session or flow associated with the packet (e.g., voice call, email, web services, and or other session/flow types), and/or by other packet related information. The classification engine 206 then outputs packet data 208, such as a classification pointer (CL-PTR) and/or other packet data (PKT DATA), to the latency processor 124. The hash value 204 and the timestamp (TS) 207 for each packet are also received by the latency processor 124.
[0035] The second packet data stream 118 and its related timestamps are received by input port 212. As shown in FIG. 1, the second packet stream 118 can include second packets (PKT2) and related timestamps (TS) from the second TAP 114, although other techniques and devices could also be used to provide the second packet stream and related timestamps. A hash generator 122B is coupled to the input port 212 and generates hash values 214 for the packets within the second packet data stream 118. A classification engine 216 is also coupled to the input port 212 and generates classification information and other packet related data associated with the packets within the second data stream 118. For example, the classification engine 216 can be configured to use data from one or more fields within each packet to generate a classification pointer (CL-PTR) for the packet that classifies the packet. Each packet can be classified, for example, by the data type of packet (e.g., audio, video, and/or other data type), by the session or flow associated with the packet (e.g., voice call, email, web services, and/or other session/flow types), and or by other packet related information. The classification engine 216
then outputs packet data 218, such as a classification pointer (CL-PTR) and or other packet data (PKT DATA), to the latency processor 124. The hash value 214 and the timestamp (TS) 217 for each packet are also received by the latency processor 124.
[0036] The latency processor 124 compares the packet signatures, which are hash values 204/214 for the embodiment of FIG. 2, to previously stored packet signatures and determines latency for matching packet signatures based upon differences between respective timestamps associated with the matching packet signatures. As described in more detail below, the latency processor 124 stores hash values 132, timestamps 134, and sequence pointers 222 in a hash table 220 as packets are received within the packet streams 108/118. In particular, latency processor 124 stores hash values 132 as represented by the hash values (HI, H2, H3 ... HN) in data records within the hash table 220. The timestamps 134 associated with these packets are also stored along with the hash values 132 as represented the timestamps (TS 1, TS2, TS3 ... TSN) in hash table 220. Sequence pointers (PTR1, PTR2, PTR3 ... PTRN) 222 are also generated and stored in hash table 220 for each stored hash value 132 and timestamp 134 packet. The sequence pointers 222 are used to point to and reference latency records within the latency data table 230. When latency values (LI, L2, L3, ... LN) 136 are determined for matching packets based upon differences in timestamp values, the latency values 136 are stored within a latency record based upon the sequence pointers 222. As described further below, the valid bits (VI, V2, V3 ... VN) 232 for the latency records are initially set to "invalid" states (e.g., logic 0) and are subsequently changed to "valid" states (e.g. , logic 1) when valid latency values are determined after matching packet hashes are found.
[0037] In operation, the latency processor 124 compares hash values for newly received packets within packet streams 108/118 to hash values stored in the hash table 220 for previously received packets to identify matching packets. If the hash values match, the latency processor 124 treats the newly received packet as a match to the previously received packet and determines latency associated with the matching packets based upon the difference between the timestamps associated with the matching packet hash values. In particular, if a match is found, the latency processor 124 compares the timestamp for the newly received packet with the timestamp stored within the reference data table 220 for the matching packet. The difference value represents the latency for the packet as it traveled through the network infrastructure 110, and this difference value is stored as the latency value 136 within the record of the latency data table 230 pointed to by the sequence pointer 222 for the matching packet hash value within hash table 220. For example, if the hash 204/214 for a newly received packet matches the third hash value P3 in table 220, the associated timestamp TS3 is compared to the timestamp for this newly received packet. The difference value between these two timestamps is then stored as the latency value 136 in the record within the latency data table 230 pointed to by the sequence pointer PTR3. Assuming the associated record is the second record including L2/V2, the latency value is written as
value L2 into the latency data table 230 when the match is found, and the associated valid bit V2 is also set to its "valid" state. Once this match has been found and the latency data has been stored within latency data table 230, the data for the matching packet within reference data table 220 can be removed.
[0038] It is noted that additional and/or different data can also be stored within the hash table 220 along with the hash values 132 and the timestamps 134. For example, for the embodiment described above and with respect to FIG. 3A below, sequence pointers (PTR1, PTR2, PTR3 ... PTRN) are stored as data 222. However, for the embodiment described with respect to FIG. 3B below, port identifiers (PID1, PID2, PD3 ... PIDN) are stored as data 222 instead of the sequence pointers (PTR1, PTR2, PTR3 ... PTRN) 222. Further, port identifiers and sequence pointers can both be stored with the hash table 220, and other packet related data can also be stored in the hash table 220, if desired, while still taking advantage of the signature-based latency extraction techniques described herein.
[0039] It is noted that the latency values 136 stored within the latency data table 230 can be used to generate a variety of latency related information for the packets traveling through the network infrastructure 110. For example, the latency values 136 can be used to determine minimum latency, maximum latency, average latency, latency variation (often called jitter), and/or other latency related parameters for packets traveling through the network infrastructure 110. In part, latency refers to a measure of delay between when a packet or a packet pair (e.g., request/response packets) appears in time at two different points in a network communication system, such as the difference in time between when a packet appears at the first TAP 104 and the second TAP 114 in FIG. 1, or such as the difference in time between when a packet appears at the input port 202 and at the input port 212 in FIG. 2. Other packet related parameters could also be generated, if desired, using the latency values 136 stored in latency data table 230 in combination with other packet related data. It is also noted that he sequence pointers 222 can be generated as serial tokens from the latency data table 230. As packets are processed, one of the input ports 202/212 can be used as a reference port such that when new packets are received at the that port, the next sequential location within the latency data table 230 is used as the sequence pointer (PTR) for the data stored in hash table 220 for that packet. It is further noted that the timestamps generated by the timestamp generators 106/116 are configured to provide an accurate time representation of when a given packet is seen at a given point in network communication system, such as when received by the TAPS 104/114 or by the input ports 202/212. The timestamp generators 106/116 can also be configured to lock to an accurate time source, such as a GPS (Global Positioning System) clock and/or to a network master clock source, such as one made available through PTP (Precision Time Protocol) or NTP (Network Time Protocol) communications. Other variation can also be implemented.
[0040] The latency processor 124 can also use an aging buffer 250 to store packet data for a selected amount of time within a detection time window. For example, the latency processor 124 can
store the hash values (HI, H2, H3 ... HN) for the received packets within streams 108/118 within aging buffer 250 (e.g., a first-in-first-out (FIFO) buffer). After the detection time window has passed for packet data within the aging buffer 250, this packet data can be removed. The detection time window can be determined, for example, through the size of the aging buffer 250. For example, the aging buffer 250 can be sized such that it stores the packet hashes for a duration that exceeds the maximum expected latency for the network infrastructure being measured (e.g., 50-100 milliseconds, although other durations could also be used). Further, timestamps (Tl, T2, T3 ... TN) can also be stored within the aging buffer 250 and can be used by the latency processor 124 to determine when a detection time window has passed for packet data such that this aged-out data should be removed. As represented by delete arrow 251 , the latency processor 124 can also cause matching hash values and related timestamps to be removed from the hash table 220 when packet data ages out of the aging buffer 250 if a matching hash value still exists within the hash table 220, for example, after the packet data has been stored with the aging buffer for a predetermined threshold amount of time (e.g. , 50- 100 milliseconds, although other thresholds could also be used).
[0041] The latency processor 124 can also use one or more classification data table(s) 240 to store additional information concerning received packets and matched packets. For example, packet counts for received packets having a particular classification can be stored in classification tables 240 along with packet byte counts for packets contents and/or other packet related data and statistics. As a further example, the classification pointers (CL-PTRs) generated by the classification engines 206/216 can be used to generate latency histograms with respect to packets having common classifications. The classification engines 206/216, for example, can extract data from a set of desired fields within each packet and can then apply one or more classification algorithms to this set of data to generate classification data for packet identification purposes. Classification hash algorithms can also be applied to the data to compress the amount of information being processed. As indicated above, the classification pointers can be generated using data from one or more different fields within each packet. For example, a classification pointer (CL-PTR) can be generated for each packet based upon a 5-tuple including source IP (Internet Protocol) address, source port number, destination IP address, destination port number, and network protocol. Other techniques could also be used to generate one or more classification pointers. Other histograms and or packet parameters can also be generated and stored within the classification tables 240, as desired, with respect packet related data. Other variations could also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
[0042] It is noted that various latency related parameters can be tracked using the latency data table 230, the classification tables 240, and/or other data tables. For example, a maximum (MAX) latency value can be tracked by comparing each new latency value with a previous maximum detected latency
value. If the new latency value is greater than the previous maximum latency value, the new latency value is kept as the maximum latency value. If the new latency value is not greater than the previous maximum latency value, the previous maximum latency value is kept as the maximum latency value. Similarly, a minimum (MIN) latency value can be tracked by comparing each new latency value with a previous minimum detected latency value. If the new latency value is less than the previous minimum latency value, the new latency value is kept as the minimum latency value. If the new latency value is not less than the previous minimum latency value, the previous minimum latency value is kept as the minimum latency value. Further, rather than keeping the maximum (MAX) and minimum (MIN) values as each new latency value is detected, the maximum/minimum latency values can also be determined by analyzing the latency values stored within the latency data table 230 to determine maximum and/or minimum values within the latency data table 230. In addition, an average latency value can also be tracked by dividing the sum of all detected latency values by the number of latency values detected. As with the maximum/minimum determinations, the average latency value can be kept as each new latency value is determined and/or can be determined by analyzing the latency values stored in the latency data table 230. Other latency related parameters can also be determined, as desired, and classification data stored in the classification tables 240 can also be used for latency related determinations. Other variations can also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
[0043] It is noted that the hash table 220 in the example embodiment of FIG. 2 is implemented as a single hash table. However, hash table 220 could also be implemented as two or more different hash tables. For example, a hash table could be associated with each input port 202/212. For such an embodiment, when a packet is received at one port, the latency processor 124 is configured to perform a look up within the hash table associated with the other port. The packet data (e.g. , hash and timestamp) can then be stored within the port's hash table if the look up operation does not find a matching packet hash value in the other hash table. Further, the latency processor 124 can be also be distributed such that its functions are split among multiple different latency processors. Further, the timestamp generators 106/116, the hash generators 122A/122B, the classification engines 206/216, and/or the latency processor 124 can be distributed geographically such that one or more of the functions described for these components are performed at different geographic locations. This geographic distribution can be implemented, for example, to improve accuracy of measurements such as by locating the timestamp generators 106/116 at the same geographic location as the TAPs 104/114 that generate the copy of the packets being measured.
[0044] As indicated above, the TAPs 104/114 can also be implemented as other devices or components that are configured to generate copies of packet traffic within a network packet communication path. For example, switched port analyzer (SPAN) ports on network switches can be
used to generate copies of packets being communicated through a network switch. The TAPs 104/114 or other packet extraction devices or components can also be located at the same geographic location as the latency extraction processing system 120 or can be remotely located depending upon the network infrastructure 110 being measured. Further, one or more packet tunnel protocols can be also be used to forward packets from the TAPs 104/114 or other packet extraction devices or components to the latency extraction processing system 120. Further, tags can be added to extracted packets that can be used to identify and classify the packets during later processing. For example, rather than simply determine an average latency for all packets received and matched, latency calculations can be based upon one or more classification parameters associated with the packets and/or tags associated with the packets. These parameters can include, for example, source IP address, destination IP address, source port number, destination port number, network protocol, application, and or other parameter associated with the packet and/or its tag. As one further example, a 5-tuple tag can be used to classify the packet, and this 5-tuple tag can include the source IP address, the destination IP address, the source port, the destination port, and a protocol value. Latency calculations and histograms can then be generated and updated based upon latency values and this classification information.
[0045] The hash generators 122A/122B can be configured to generate hash values based upon one or more hash algorithms that are applied to data within each packet. The resulting hash values or keys are used to provide the packet signatures 132, and these hash values or keys effectively reduce the size of the packets (e.g., 128 bytes) to smaller data values (e.g., 32 bits) that can still be used to identify different packets. Any desired hash algorithm could be used. Preferably, a hash algorithm is configured to disregard certain fields, such as a TTL (time-to-live) field, that are likely to change as a packet traverses one or more networking devices. Other fields, such as a source/destination IP (Internet Protocol) addresses, may or may not change depending upon networking device(s) and their capabilities and policies. Further, some packets may have Network Address Translation (NAT) applied, and other packets will not have such NAT applied. By generating hash values based upon selected portions of the packet that are expected to remain unchanged (e.g., source/destination IP addresses, source/destination ports, network protocol), the resulting hash values can remain consistent for packets as they travel through network infrastructure 110 even if other portions of the packet are modified. As such, the disclosed embodiments are able to measure latency for network packets, even if they are modified by network infrastructure 110, by matching packet signatures (e.g., hash values) and by then comparing timestamps associated with matching packet signatures.
[0046] The hash generators 122A/122B are also preferably configured to apply hash algorithms having uniform distribution characteristics such that resulting hash values are generated with even distributions across the range of possible hash values. Further, it is desirable that the hash algorithms generate different hash values for data strings that are different but similar so that similar but different
data strings can be distinguished. Other considerations can also be used to select the hash algorithms. It is further noted that SHA-1, MD5, FNV (Fowler-Noll-Vo), and MurmurHash are known algorithms for generating hash values based upon selected input parameters. It is further noted that large cryptographic hash algorithms, such as MD5, may be difficult to utilize for the embodiments described herein because they tend to be complex and slow algorithms. It is also noted that PRBS (pseudo-random binary sequence), CRC (cyclic redundancy check), and other cyclical polynomial computations (e.g. , Reed Solomon) could also be utilized to generate hash values. While these cyclical polynomial computations can be easier to implement in hardware, they typically provide worse performance with respect to desirable hash parameters. Non-cryptographic hash algorithms can also be used to provide hash values. If desired, a non-cryptographic MurmurHash-type hash algorithm can be used and can be split into multiple 16-bit hash processes that execute in parallel followed by a final series of mixing steps. The mixing steps can be operated at 200 MHz or above, if desired, to generate resulting hash values, such as 32-bit hash values. Other variations, hash algorithms, and combinations of has algorithms can also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
[0047] It is further noted that the latency processor 124, the timestamp generators 106/116, the hash generators 122A/122B, and/or classification engines 206/216 can be implemented using one or more processing devices including controllers, microcontrollers, microprocessors, hardware accelerators, configurable logic devices (e.g., field programmable gate arrays), and/or other processing devices. Further, the one or more processing devices can be configured to execute instructions stored in a non-transitory tangible computer-readable medium to perform the functions described herein. In addition, one or more packet data table(s) 130 can be implemented as any desired non-transitory tangible computer-readable medium. Such computer readable mediums include, for example, data storage devices, FLASH memory, random access memory, read only memory, programmable memory devices, reprogrammable storage devices, hard drives, floppy disks, DVDs, CD-ROMs, and/or any other non-transitory data storage mediums. As described further below with respect to FIGS. 6A-B below, the latency extraction processing system 120 can also be implemented as one or more virtual machine (VM) platforms operating within a virtual processing environment hosted by one or more host processing systems. It is further noted that the network communications can be based upon any desired protocol or combination of protocols including Ethernet protocols, multi-protocol label switching (MPLS) protocols, FibreChannel (FC) protocols and/or any other desired communication protocol that can be used for packet-based network communications. Other implementations could also be used while still taking advantage of the signature-based latency extraction techniques described herein.
[0048] FIG. 3A is a process flow diagram of an example embodiment 300 for operation of the latency extraction processing system 120 as described with respect to the example embodiment of FIG.
2 where sequence pointers are stored as data 222 in the hash table 220. For embodiment 300, a packet is first received in block 302. A timestamp (TS) is extracted from the packet data or generated for the packet in block 304. The packet is classified in block 306 to generate a classification pointer (CL-PTR). A hash value (H) is also generated in block 308 for the packet using contents of the packet. Flow then passes to block 310 where the timestamp (TS) and the hash value (H) are stored in the aging buffer 250. A latency value for the received packet can also be set to an "invalid" state until a valid latency has been measured. In block 312, a determination is made whether a matching hash value exists within the hash table 220.
[0049] If the determination in block 312 is "NO," then flow passes to block 324 where the timestamp (TS) and hash value (H) are stored in hash table 220. A determination is then made in block 326 whether the receiving port for the packet was designated as a reference port. If "NO," then flow passes to block 328 where the timestamp (TS) and hash value (H) are removed from the hash table 220 and from the aging buffer 250. Flow then passes back to block 302. If the determination in block 326 is "YES," then flow passes to block 330 where the next sequence pointer is obtained from the latency table 230. Flow then passes to block 336 where the sequence pointer 222 is stored in the hash table 220 along with the packet data (TS/H). Flow then passes back to block 302.
[0050] If the determination in block 312 is "YES," then flow passes to block 314 where latency is determined using the matching timestamp (TSM) extracted from the hash table for the matching hash value stored within the hash table. The latency value (L) is represented by the difference between timestamp (TS) for the received packet and the matching timestamp (TSM) for the matching packet hash value (e.g., L = TS - TSM). In block 316, classification tables 240 are updated using the classification pointer (CL-PTR), the latency value (L), and other packet data, depending upon the additional classification and other data being collected for the received packets that match previously received packets. Flow then passes to block 320 where the sequence pointer from the hash table 220 is used to locate and update a latency record within the latency table 230 with the latency value (L). The valid bit in the latency table 230 is also then set to a "valid" state. In block 322, the matching timestamp (TSM) and hash value (HM) for the matching packet data within the hash table 220 are removed from the hash table 220 along with the sequence pointer 222 stored for that packet data within the hash table 220. From block 322, flow passes back to block 302.
[0051] It is noted that through the use of the sequence pointers 222, the valid latency values 136 stored within latency table 230 will be in sequential order as received at the port designated as the reference port. With respect to embodiment 300, new sequence pointers are generated for records within the latency table 230 upon receipt of packets at the reference port through the operation of determination block 326. If the packet was not received at the reference port, then block 328 is reached where packet data for that packet is not stored in the hash table 220 or the aging buffer 250. If the packet
was received at the input port 202/212 designated as the reference port, then blocks 330 and 336 will be reached where a new sequence pointer for the latency table 230 is obtained and is stored along with the timestamp (TS) and hash value (H) within the hash table 220. When a matching packet is subsequently received at one of the input ports 202/212, a match will be found and block 320 is ultimately reached where the sequence pointer is used to update the latency table 230. As such, the resulting latency values 136 stored in latency table 230 will be in sequential order as packets are received at the input port 202/212 that was designated as the reference port. This sequential ordering is useful in determining certain latency related parameters such as packet delay variation or jitter for received packets. This sequential ordering can also be used for other purposes, as desired. It is noted that either input port 202/212 can be designated as the reference port. Other variations could also be implemented.
[0052] FIG. 3B is a process flow diagram of an example embodiment 370 for operation of the latency extraction processing system 120 as described with respect to the example embodiment of FIG. 2 where port identifiers (IDs), such as port numbers, are stored as data 222 in the hash table 220. The port IDs (PID1, PID2, PD3 ... PIDN) represent an indication of which input port 202/212 received the incoming packet. Blocks 302, 304, 306, 308, 310, and 312 are the same as for embodiment 300 of FIG. 3A. However, other blocks are changed as sequence pointers are no longer tracked. Embodiment 370 can be used, for example, where delay variation or jitter is not being tracked and or for other applications where the sequence of received packets is not being tracked or needed for the latency related information being generated.
[0053] Looking back to FIG. 3B, if the determination in block 312 is "NO," then flow passes to block 384 where the timestamp (TS) and hash value (H) are stored in hash table 220 along with the port identifier (ID) for the packet. If the determination in block 312 is "YES," then flow passes to block 386 where a determination is made whether the port ID for the new packet matches the stored port ID. If "YES," then flow passes back to block 302. If "NO," then flow passes to block 314 where latency is determined using the matching timestamp (TSM) extracted from the hash table for the matching hash value stored within the hash table. The latency value (L) is represented by the difference between timestamp (TS) for the received packet and the matching timestamp (TSM) for the matching packet hash value (e.g., L = TS - TSM). In block 316, classification tables 240 are updated using the classification pointer (CL-PTR), the latency value (L), and other packet data, depending upon the additional classification and other data being collected for the received packets that match previously received packets. Flow then passes to block 392 where the latency data is updated with the latency value (L). For example, where only minimum, maximum, and average latency values are being tracked, these values are updated with the new latency value (L) before it is discarded. The latency value (L) can also be stored in a latency data table 230 for later analysis, if desired. From block 392, flow passes
to block 394 where the matching timestamp (TSM) and hash value (HM) for the matching packet data within the hash table 220 are removed from the hash table 220 along with the port ID stored for that packet data within the hash table 220. From block 394, flow passes back to block 302.
[0054] FIG. 3C is a process flow diagram of an example embodiment 350 for operation of the aging buffer 250. In block 352, a determination is made whether a time out event has occurred for a record with the aging buffer 250. For example, this time out event can occur after a detection time window has passed for a particular packet data record within the aging buffer 250. As indicated above, this time out determination that the detection time window has passed can be made by the latency processor 124, for example, by analyzing timestamps stored along with hash values within the aging buffer 205. This time out determination that the detection time window has passed can also be made by sizing the aging buffer 250 such that records will cycle out of the buffer after an amount of time that would exceed an expected maximum time for latency within the network infrastructure 110. Other techniques could also be used to determine when a detection time window has passed.
[0055] If the determination in block 352 is "NO," then flow pass back to block 352. When a time out event does occur for a record, the determination in block 352 will be "YES." Flow then passes to block 354 where a determination is made whether the hash value for the packet data stored in the aging buffer 250 matches a hash value for packet data stored within the hash table 220. If "NO," then flow passes to block 406 where the timestamp (TS) and hash value (H) are removed from the aging buffer 250. If "YES," then flow first passes to block 358 where the timestamp (TS) and hash value (H) along with the sequence pointer or port identifier (ID) 222 are removed from the hash table 220. Flow then passes to block 356. From block 356, flow passes back to block 352 until the next time out event is detected.
[0056] FIG. 4 is a block diagram of an example embodiment 400 where the packet traffic being measured represents request packets 102 and response packets 112 associated with a network application 402 operating with the network communication system. As depicted for this example embodiment 400, request packets 102, which are generated by requesting network devices, travel through network infrastructure 110 and are received by the network application 402. The network application 402 then generates response packets 112 that travel back through the network infrastructure 110 and are ultimately received by the requesting devices. The first TAP 104 extracts request packets and provides the first packet data stream 108 to the latency extraction processing system 120. The second TAP 114 extracts response packets and provides the second packet data stream 118 to the latency extraction processing system 120. Alternatively, where the request and response packets 102/112 are occurring within a common network communication path, a single network TAP or other packet extraction device/component can be used to provide copies of both the request packets 102 and the response packets 112 to the latency extraction processing system 120. As described above, timestamps
can also be generated for each of the received packets. The latency extraction processing system 120 then uses the packet signatures 132, such as hash values generated based upon contents of the request packets 102 and the response packets 112, to match the response packets 112 to corresponding request packets 102. Latency associated with the request/response exchange can then be determined, as described above, using the timestamps associated with the response/request packets 102/112.
[0057] In operation for embodiment 400, therefore, the latency extraction processing system 120 measures bi-directional latency for the request/response packets 102/112. Using the packet signatures 132 (e.g., hash values), the packet flow of requests and the packet flow of responses can be paired. Once paired through matching packet signatures, their respective timestamps are used to determine request response latency within the network communication system. The packet signatures 132 are used to pair the request packets and the response packets based upon one or more sets of fields within the packets. One or more packet classification engines 208/218 can also be used to help identify request response packet pairs. As described above, one or more hash generators 122A/122B can also be used to generate hash values as the packet signatures based upon the selected fields within the packets, and the hash values are stored along with timestamps for received packets. Response packets are then paired with request packets based upon a look up for the hash value of each response packet with respect to stored hash values for request packets. Once this match has been found, a latency value can be determined based upon the timestamps associated with the request response packets. For the embodiment 400, this latency represents network delays and application level delays for the request response exchange. These latency measurements for request response exchanges can be used for a variety of purposes to improve operations of the network communication system. For example, sizes for one or more packet buffers within the network communication system can be adjusted based upon the network/application level latency measurements to provide better quality-of-service (QoS) for applications operating within the packet network packet communication system. Other variations could also be implemented while still taking advantage of the signature-based latency extraction techniques described herein
[0058] FIG. 5 is a diagram of an example embodiment for a product configuration as well as external connections for an example latency extraction processing system 120. As depicted, the latency extraction processing system 120 includes a housing 550 having external connections for a variety of connector types. For example, Ethernet port connectors 552 can be provided (e.g., Ethernet ports 1-24), and fiber optic connectors 554 can be provided for fiber optic connector modules. Further, a display screen, such a back-lit LCD (liquid crystal display) screen 557, can also be included for displaying information related to the latency extraction processing system 120. Direct navigation controls 558 can also be included, for example, for navigating management menus displayed in screen 557. Although not shown, a separate management network port can also be provided, for example, on the back of
housing 550. This management network port can provide a control and management network interface for the latency extraction processing system 120. It is further noted that circuitry for the latency extraction processing system 120, including circuit boards and power supply circuitry, can be mounted within the housing 550. Other variations can also be implemented while still taking advantage of the embodiments described herein.
[0059] As indicated above, the latency extraction processing system 120 can also be implemented as one or more virtual machine (VM) platforms within a virtual processing environment hosted by one or more processing devices. FIGS. 6A-B provide example embodiments of virtual environments. For example, one or more of the components within embodiment 100 of FIG. 1, including the latency extraction processing system 120 or components of the latency extraction processing system 120, can be virtualized such that they operate as one or more VM platforms within a virtual processing environment. Virtual resources can be made available, for example, through processors and/or processing cores associated with one or more server processing systems or platforms (e.g., server blades) used to provide software processing instances or VM platforms within a server processing system. A virtual machine (VM) platform is an emulation of a processing system that is created within software being executed on a VM host hardware system. By creating VM platforms within one or more VM host hardware systems, the processing resources of these VM host hardware systems become virtualized for use within the network packet communication system. The VM platforms can be configured to perform desired functions that emulate processing systems, such as one or more of the components of the latency extraction processing system 120.
[0060] FIG. 6A is a block diagram of an example embodiment for a virtual machine (VM) host hardware system 600 that communicates with a network 614 such as a network packet communication system. For the example embodiment depicted, the VM host hardware system 600 includes a central processing unit (CPU) 602 that runs a VM host operating system 620. An interconnect bridge 608 couples the CPU 602 to additional circuitry and devices within the VM host hardware system 600. For example, a system clock 612, a network interface card (NIC) 604, a data storage system 610 (e.g. , memory) and other hardware (HAV) 606 are coupled to the CPU 602 through the interconnect bridge 608. The system clock 612 and the storage system 610 can also have a direct connections to the CPU 602. Other hardware elements and variations can also be provided.
[0061] The VM host hardware system 600 also includes a hypervisor 622 that executes on top of the VM host operating system (OS) 620. This hypervisor 622 provides a virtualization layer including one or more VM platforms that emulate processing systems, such as the latency extraction processing system 120 described above, and that provide related processing resources. As shown with respect to the VM platform that implements the latency extraction processing system 120 A, each of the VM platforms 120A, 120B, 120C ... can be configured to have one or more virtual hardware resources
associated with it, such as virtualized ports 624A, a virtualized processor 626A, virtualized processing engines 628A, and/or other virtualized resources. The VM host hardware system 600 hosts each of the VM platforms 120A, 120B, 120C ... and makes their processing resources and results available to the network618 through the VM host operating system 620 and the hypervisor 622. As such, the hypervisor 622 provides a management and control virtualization interface layer for the VM platforms 120A-C. It is further noted that the VM host operating system 620, the hypervisor 622, and the VM platforms 120A-C as well as the related virtualized hardware resources can be implemented, for example, using computer-readable instructions stored in a non-transitory data storage medium that are accessed and executed by one or more processing devices, such as the CPU 602, to perform the functions for the VM host hardware system 600.
[0062] It is noted that the VM platforms 120A, 120B, 120C ... can include virtual components for the components described for the latency extraction processing system 120 with respect to embodiment in FIG. 2 above. Further, the VM platforms 120A, 120B, 120C ... can implement the functions described with respect to the embodiments described above. In such embodiments, all of the components of the latency extraction processing system 120 are include within each VM platform 120A, 120B, 120C ..., and the packets provided to these VM platforms 120A, 120B, 120C ... could be passed through one or more external and/or virtual load balancers to distribute the packets from one or more TAPs 104/114 that provide packet data from the network 614. Further, as indicated below, virtual TAPs could also be used. It is further noted that one or more of the individual components of the latency extraction processing system 120 can also be separately virtualized, as desired, while still taking advantage of the signature-based latency extraction techniques described herein. Still further, the virtual ports represented by 624 A can be shared by all of the VM platforms 120 A, 120B, 120C ..., and a virtual load balancer within the virtualization layer provided by hypervisor 622 can be used to distribute packet data. For example, a load balancer can be used such that packets within a common flow are distributed to the same VM platform 120A, 120B, 120C ... so that they can be processed together. Other variations can also be implemented.
[0063] FIG. 6B is a block diagram of an example embodiment for a server system 650 including multiple VM processing environments 654 and 656 that host VM platforms implementing one or more latency extraction processing systems 120A-D as well as two or more network TAPs 104/114. For the example embodiment 650, a number of processing system platforms 670, such as blade servers that each include one or more VM host hardware systems 600 of FIG. 6A, are connected to an external network communication system through connections 651 and to each other through a router or switch 652. For the example embodiment 650, the processing system platforms 670 are configured into three nominal groups as indicated by nodes 671, 673, and 675. The processing system platforms 670 within each group are managed together to provide virtual processing resources as part of the network
communication system. For the example embodiment 650, one group 672 of processing system platforms 670 is used to host a VM environment 654 that includes virtual machine (VM) platforms operating to provide the latency extraction processing system 120A, 120B ... 120C, respectively. One other group 674 of processing system platforms 670 is used to host a VM environment 656 that includes virtual machine (VM) platforms operating to provide latency extraction processing system 120D and first and second TAPs 104/114, respectively. It is noted that other groupings of processing system platforms 670 can also be used, or all of the processing system platforms 670 can be managed individually or as a single unit.
[0064] As described herein, each of the VM platforms 120A-D can receive streams of packets 108/118 from points within the network 614. Each of the VM platforms 120A-D can also receive streams of packets 108/118 from virtual points within the VM environments 654/656 as represented in embodiment 650 by virtual TAPs 104/114 and virtual packet streams 108/118 within VM environment 656. Further, there can be multiple different virtual TAPs 104/114, and a virtual load balancer 658 can be used to distribute packet data to the different VM platforms 120A-D. For example, the virtual load balancer 658 can be configured to distribute packets such that packets within a common flow are distributed to the same VM platform 120A-D so that they can be processed together. It is noted that the VM platforms 120A-C within VM environment 654 can receive packet streams from the external network as represented by connections 651 , from the virtual load balancer 658, and/or directly from the virtual TAPs 104/114, as desired. Similarly, the VM platform 120D within VM environment 656 can receive packet streams from the external network as represented by connections 651, from the virtual load balancer 658, and/or directly from the virtual TAPs 104/114, as desired. The VM environments 654/656 can also be configured to communicate with each other as well as with other processing systems or virtual environments within server system 650 or the external network 614. Further, it is noted that the processing system platforms 670 can be connected to each other by a high-speed communication backbone. Other variations could also be implemented while still taking advantage of the signature-based latency extraction techniques described herein.
[0065] It is further noted that the functional blocks, systems, devices, and/or circuitry described herein can be implemented using hardware, software, or a combination of hardware and software. In addition, one or more processing devices (e.g., central processing units (CPUs), controllers, microcontrollers, microprocessors, hardware accelerators, processors, programmable integrated circuitry, FPGAs (field programmable gate arrays), ASICs (application specific integrated circuits), and/or other processing devices) executing software and/or firmware instructions can be used to implement the disclosed embodiments. It is further understood that one or more of the operations, tasks, functions, or methodologies described herein can be implemented, for example, as software, firmware and/or other program instructions that are embodied in one or more non-transitory tangible computer-
readable mediums (e.g., data storage devices, flash memory, random access memory, read only memory, programmable memory devices, reprogrammable storage devices, hard drives, floppy disks, DVDs, CD-ROMs, and/or any other tangible data storage medium) and that are executed by one or more processing devices (e.g. , central processing units (CPUs), controllers, microcontrollers, microprocessors, hardware accelerators, processors, programmable integrated circuitry, FPGAs (field programmable gate arrays), ASICs (application specific integrated circuits), and/or other processing devices) to perform the operations, tasks, functions, or methodologies described herein.
[0066] Further modifications and alternative embodiments of this invention will be apparent to those skilled in the art in view of this description. It will be recognized, therefore, that the present invention is not limited by these example arrangements. Accordingly, this description is to be construed as illustrative only and is for the purpose of teaching those skilled in the art the manner of carrying out the invention. It is to be understood that the forms of the invention herein shown and described are to be taken as the presently preferred embodiments. Various changes may be made in the implementations and architectures. For example, equivalent elements may be substituted for those illustrated and described herein, and certain features of the invention may be utilized independently of the use of other features, all as would be apparent to one skilled in the art after having the benefit of this description of the invention.
Claims
1. A method to measure network packet latency, comprising:
receiving packets at a first input port associated with a first point within a network packet communication system;
receiving packets at a second input port associated with a second point within the network packet communication system; and
for each received packet:
generating a packet signature for the packet;
comparing the packet signature to packet signatures stored in a signature table; if a signature match is not found, storing the packet signature within the signature table along with a timestamp associated with the received packet; and if a signature match is found, determining a latency value for the received packet based upon a timestamp associated with the received packet and a timestamp associated with the matching packet signature within the signature table.
2. The method of claim 1, further comprising generating hash values as the packet signatures for the received packets, the hash values being based upon selected portions of the received packets.
3. The method of claim 1, further comprising storing the latency values in a latency table and using the stored latency values to determine one or more latency related parameters for the network packet communication system.
4. The method of claim 3, further comprising selecting one of the input ports as a reference port, generating sequence pointers for the latency table based upon an order in which packets are received at the reference port, and using the sequence pointers to order the latency values stored in the latency table.
5. The method of claim 4, further comprising using the ordered latency values within the latency table to determine one or more latency related parameters for the network packet communication system.
6. The method of claim 5, wherein the one or more latency related parameters comprises packet delay variation.
7. The method of claim 1, further comprising storing a port identifier associated with the received packet along with the hash value and the timestamp if a signature match is not found, and wherein a latency value is determined if a signature match is found only if a port identifier associated with the received packet does not match a port identifier stored for the matching packet within the signature table.
8. The method of claim 1, wherein the packets received at the input ports include timestamps.
9. The method of claim 1, further comprising generating a timestamp for each packet when the packet is received at the first input port or the second input port.
10. The method of claim 1, further comprising storing the packet signature for each received packet within an aging buffer, and after a detection time window, removing the packet signature from the aging buffer.
11. The method of claim 10, further comprising comparing each removed packet signature to packet signatures within the signature table and removing any matching packet signature and related timestamp from the signature table.
12. The method of claim 11, further comprising relying upon a size of the aging buffer to determine when packet signatures are removed from the aging buffer.
13. The method of claim 11, further comprising storing the timestamp associated with each packet signature in the aging buffer, and using the timestamp associated with each packet signature to determine when each packet signature is removed from the aging buffer.
14. The method of claim 1, further comprising classifying each packet based upon contents of the packet to generate a packet classification, and using the packet classification to update histogram information about packets having a common packet classification.
15. The method of claim 14, wherein the histogram information comprises latency information based upon the latency values.
16. The method of claim 1, wherein the received packets comprise request packets and response packets associated with the request packets, and wherein matching packet signatures are configured to pair a response packet to its associated request packet.
17. A system to measure latency for network packets, comprising:
a first input port configured to receive packets associated with a first point within a network packet communication system;
a second input port configured to receive packets associated with a second point within the network packet communication system;
one or more packet signature generators configured to generate a packet signature for each received packet;
a signature table configured to store packet signatures and timestamps; and
a latency processor configured to compare the packet signature for each received packet to packet signatures stored in the signature table, to store the packet signature within the signature table along with a timestamp associated with the received packet if a signature match is not found, and to determine a latency value for the received packet based upon a timestamp associated with the received packet and a timestamp associated with the matching packet signature within the signature table if a signature match is found.
18. The system of claim 17, wherein the one or more packet signature generators comprise one or more hash generators configured to generate hash values as the packet signatures for the received packets, the hash values being based upon selected portions of the received packets.
19. The system of claim 17, wherein the latency processor is further configured to store the latency values in a latency table and to determine one or more latency related parameters for the network packet communication system based upon the stored latency values.
20. The system of claim 19, wherein one of the input ports is a reference port, and wherein the latency processor is further configured to generate sequence pointers based upon an order in which packets are received at the reference port and to use the sequence pointers to order the latency values stored in the latency table.
21. The system of claim 20, wherein the latency processor is further configured to use the ordered latency values within the latency table to determine one or more latency related parameters for the network packet communication system.
22. The system of claim 21, wherein the one or more latency related parameters comprises packet delay variation.
23. The system of claim 17, wherein the latency processor is further configured to store a port identifier associated with the received packet along with the hash value and the timestamp if a signature match is not found, and wherein the latency processor is further configured to determine a latency value if a signature match is found only if a port identifier associated with the received packet does not match a port identifier stored for the matching packet within the signature table.
24. The system of claim 17, wherein the latency processor is configured to obtain timestamps from the packets received at the input ports.
25. The system of claim 17, further comprising one or more timestamp generators configured to generate a timestamp for each packet received at the first input port or the second input port.
26. The system of claim 17, further comprising an aging buffer, and wherein the latency processor is further configured to store the packet signature for each received packet within the aging buffer and to remove the packet signature from the aging buffer after a detection time window.
27. The system of claim 26, wherein the latency processor is further configured to compare each removed packet signature to packet signatures within the signature table and to remove any matching packet signature and related timestamp from the signature table.
28. The system of claim 27, wherein a size of the aging buffer is configured to determine when packet signatures are removed from the aging buffer.
29. The system of claim 27, wherein the latency processor is further configured to store the timestamp associated with each packet signature in the aging buffer and to use the timestamp associated with each packet signature to determine when each packet signature is removed from the aging buffer.
30. The system of claim 17, further comprising a classification engine configured to generate a packet classification for each packet based upon contents of the packet and to use the packet classification to update histogram information about packets having a common packet classification.
31. The system of claim 30, wherein the histogram information comprises latency information based upon the latency values.
32. The system of claim 17, wherein the received packets comprise request packets and response packets associated with the request packets, and wherein matching packet signatures are configured to pair a response packet to its associated request packet.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP16786890.0A EP3289707B1 (en) | 2015-04-29 | 2016-03-28 | Signature-based latency extraction systems and related methods for network packet communications |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/699,056 | 2015-04-29 | ||
US14/699,056 US9800482B2 (en) | 2015-04-29 | 2015-04-29 | Signature-based latency extraction systems and related methods for network packet communications |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2016175957A1 true WO2016175957A1 (en) | 2016-11-03 |
Family
ID=57199531
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2016/024449 WO2016175957A1 (en) | 2015-04-29 | 2016-03-28 | Signature-based latency extraction systems and related methods for network packet communications |
Country Status (3)
Country | Link |
---|---|
US (1) | US9800482B2 (en) |
EP (1) | EP3289707B1 (en) |
WO (1) | WO2016175957A1 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3281361A4 (en) * | 2015-07-01 | 2018-03-07 | Hewlett-Packard Enterprise Development LP | Latency measurer |
Families Citing this family (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10284471B2 (en) * | 2015-07-23 | 2019-05-07 | Netscout Systems, Inc. | AIA enhancements to support lag networks |
US10264092B2 (en) * | 2015-08-24 | 2019-04-16 | Lenovo Enterprise Solutions (Singapore) Pte. Ltd. | Signature based distributed inventory caching |
US10142212B2 (en) * | 2015-10-26 | 2018-11-27 | Keysight Technologies Singapore (Holdings) Pte Ltd | On demand packet traffic monitoring for network packet communications within virtual processing environments |
US10404564B2 (en) * | 2017-01-19 | 2019-09-03 | Cisco Technology, Inc. | System and method for continuous in-line monitoring of data-center traffic |
CN108809575B (en) | 2017-05-05 | 2024-01-30 | 华为技术有限公司 | Method for reporting port information, terminal equipment and network equipment |
US10931534B2 (en) * | 2017-10-31 | 2021-02-23 | Cisco Technology, Inc. | Auto discovery of network proxies |
FR3086481B1 (en) * | 2018-09-20 | 2021-12-10 | Thales Sa | DETECTION AND FILTERING PROCESS OF ILLEGITIMATE FLOWS IN A SATELLITE COMMUNICATION NETWORK |
WO2020139509A1 (en) * | 2018-12-27 | 2020-07-02 | Apple Inc. | Integrity protection for frequent small data transmission |
CN109886011B (en) * | 2018-12-28 | 2021-02-12 | 北京思源理想控股集团有限公司 | Safety protection method and device |
US11025519B2 (en) * | 2019-04-10 | 2021-06-01 | At&T Intellectual Property I, L.P. | Systems, methods and computer-readable media for external non-intrusive packet delay measurement |
US11283699B2 (en) | 2020-01-17 | 2022-03-22 | Vmware, Inc. | Practical overlay network latency measurement in datacenter |
US11240163B2 (en) * | 2020-01-17 | 2022-02-01 | Vmware, Inc. | Practical overlay network latency measurement in datacenter |
US20210264689A1 (en) * | 2020-02-24 | 2021-08-26 | Ford Global Technologies, Llc | Vehicle error alerting system |
WO2021171259A1 (en) * | 2020-02-27 | 2021-09-02 | Ssimwave Inc. | Real-time latency measurement of video streams |
US11570090B2 (en) | 2020-07-29 | 2023-01-31 | Vmware, Inc. | Flow tracing operation in container cluster |
US11336533B1 (en) | 2021-01-08 | 2022-05-17 | Vmware, Inc. | Network visualization of correlations between logical elements and associated physical elements |
US11677645B2 (en) | 2021-09-17 | 2023-06-13 | Vmware, Inc. | Traffic monitoring |
US20230117644A1 (en) * | 2021-10-15 | 2023-04-20 | Pensando Systems Inc. | Methods and systems for processing network packets using a service device in a smart switch |
US20230239247A1 (en) * | 2022-01-24 | 2023-07-27 | Netscout Systems Texas, Llc | Method and system for dynamic load balancing |
US11962516B1 (en) | 2023-01-31 | 2024-04-16 | Cisco Technology, Inc. | Packet deduplication |
Citations (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5521907A (en) | 1995-04-25 | 1996-05-28 | Visual Networks, Inc. | Method and apparatus for non-intrusive measurement of round trip delay in communications networks |
US20020055998A1 (en) * | 1997-11-25 | 2002-05-09 | Packeteer, Inc. | Method for automatically classifying traffic in a pocket communications network |
US20020093917A1 (en) | 2001-01-16 | 2002-07-18 | Networks Associates,Inc. D/B/A Network Associates, Inc. | Method and apparatus for passively calculating latency for a network appliance |
US20030046388A1 (en) | 2001-09-06 | 2003-03-06 | Milliken Walter Clark | Systems and methods for network performance measurement using packet signature collection |
US20050089016A1 (en) * | 1999-06-30 | 2005-04-28 | Kui Zhang | Method and apparatus for measuring latency of a computer network |
US20050207437A1 (en) * | 2004-03-16 | 2005-09-22 | Snowshore Networks, Inc. | Jitter buffer management |
US20050271071A1 (en) * | 2000-03-29 | 2005-12-08 | Microsoft Corporation | Method and system for accurately calculating latency variation on an end-to-end path in a network |
US20070195797A1 (en) * | 2006-02-23 | 2007-08-23 | Patel Alpesh S | Network device that determines application-level network latency by monitoring option values in a transport layer message |
EP1936867A1 (en) | 2006-12-22 | 2008-06-25 | Corvil Limited | Delay measurements in network traffic |
US7742415B1 (en) | 2007-09-26 | 2010-06-22 | The United States Of America As Represented By Secretary Of The Navy | Non-intrusive knowledge suite for evaluation of latencies in IP networks |
US8228923B1 (en) * | 2008-01-09 | 2012-07-24 | Tellabs Operations, Inc. | Method and apparatus for measuring system latency using global time stamp |
US20130063441A1 (en) * | 2011-09-09 | 2013-03-14 | Laura Choy | Measuring and Displaying Bandwidth Contention |
US20140119231A1 (en) | 2012-10-30 | 2014-05-01 | Lai-chong CHAN | Method and system for identifying matching packets |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6601098B1 (en) | 1999-06-07 | 2003-07-29 | International Business Machines Corporation | Technique for measuring round-trip latency to computing devices requiring no client-side proxy presence |
US6922417B2 (en) | 2000-01-28 | 2005-07-26 | Compuware Corporation | Method and system to calculate network latency, and to display the same field of the invention |
US8509072B2 (en) * | 2011-03-07 | 2013-08-13 | Comcast Cable Communications, Llc | Network congestion analysis |
US8462781B2 (en) | 2011-04-06 | 2013-06-11 | Anue Systems, Inc. | Systems and methods for in-line removal of duplicate network packets |
JP5716229B2 (en) * | 2011-12-28 | 2015-05-13 | 株式会社日立製作所 | Time synchronization system, management node, and time synchronization method |
US9191269B2 (en) | 2012-09-06 | 2015-11-17 | Verizon Patent And Licensing Inc. | Method and system for providing latency detection based on automated latency measurements of communication network paths |
US9521083B2 (en) * | 2014-01-27 | 2016-12-13 | Anue Systems, Inc. | Traffic differentiator systems for network devices and related methods |
US9705775B2 (en) * | 2014-11-20 | 2017-07-11 | Telefonaktiebolaget Lm Ericsson (Publ) | Passive performance measurement for inline service chaining |
-
2015
- 2015-04-29 US US14/699,056 patent/US9800482B2/en active Active
-
2016
- 2016-03-28 EP EP16786890.0A patent/EP3289707B1/en active Active
- 2016-03-28 WO PCT/US2016/024449 patent/WO2016175957A1/en active Application Filing
Patent Citations (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5521907A (en) | 1995-04-25 | 1996-05-28 | Visual Networks, Inc. | Method and apparatus for non-intrusive measurement of round trip delay in communications networks |
US20020055998A1 (en) * | 1997-11-25 | 2002-05-09 | Packeteer, Inc. | Method for automatically classifying traffic in a pocket communications network |
US20050089016A1 (en) * | 1999-06-30 | 2005-04-28 | Kui Zhang | Method and apparatus for measuring latency of a computer network |
US20050271071A1 (en) * | 2000-03-29 | 2005-12-08 | Microsoft Corporation | Method and system for accurately calculating latency variation on an end-to-end path in a network |
US20020093917A1 (en) | 2001-01-16 | 2002-07-18 | Networks Associates,Inc. D/B/A Network Associates, Inc. | Method and apparatus for passively calculating latency for a network appliance |
US20030046388A1 (en) | 2001-09-06 | 2003-03-06 | Milliken Walter Clark | Systems and methods for network performance measurement using packet signature collection |
US20050207437A1 (en) * | 2004-03-16 | 2005-09-22 | Snowshore Networks, Inc. | Jitter buffer management |
US20070195797A1 (en) * | 2006-02-23 | 2007-08-23 | Patel Alpesh S | Network device that determines application-level network latency by monitoring option values in a transport layer message |
EP1936867A1 (en) | 2006-12-22 | 2008-06-25 | Corvil Limited | Delay measurements in network traffic |
US7742415B1 (en) | 2007-09-26 | 2010-06-22 | The United States Of America As Represented By Secretary Of The Navy | Non-intrusive knowledge suite for evaluation of latencies in IP networks |
US8228923B1 (en) * | 2008-01-09 | 2012-07-24 | Tellabs Operations, Inc. | Method and apparatus for measuring system latency using global time stamp |
US20130063441A1 (en) * | 2011-09-09 | 2013-03-14 | Laura Choy | Measuring and Displaying Bandwidth Contention |
US20140119231A1 (en) | 2012-10-30 | 2014-05-01 | Lai-chong CHAN | Method and system for identifying matching packets |
Non-Patent Citations (1)
Title |
---|
L. MARK ET AL., PASSIVE ONE-WAY DELAY MEASUREMENT, 1 June 2003 (2003-06-01) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3281361A4 (en) * | 2015-07-01 | 2018-03-07 | Hewlett-Packard Enterprise Development LP | Latency measurer |
US10425308B2 (en) | 2015-07-01 | 2019-09-24 | Hewlett Packard Enterprise Development Lp | Latency measurer |
Also Published As
Publication number | Publication date |
---|---|
EP3289707A1 (en) | 2018-03-07 |
EP3289707A4 (en) | 2018-11-21 |
EP3289707B1 (en) | 2020-11-11 |
US20160323166A1 (en) | 2016-11-03 |
US9800482B2 (en) | 2017-10-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3289707B1 (en) | Signature-based latency extraction systems and related methods for network packet communications | |
US11128552B2 (en) | Round trip time (RTT) measurement based upon sequence number | |
US9654372B2 (en) | Patent latency monitoring in software-defined networks | |
US10135711B2 (en) | Technologies for sideband performance tracing of network traffic | |
US9954693B2 (en) | System and method of assessing latency of forwarding data packets in virtual environment | |
Phan et al. | Sdn-mon: Fine-grained traffic monitoring framework in software-defined networks | |
TW201520770A (en) | Port mirroring for sampling measurement of network flows | |
CN109428782B (en) | Network monitoring method and equipment | |
EP3624401B1 (en) | Systems and methods for non-intrusive network performance monitoring | |
CN117121458A (en) | Wide area network services using provider network backbone networks | |
US20160248652A1 (en) | System and method for classifying and managing applications over compressed or encrypted traffic | |
US11088960B2 (en) | Information processing apparatus and verification system | |
Cao et al. | CoFilter: High-performance switch-accelerated stateful packet filter for bare-metal servers | |
US20170324708A1 (en) | Concurrent Security Processing Of Network Packets By Multiple In-Line Network Security Tools | |
Einziger et al. | Constant time weighted frequency estimation for virtual network functionalities | |
CN113132179A (en) | Measuring packet residence and propagation times | |
CN105634999B (en) | A kind of aging method and device of Media Access Control address | |
EP3092737B1 (en) | Systems for enhanced monitoring, searching, and visualization of network data | |
CN112313638A (en) | Efficient time-based association of data streams | |
JP2018519753A (en) | Estimating VM to VM traffic in a multi-tenant data center | |
WO2022100707A1 (en) | Method, apparatus and system for determining data flow information | |
Gray et al. | Simulative evaluation of KPIs in SDN for topology classification and performance prediction models | |
Pacífico et al. | Bloomtime: space-efficient stateful tracking of time-dependent network performance metrics | |
Csikor et al. | End-host driven troubleshooting architecture for software-defined networking | |
EP3092771A1 (en) | Apparatus, system, and method for enhanced monitoring and interception of network data |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16786890 Country of ref document: EP Kind code of ref document: A1 |
|
REEP | Request for entry into the european phase |
Ref document number: 2016786890 Country of ref document: EP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |