Network processor for analyzing network data

Abstract

A network processor used to route network packet to multiple analysis processors for analysis. A network processor is programmable and routes data by receiving the network packets and identifying a transaction of each packet. Each packet is assigned the same transaction identifier by the network processor. A path manager can then send all packets having the same transaction identifier to the same analysis processor. This analysis processors can more easily perform transactional analysis. The network processor also generates control signals that can select the appropriate path for the packets. Alternatively, the transaction identifier and timestamps can be interleaved with the packets for use in distributing the packets to the appropriate analysis processors.

1 . A network processor for analyzing data transferred in a network, the network processor comprising: 
 a parser that extracts identification fields for each packet included in network data;    a transaction manager that determines whether the each packet included in the network data has been assigned a transaction identifier based on the identification fields, wherein the transaction manager assigns a new transaction identifier to each packet that is not assigned to a transaction identifier;    a path manager that determines an appropriate path for each packet based on the transaction identifier associated with each packet; and    an interleaver that combines at least the transaction identifier and the appropriate path with each packet such that packets having the same transaction identifier are routed to a particular analysis processor.    
     
     
         2 . The network processor of  claim 1 , further comprising a transaction look up table that stores transaction identifiers that have been assigned to packets, wherein the transaction manager accesses the transaction look up table to determine if each packet has been assigned a transaction identifier.  
     
     
         3 . The network processor of  claim 1 , further comprising a path look up table used by the path manager to associate transaction identifiers with specific path such that each packet associated with a particular transaction identifier is routed to a particular path.  
     
     
         4 . The network processor of  claim 1 , wherein the identification fields include: 
 a source of a transaction to which each packet corresponds;    a destination of the transaction to which each packet corresponds; and    an identification number assigned to each packet.    
     
     
         5 . The network processor of  claim 1 , wherein the path manager receives a status from each analysis processor connected with the network processor, wherein the status determines whether each analysis processor can receive more packets of network data.  
     
     
         6 . The network processor of  claim 5 , further comprising a filter manager that uses the status to determine whether network data is excluded from analysis by each analysis processor, wherein the network data excluded from analysis includes one or more of a portion of a packet, a payload of a packet, each packet in a particular transaction.  
     
     
         7 . The network processor of  claim 1 , further comprising a frame parser that extracts a start of frame and an end of frame for each packet such that the path manager can establish the appropriate path for a particular duration for the associated network data.  
     
     
         8 . The network processor of  claim 1 , further comprising control signals used to select the appropriate path in a distribution module connected with the path manager, wherein the control signals are controlled by the path manager.  
     
     
         9 . In a system that transmits network data, a network processor that facilitates the analysis of the network data by sending packets of a particular transaction to a particular analysis processor, the network processor comprising: 
 a parser that extracts identification fields from each packet, wherein the identification fields include an identification number that identifies a particular transaction of each packet;    a transaction manager that uses a transaction lookup table to determine whether a particular transaction has been assigned a transaction identifier, wherein each packet is assigned a particular transaction identifier based on data in the lookup table; and    a path manager that routes each packet with the same transaction identifier to a particular analysis processor, wherein each packet is associated with a timestamp.    
     
     
         10 . The network processor of  claim 9 , further comprising a frame parser that enables the path manager to determine a length of each packet.  
     
     
         11 . The network processor of  claim 9 , wherein the path manager receives a status from each analysis processor connected with the processor, each status indicating whether the associated analysis processor is able to receive additional packets.  
     
     
         12 . The network processor of  claim 9 , wherein the identification fields include a source of the particular transaction, a destination of the particular transaction, and a identification number.  
     
     
         13 . The network processor of  claim 9 , wherein the path manager generates one or more control signals that select a particular path for each packet.  
     
     
         14 . The network processor of  claim 9 , wherein the path manager interleaves the timestamp and the transaction identifier with the associated packets in the network data.  
     
     
         15 . A method for routing packets of network data to analysis processors for analysis, the method comprising; 
 receiving network data including packets;    identifying a transaction for a particular packet;    identifying a particular transaction identifier associated with the particular packet; and    sending the particular packet to a particular analysis processor based on the transaction identifier associated with the particular packet.    
     
     
         16 . The method of  claim 15 , wherein identifying a transaction for a particular packet further comprises identifying an identification number, a source, and a destination of the transaction from identification fields in the particular packet.  
     
     
         17 . The method of  claim 16 , wherein identifying a particular transaction identifier associated with the particular packet further comprises: 
 accessing a look up table based on at least one of the identification number, the source, and the destination to determine if the particular transaction identifier is already assigned to the particular packet; and    assigning the particular transaction identifier to the particular packet if the particular packet is not associated with any transaction identifier.    
     
     
         18 . The method of  claim 15 , wherein sending the particular packet to a particular analysis processor based on the transaction identifier associated with the particular packet further comprises monitoring a buffer level of a queue associated with the particular analysis processor.  
     
     
         19 . The method of  claim 18 , further comprising directing the particular packet to a second analysis processor based on the buffer level of the queue associated with the particular analysis processor.  
     
     
         20 . The method of  claim 15 , further comprising generating control signals to select a path for the particular packet such that the particular packet is transmitted to the particular analysis processor.  
     
     
         21 . The method of  claim 15 , further comprising interleaving a timestamp and the particular transaction identifier with the particular packet.