Data stream protocol analysis with queue management

Abstract

Queue management in performing protocol analysis on network data with multiple analysis processors. Each analysis processor is associated with a memory buffer such as a FIFO queue. Each FIFO queue maintains a status signal representing the fullness of the FIFO queue. The status signal is provided to the analysis processor connected with the FIFO queue and to a network processor that is used in routing the packets of network data. If the status signal indicates that the FIFO queue is too full, then the network processor can redirect the packets to a different analysis processor, begin excluding certain packets from analysis, or controlling the distribution of the packets. Alternatively or at the same time, the analysis processor can begin to restrict which aspects of protocol analysis are performed on the packets of data in the FIFO queue. Full analysis can resume based according to the status signal.

1 . A system for routing network data to multiple analysis processors, the system comprising: 
 a plurality of analysis processors that perform protocol analysis on packets of network data;    a plurality of memory buffers, wherein each analysis processor is connected to one of the memory buffers, wherein each memory buffer generates a status signal that determines the ability of each memory buffer to accept additional packets of network data; and    a distribution module that delivers the packets of network data to the plurality of memory buffers based on a transaction identifier associated with each packet and based on the status signal of each memory buffer, wherein each packet in a particular transaction is delivered to a particular memory buffer and analyzed by a particular analysis processor.    
   
   
       2 . The system of  claim 1 , further comprising a network processor that associates a transaction identifier with each packet in the network data.  
   
   
       3 . The system of  claim 1 , wherein the distribution module is a field programmable gate array.  
   
   
       4 . The system of  claim 1 , wherein the distribution module is a demultiplexor having outputs connected to the plurality of memory buffers.  
   
   
       5 . The system of  claim 1 , wherein the protocol analysis comprises one or more of physical layer analysis, packet layer analysis, command layer analysis, application layer analysis, and network layer analysis.  
   
   
       6 . The system of  claim 2 , each status signal generated by each memory buffer is provided to both the network processor and the associated analysis processor.  
   
   
       7 . The system of  claim 6 , wherein the status signal of each memory buffer identifies a data level in the memory buffer, wherein the data level determines whether the network processor routes additional packets of network data to each memory buffer.  
   
   
       8 . The system of  claim 7 , wherein the status signal of each memory buffer determines which protocol analysis tests are performed on the data packets in each corresponding memory buffer by the corresponding analysis processor.  
   
   
       9 . The system of  claim 7 , wherein each memory buffer is a FIFO queue.  
   
   
       10 . A method for routing packets of network data to analysis processors, the method comprising: 
 assigning each packet in network data a transaction identifier with a network processor;    distributing each packet in the network data to a plurality of memory buffers based on the transaction identifier of each packet;    delivering packets in each memory buffer to a plurality of analysis processors, each memory buffer connected with a particular analysis processor;    maintaining a status signal for each memory buffer, wherein the status signal identifies a buffer level;    providing the status signal from each memory buffer to the network processor; and    controlling distribution of additional packets to each memory buffer based on the associated status signal.    
   
   
       11 . The method of  claim 10 , wherein controlling distribution of additional packets to each memory buffer based on the associated status signal further comprises sending the additional packets to a different analysis processor.  
   
   
       12 . The method of  claim 10 , wherein controlling distribution of additional packets to each memory buffer based on the associated status signal further comprises reducing a number of analysis tests performed by the particular analysis processor associated with the additional packets based on the status signal.  
   
   
       13 . The method of  claim 10 , wherein controlling distribution of additional packets to each memory buffer based on the associated status signal further comprises balancing a load such that each memory buffer contains substantially the same amount of packets of network data.  
   
   
       14 . The method of  claim 10 , wherein controlling distribution of additional packets to each memory buffer based on the associated status signal further comprises excluding certain packets of network data from being delivered to the plurality of memory buffers.  
   
   
       15 . The method of  claim 10 , wherein controlling distribution of additional packets to each memory buffer based on the associated status signal further comprises determining whether a particular packet qualifies for analysis and discarding the particular packet if it does not qualify for analysis.  
   
   
       16 . The method of  claim 10 , wherein controlling distribution of additional packets to each memory buffer based on the associated status signal further comprises filtering the additional packets of network data at the network processor.  
   
   
       17 . The method of  claim 16 , wherein filtering the additional packets of network data further comprises excluding packets of a particular type from being distributed to each memory buffer.  
   
   
       18 . The method of  claim 16 , wherein controlling distribution of additional packets to each memory buffer based on the associated status signal further comprises checking the status signal to determine whether to continue filtering the additional packets of network data.