Data stream protocol prioritized analysis

Abstract

Methods and apparatuses for performing priority analysis on data transferred in a network. A network processor is connected with a distribution module that distributes network data to multiple memory buffers that are each connected with an analysis processor. Each analysis processor performs protocol analysis tests on the data it receives. When a status signal generated by each memory buffer indicates that the memory buffer is nearing capacity, the corresponding analysis processor may selecting exclude protocol analysis tests based on the priority of those tests. The protocol analyzer is also scalable to include multiple instances of network processors, distribution modules, memory buffers and analysis processors. Each instance is typically interconnected.

1 . A method for performing protocol analysis on network data, the method comprising: 
 receiving network data representing at least a portion of a data stream transmitted in a network at a network processor;    distributing the network data to a plurality of memory buffers connected with a plurality of analysis processors such that each packet of a particular transaction is distributed to the same analysis processor, wherein each memory buffer generates a status signal indicating a fullness of the memory buffer;    assigning a priority to each of a plurality of protocol analysis tests; and    performing selected protocol analysis tests based on the priority when the status signal is above a threshold level.    
   
   
       2 . The method of  claim 1 , wherein the priority of each protocol analysis test is assigned based on at least one of: (i) whether each protocol analysis test is a functional test, (ii) whether each protocol analysis test is a performance test, (iii) whether each protocol analysis test has been conducted in the past, (iv) whether each protocol analysis test has been conduct on a particular transaction in the past, (v) and whether each protocol analysis test has identified errors for previous network data analyzed by the plurality of analysis processors.  
   
   
       3 . The method of  claim 1 , further comprising looking up entries in a priority look up table, each entry assigning a priority to at least two of the protocol analysis tests.  
   
   
       4 . The method of  claim 1 , wherein performing selected protocol analysis tests based on the priority when the status signal is above a threshold level is performed at real-time speed.  
   
   
       5 . The method of  claim 1 , further comprising comparing the status signal to the threshold level to determine whether the status signal is above the threshold level, wherein the threshold level represents an amount of data in a memory buffer.  
   
   
       6 . The method of  claim 1 , further comprising presenting a user a description of certain protocol analysis tests not conducted on the network data due to the priority of the certain protocol analysis tests.  
   
   
       7 . The method of  claim 1 , further comprising presenting results of the selected protocol analysis tests to the user.  
   
   
       8 . The method of  claim 11 , further comprising prioritizing tests of transaction identifications that have not been conducted over transaction identifications that have been tested.  
   
   
       9 . The method of  claim 15 , further comprising prioritizing functionality protocol analysis tests over performance protocol analysis tests.  
   
   
       10 . A protocol analyzer for performing protocol analysis of network data, the protocol analyzer comprising: 
 a first network processor configured to receive first network data representing at least a portion of a data stream transferred in a first network link;    a second network processor configured to receive second network data representing at least a portion of a data stream transferred in a second network link;    first analysis processors coupled to the first network processor for performing protocol analysis tests on at least the first network data;    second analysis processors coupled to the second network processor for performing protocol analysis tests on at least the second network data, wherein the second analysis processors are configured to communicate with the first analysis processors;    a first distribution module that distributes packets from the first network processor to the first analysis processors; and    a second distribution module that distributes packets from the second network processor to the second analysis processors, wherein the second distribution module communicates with the first distribution module such that packets from the first distribution module can be distributed to the second analysis processors.    
   
   
       11 . The protocol analyzer of  claim 10 , further comprising a programmable logic device (PLD) configured to receive network data from a network link and selectively direct the network data to at least one of the first network processor and the second network processor.  
   
   
       12 . The protocol analyzer of  claim 11 , wherein the PLD is a Field programmable gate array (FPGA).  
   
   
       13 . The protocol analyzer of  claim 11 , further comprising first memory buffers that queue the first network data for the first analysis processors and second memory buffers that queue the second network data for the second analysis processors, wherein the distribution of the first network data and of the second network data is controlled by control signals generated by at least one of the first network processor and the second network processor such that packets in the first network data and the second network data belonging to the same transaction are distributed to the same analysis processor included in either the first or second analysis processors.  
   
   
       14 . The protocol analyzer of  claim 11 , wherein the PLD selectively directs the network data between the first and second network processors based on a status signal received from at least one memory buffer coupled to one of the first or second analysis processors.  
   
   
       15 . The protocol analyzer of  claim 11 , wherein the PLD includes a transaction look up table manager for assigning a transaction identification to the packets in the first and second network data.  
   
   
       16 . The protocol analyzer of  claim 15 , wherein each network processor includes an analysis processor LUT path manager for routing the first or second network data to a particular analysis processor based on the transaction identification assigned to the first or second network data by the PLD.  
   
   
       17 . The protocol analyzer of  claim 11 , wherein an output of the first distribution module is coupled to an input of the second distribution module.  
   
   
       18 . The protocol analyzer of  claim 9 , wherein the first network processor is coupled to the second network processor for providing communication between the first and second network processors.