Apparatus and method for analysing a network

Abstract

The invention relates to an apparatus for analysing a network flow, comprising—a parser for extracting flow identification information from the network flow, —a flow metering unit for metering the network flow, —a programmable controller for controlling the flow metering unit and the parser.

1 . An apparatus for analysing a network flow, the apparatus comprising:
 a parser for extracting flow identification information from the network flow;   a flow metering unit for metering the network flow; and   a programmable controller for controlling the flow metering unit and the parser.   
   
   
       2 . The apparatus according to  claim 1 , wherein the flow metering unit is configured for sending flow status information to the programmable controller and wherein the programmable controller is configured for sending flow metering instructions to the flow metering unit in dependence on the flow status information. 
   
   
       3 . The apparatus according to  claim 1 , wherein the parser is configured for sending parsing information to the programmable controller and wherein the programmable controller is configured for sending parsing instructions to the parser in dependence on the parsing information. 
   
   
       4 . The apparatus according to  claim 1 , wherein the programmable controller is configured for:
 evaluating in parallel two or more flow status information values of the flow metering unit; and   sending two or more flow metering instructions in parallel to the flow metering unit.   
   
   
       5 . The apparatus according to  claim 1 , wherein the programmable controller comprises a program memory having two or more flow metering programs. 
   
   
       6 . The apparatus according to  claim 1 , wherein the programmable controller is implemented as state machine. 
   
   
       7 . The apparatus according to  claim 6 , wherein the state machine comprises:
 a transition rule memory;   a rule selector; and   a state register;   wherein the rule selector is configured for receiving an external input signal and an internal input signal from the state register indicating the current state and wherein the rule selector is configured for observing the internal and external input signal by means of the transition rule memory for transition rules and for changing the state of the state register and generation of an output signal having parsing and/or flow metering instructions when a transition rule applies.   
   
   
       8 . The apparatus according to  claim 1 , wherein the flow metering unit comprises:
 a flow table unit;   a flow table management unit; and   a flow information export unit.   
   
   
       9 . The apparatus according to  claim 8 , wherein the flow table management unit comprises a programmable hash function unit provided with two or more selectable hash functions for mapping the flow identification information on a hash index, wherein the programmable controller is configured for selecting one of the selectable hash functions. 
   
   
       10 . The apparatus according to  claim 8 , wherein the programmable controller is configured for sending table management commands to the table management unit. 
   
   
       11 . The apparatus according to  claim 1 , wherein the apparatus is implemented as hardware assist device. 
   
   
       12 . The apparatus according to  claim 1 , further comprising:
 a central processing unit;   a memory; and   a computer networking device.   
   
   
       13 . The apparatus according to  claim 12 , wherein the apparatus is implemented in hardware as hardware assist device for the central processing unit. 
   
   
       14 . The apparatus according to  claim 1 , further comprising:
 two or more virtual computing systems;   wherein the apparatus is provided for analysing the network flow between the virtual computing systems and/or between the virtual computing systems and an external device.   
   
   
       15 . The apparatus according to  claim 14 , further comprising:
 a software networking device for internal communication between the virtual computing systems; and   a hardware networking device for external communication between the virtual computing systems and an external device;   wherein the software networking device and the hardware networking device are provided for forwarding the network flow between the virtual computing systems and/or between the virtual computing systems and an external device for an analysis to the apparatus.   
   
   
       16 . The apparatus according to  claim 15 , wherein the apparatus is arranged in the hardware networking device. 
   
   
       17 . A method for analysing a network flow, comprising the steps of:
 extracting flow identification information from the network flow using a parser;   metering the network flow using a flow metering unit; and   controlling the flow metering unit and the parser using a programmable controller.   
   
   
       18 . A computer readable program product tangibly embodying computer executable instructions which when implemented, causes the computer to carry out an analysis of a network flow according to the steps of the method according to  claim 17 .