Adaptive network router

A network router includes a set of interface cards to receive packets from a network, and a set of accounting modules to calculate flow statistics for the packets. The router further includes a control unit to adaptively update routing information in response to the calculated flow statistics, and to route the packets in accordance with the routing information. The control unit identifies potentially malicious packet flows for the received packets based on the flow statistics, and applies an intercept filter to intercept the packets of the identified packet flows. The control unit analyzes the intercepted packets in real-time to determine the presence of a network event, and updates the routing information based on the determination, e.g., by terminating routing for packets associated with malicious packet flows. In this manner, the router may adaptively respond to network events, such as network security violations.

TECHNICAL FIELD

The invention relates to computer networks and, more particularly, to routing packets within computer networks.

BACKGROUND

A computer network is a collection of interconnected computing devices that can exchange data and share resources. In a packet-based network, such as the Internet, the computing devices communicate data by dividing the data into small blocks called packets, which are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission.

The packets are communicated according to a communication protocol that defines the format of the packet. A typical packet, for example, includes a header carrying source and destination information, as well as a payload that carries the actual data. The de facto standard for communication in conventional packet-based networks, including the Internet, is the Internet Protocol (IP).

A system administrator or other user often makes use of a network analyzer to monitor network traffic and debug network problems. In general, a network analyzer is a tool that captures data from a network and presents the data to the user. The network analyzer typically allows the user to browse the captured data, and view summary and detail information for each packet. Accordingly, the user can view the network traffic flowing between devices on the network. The information collected during traffic flow analysis may be used for network planning, traffic engineering, network monitoring, usage-based billing and the like. Many conventional network analyzers, such as NetFlow, NeTraMet and FlowScan, use software applications to collect traffic flow information.

The analyzers typically monitor and collect packets having routing information that matches criteria specified by the system administrator. The system administrator may specify, for example, source and destination Internet Protocol (IP) addresses, source and destination port numbers, protocol type, type of service (ToS) and input interface information. The analyzers typically collect packets matching the specified criteria, and construct flow analysis diagrams. Conventional network analyzers often make use of sampling techniques to selectively sample the packets, and present a statistically generated view of the traffic within the network. Consequently, the statistics generated by the network analyzer may not only be limited to specified flows, but may be relatively inaccurate.

SUMMARY

In general, the invention is directed to techniques for monitoring and analyzing traffic flows within a network. A network router, in accordance with the principles of the invention, integrates accounting functionality for generation of flow statistics with packet intercept functionality to dynamically adapt to network events, such as network security violations.

In one embodiment, a method comprises distributing packets to a set of analysis service cards of a router for real-time traffic analysis, and updating routing information of the router in response to the traffic analysis. The method further comprises routing the packets in accordance with the routing information.

In another embodiment, a network router includes a set of interface cards to receive packets from a network, and a set of accounting modules to calculate flow statistics for the packets. The router further includes a control unit to update routing information in response to the calculated flow statistics, and to route the packets in accordance with the routing information. The control unit identifies potentially malicious packet flows for the received packets based on the flow statistics, and applies one or more intercept filters to intercept the packets of the identified packet flows. The control unit analyzes the intercepted packets in real-time to determine the presence of a network event, and updates the routing information based on the determination, e.g., by terminating routing for packets associated with malicious packet flows.

In another embodiment, a method comprises receiving packets from a network, and calculating flow statistics for the packets. The method further includes updating routing information in response to the calculated flow statistics, and routing the packets in accordance with the routing information.

In another embodiment, a network router comprises a set of interface cards to receive packets from a network, and a set of accounting service cards to calculate flow statistics for the packets. The router further comprises a control unit intercept a subset of the packets based on the flow statistics, and a set of packet analysis cards to perform real-time analysis on the intercepted packets.

The techniques may provide one or more advantages. For example, flow analysis and packet intercept features may be readily integrated within a router for a packet-based network. The router may, for example, operate as a core router within the Internet to route packets received from high data rate communication links, such as OC-3, OC-12, OC-48, and greater communication links. The router may integrate accounting functionality to generate flow records for routed packets, as well as intercept features to capture packets for select packet flows. In this manner, the router can adjust routing functions based on the generated flow records and intercepted packets, thereby dynamically reacting to network events, such as Denial of Service (DOS) attacks and other network security violations.

In addition, multiple accounting service cards and multiple packet analysis cards may be added to easily scale the network router to support monitoring and accounting for higher bandwidth communication links. Depending upon processing power, two accounting service cards may be used to provide accounting for a single OC-3 communication link, while four cards and sixteen cards may be used to monitor OC-12 and OC-48 links, respectively. As another example, eight accounting service cards may be used to monitor four OC-3 links. Additional accounting service cards may be used for purposes of redundancy to support continuous, uninterrupted packet processing and accounting in the event of card failure.

DETAILED DESCRIPTION

FIG. 1illustrates an exemplary system2in which a network monitor4integrates accounting functionality for generation of flow records with packet intercept functionality to provide a comprehensive traffic analysis environment in accordance with the principles of the invention. Network monitor4is coupled to network6for monitoring network traffic. Network6may be formed by an interconnected group of autonomous systems, each representing an independent administrative domain having a variety of networked resources capable of packet-based communication. For example, network6may include servers, workstations, network printers and fax machines, gateways, routers, and the like. Each autonomous system within network6typically includes at least one router for sharing routing information with, and forwarding packets to, the other autonomous systems via communication links.

The term “packet” is used herein to generally describe a unit of data communicated between resources in conformance with a communication protocol. The principles of the invention may be readily applied to a variety of protocols, such as the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP), the Internet Protocol (IP), Asynchronous Transfer Mode, Frame Relay, and the like. Accordingly, “packet” is used to encompass any such unit of data, and may be interchanged with the term “cell,” or other similar terms used in such protocols to describe a unit of data communicated between resources within the network.

As described, network monitor4includes one or more accounting modules that generate accurate flow statistics for traffic within network6. More specifically, network monitor4captures packets from one or more links within network6, and can generate flow statistics for each packet flow within the link. As network monitor4receives packets, the accounting modules associate the network packets with respective packet flows, and update the statistics for the packets flows. For example, the accounting modules may maintain an accurate packet count, byte count, source IP address, destination IP address, next hop IP address, input interface information, output interface information, total octets sent, flow start time, flow end time, source and destination port numbers, TCP flags, IP type of service, originating AS, source address prefix mask bits, destination address prefix mask bits, and the like, for each packet flow.

The accounting modules provide real-time accounting capabilities for maintaining accurate flow statistics for all of the packets received by network monitor4. In particular, as described herein, the accounting modules can monitor and generate statistics for high traffic rates, even core traffic rates of the Internet, including OC-3, OC-12, OC-48, and higher rates.

Network monitor4outputs a stream of flow records14that carry flow statistics for the captured packets. Network monitor4may, for example, output flow records14carrying accounting data for each flow, such as a number of packets, a number of bytes, a time of capturing a first packet for the flow, a time of capturing a most recent packet for the flow, an incoming interface, an outgoing interface, a source/destination network mask, a source/destination Autonomous System (AS) number, and the like. Accounting server10receives flow records14, and updates an accounting system based on the flow records for further detailed analysis.

In addition, network monitor4provides intercept capabilities that allow a real-time packet analyzer12to monitor specific packet flows within network4. Network monitor4outputs a stream of packets16to real-time packet analyzer12for further analysis. The stream of packets16comprises a subset of the packets captured from network6. In particular, network monitor4intercepts packets for one or more selected packet flows within network4, and outputs the intercepted packets as a stream of packets16. Packet analyzer12receives the stream of packets16, and analyzes the packets to identify any suspicious packet flows. For example, packet analyzer12may identify packet flows arising from Denial of Service (DOS) attacks and other network security violations.

A system administrator may provide intercept information to network monitor4that specifies a set of packet flows for which to capture packets. The system administrator may provide the intercept information directly, e.g., via a keyboard, mouse or other input mechanism, to control interception of packet flows. In addition, an administrator may remotely provide the routing information to network monitor4via a remote management protocol. In this manner, the administrator may selectively define the packet flows, and packets within a given flow, that are intercepted for analysis.

Network monitor4may also control the stream of intercepted packets16based on feedback from accounting server10. More specifically, accounting server10may perform preliminary traffic analysis based on the flow records14received from network monitor4, and provides filter information18to the network monitor to control the interception and forwarding of packets flows to packet analyzer12for further analysis. In this manner, network monitor4integrates accounting functionality for generation of flow records14along with packet intercept functionality to provide a comprehensive traffic analysis environment.

Although illustrated as a stand-alone apparatus, the features of network monitor4may be integrated within a network device. For example, as described in detail below, the feature may be integrated within a router. Other network devices in which the features may be integrated include gateways, switches, servers, workstations, and the like.

FIG. 2is a block diagram illustrating in further detail an example embodiment of network monitor4coupled to communication links24of network6. As illustrated, network6includes routers20A,20B (“routers20”) coupled via communication links24. Routers20may comprise conventional routers that forward packets in accordance with a topology of network6. Communication links24may comprise uni-directional optical links for carrying packets between routers20at high data rates, such as OC-3, OC-12, OC-48 and greater rates. Optical splitters25A,25B (“optical splitters25”) may be inserted within communication links24to passively collect optical data transmitted and received between routers20.

Network monitor4includes two ports26A,26B for receiving the optical data21A,21B, respectively, and forwarding the data in digital form to control unit28. As discussed in detail, control unit28merges the inbound data21A,21B received from ports26A,26B, and digitally generates two identical packets streams27A,27B from the data. Control unit28applies filter30to packet stream27A to selectively capture packet flows16for forwarding to packet analyzer12via output port26C. In addition, control unit28distributes packets of the second stream27B to accounting modules32. Accounting modules32generate flow records14based on all of the packets of data stream27B, i.e., all of the packets received from optical splitters25, and forward flow records14to accounting server10via output port26D.

Accounting modules32may buffer flow records14for a given packet flow until the flow “expires,” i.e., when the accounting modules32detect inactivity for the flow for a configurable period of time, e.g., 30 minutes. Accounting modules32may periodically output batches of flow records14for all flows that have recently expired, e.g., every fifteen, thirty or sixty seconds. For packet flows that remain active for long durations, accounting modules32may be configured to automatically expire the packet flows after a defined duration, e.g., 30 or 60 minutes. Upon marking the active packet flow as expired, accounting modules32may output one or more flow records14for the packet flow, and may reset the statistics for the packet flow. Alternatively, accounting modules may output flow records114without resetting the statistics for the active packet flow.

FIG. 3is a block diagram illustrating another exemplary embodiment of a network monitor4. In the illustrated embodiment, network monitor4includes a chassis33for housing control unit42. Chassis33has a number of slots (not shown) for receiving a set of cards, including interface cards (IFCs)34, accounting service cards (ACCOUNTING SCs)36, an encryption service card (ENCRYPTION SC)38, and a tunnel service card (TUNNEL SC)40. Each card may be inserted into a corresponding slot of chassis33for electrically coupling the card to control unit42via a bus, backplane, or other electrical communication mechanism.

Interface cards34include ports for receiving inbound data21from optical splitters25, and for outputting flow records14and intercepted packet flows16. Accordingly, interface cards34include a number of ports (not shown) for coupling with communication links.

Accounting service cards36each include one or more accounting modules that generate flow records based on packets received from control unit42. Each accounting service card36may, for example, include one or more microprocessors, FPGAs, ASICs, or other components. As described, control unit42distributes packets to accounting service cards36for accounting and generation of flow records14. In one embodiment, control unit42distributes the packets of a common flow to a common accounting service card36. In other words, control unit42distributes packet flows across accounting service cards36, and ensures that packets of any particular flow are distributed to a common one of accounting service cards36. In this manner, each of accounting service cards can generate complete flow records for the packet flows for which the card receives packets.

In one embodiment, control unit42applies a hashing function to at least a portion of the header for each packet to ensure that packet flows are distributed across accounting service cards36, and that packets of a packet flow are distributed to a common one of the accounting service cards36. Control unit42may apply a hashing function to at least one of a source network address, a destination network address, and a communication protocol for the packet. Control unit42may apply the hash function to header information with each packet to generate a hash value, and distribute each packet to one of the accounting service cards36based on the calculated hash values. Furthermore, portions of the header information may be selected to cause packet fragments associated with a common one of the network packet to be distributed to a common one of the accounting service cards. For example, layer 4 port information may be ignored, which may not be present for packet fragments.

Multiple accounting service cards36may be added to easily scale network monitor4to support monitoring and accounting for higher bandwidth communication links. For example, depending upon processing power, two accounting service cards36may be used to provide accounting for a single OC-3 communication link, while four cards and sixteen cards may be used to monitor OC-12 and OC-48 links, respectively. As another example, eight accounting service cards36may be used to monitor four OC-3 links. Additional accounting service cards36may be used for purposes of redundancy to support continuous, uninterrupted packet processing and accounting in the event of card failure.

As described with respect to accounting modules32(FIG. 2), accounting service cards36may output the flow records14for a given packet flow when the flow “expires,” i.e., when the accounting service cards36detect inactivity for the flows for a configurable period. For example, accounting service cards36may make use of inactivity timers to determine when to output flow records. For packet flows that remain active for long durations, accounting service cards36may be configured to automatically expire the packet flows after a defined duration, e.g., 30 or 60 minutes.

If accounting server10and packet analyzer12are co-located with network monitor4, control unit42may direct the flow records and intercepted packets directly to an appropriate output port of interface cards34. In environments where accounting server10and packet analyzer12are located at remote destinations from network monitor4, control unit42may make use of encryption service card38and tunnel service card40to preserve security.

Encryption service card38provides cryptographic functionality to network monitor4. In particular, control unit42may forward flow records generated by accounting service cards36to encryption service card38prior to forwarding to accounting server10. In addition, control unit42may forward the intercepted packets for the select packet flows to encryption service card38for encryption prior to forwarding to packet analyzer12.

Network monitor4may also include a network tunneling mechanism for relaying the flow records and intercepted packets through tunnels. Encryption service card38may provide IPSec tunnel, while tunnel service card40may provide GRE and IPIP tunnels. Tunnel service card40aggregates traffic received from interface cards34, and returns the traffic back to control unit42for output via interface cards34. Control unit42may apply filter-based forwarding (FBF) to direct the returned traffic to the appropriate output port of IFCs34.

FIG. 4is a block diagram illustrating the flow of packets through the various components of a network monitor50in accordance with the principles of the invention. In the illustrated example, network monitor50monitors multiple communications links. In particular, network monitor50collects transmit and receive packets for a first communication link (labeled packet stream A inFIG. 1), and a second communication link (packet stream B). The first communication link may, for example, comprise an OC-12 link, and the second communication link may comprise an OC-48 link.

Initially, control unit42receives packets streams A, B via separate monitoring ports (not shown). As described above, optical splitters may be used to passively collect packet streams A, B from the respective communication links. Control unit42distributes packet stream A, B to accounting service cards36for generation of a stream of packets50carrying flow records. More specifically, accounting service cards36collect information from the packet flows within packet streams A, B and, based on the information, output packets50carrying flow records to control unit42.

If encryption is enabled, control unit42forwards packet stream50as packet stream52to carry the flow records to encryption card38for encryption. Encryption card38encrypts each incoming packet52, and returns a stream of encrypted packets54to control unit42. Control unit42forwards the encrypted packets carrying flow records14to accounting server10via an output port of one or more of interface cards34.

Simultaneous with the above-described accounting process, control unit42mirrors and filters each of the incoming packets of incoming packet streams A, B to produce packet streams A′, B′. Control unit42may, for example, buffer incoming packets for packet streams A, B, and digitally copy each buffered packet to internally mirror packets streams A, B. Control unit42applies a filtering operation to the mirrored packet streams to produce packet streams A′, B′ having intercepted packets for select packet flows. Consequently, packet streams A′, B′ carry copies of a subset of the packets within incoming packet streams A, B, respectively.

Control unit42forwards packet streams A′, B′ to tunnel service card40for aggregation and loopback to control unit42as aggregated packet stream56. Finally, control unit42applies filter-based forwarding (FBF) to forward aggregated packet stream56to packet analyzer12as output packet stream16. More specifically, control unit42directs aggregated packet stream56to an appropriate output interface card as packet stream16for forwarding to packet analyzer12. If encryption is enabled, control unit may forward aggregated packet stream56to encryption service card38as packet stream58, and may receive encrypted packet stream62in return for forwarding to packet analyzer12as packet stream16.

FIG. 5is a block diagram illustrating an example embodiment of an accounting service card36in accordance with the principles of the invention. Accounting service card36receives inbound packet stream66via interface70. Interface70may, for example, comprise a high-speed communication bus, back plane, switch fabric, or the like, to allow accounting service card36to easily be inserted and removed from an interface slot within the chassis of network monitor33. In this fashion, interface70allows multiple accounting service cards36to be added to network monitor chassis33to support monitoring of high data rate communication links.

Interface70forwards packet stream66to accounting unit72for updating flow statistics. Interface70may forward each packet in its entirety, or may extract only those portions of the packets necessary for maintaining accurate flow statistics. Interface70may, for example, extract header information and forward the extracted header information to accounting unit72. In this manner, bandwidth efficiencies may be achieved between interface70and accounting unit72. The extracted header information may include information necessary for determining a particular packet flow for each packet, such as a source network address, a destination network address, a protocol, a source port number, and a destination port number, as well as information for generating flow statistics, such as a byte count for each packet.

Based on the received packets, accounting unit72updates flow statistics, and output packets68carrying flow records. Accounting unit72may comprise one or more microprocessors, FPGAs, ASICs, combinations thereof, and the like. As described above, accounting service cards36may output the flow records for a given packet flow when the flow “expires,” i.e., when the accounting service cards36detect inactivity for the flows for a configurable period. For example, accounting service cards36may make use of inactivity timers to determine when to output flow records. For packet flows that remain active for long durations, accounting service cards36may be configured to automatically expire the packet flows after a defined duration, e.g., 30 or 60 minutes. Interface70forwards packets68carrying flow records to control unit42.

FIG. 6is a block diagram illustrating an example embodiment of a router80that incorporates accounting and intercept functionality consistent with the principles of the invention. Router80implements routing functionality to operate as a router within a packet-based network. Router80may, for example, operate as a core router within the Internet to route packets received from high data rate communication links, such as OC-3, OC-12, OC-48, and greater communication links. In addition, router80integrates accounting functionality to generate flow records for routed packets. Furthermore, router80integrates intercept features to capture packets for select packet flows. As described, router80can adjust routing functions based on the generated flow records and intercepted packets, thereby dynamically react to network events, such as Denial of Service (DOS) attacks and other network security violations.

Router80includes a control unit90that directs inbound packets received from inbound links100to appropriate outbound links102. In particular, the functionality of control unit90can be divided between a routing engine94and a packet-forwarding engine92.

Routing engine94is primarily responsible for maintaining routing information98to reflect the current network topology. In order to maintain an accurate representation of the network, router80supports a number of protocols for exchanging routing information with other routers. For example, router80may support the Border Gateway Protocol (BGP), for exchanging routing information with routers of other autonomous systems. Similarly, router80may support the Intermediate System to Intermediate System protocol (IS-IS), which is an interior gateway routing protocol for communicating link-state information within an autonomous system. Other examples of interior routing protocols include the Open Shortest Path First (OSPF), and the Routing Information Protocol (RIP).

Routing engine94directs packet-forwarding engine92to maintain forwarding information96in accordance with routing information98. Forwarding information96may, therefore, be thought of as a subset of the information contained within routing information98. In particular, forwarding information96associates packet information, referred to as a “key,” with specific forwarding next hops (FNH). A FNH generally refers to a neighboring router physically coupled to a source router along a given route. For example, the FNH for a route may specify a physical interface and media access control (MAC) address for the interface associated with the router.

Packet-forwarding engine92controls the flow of packets through router80as described above in order to integrate routing, accounting and intercept functionality. For example, packet-forwarding engine92distributes inbound packets to accounting service cards84for accounting and generation of flow records. In addition, packet-forwarding engine92mirrors inbound packets, and applies filter99to the mirrored packet stream to intercept select packet flows.

Similar to the packet flow described above in reference toFIG. 4, encryption service card86provides cryptographic functionality and, along with tunnel service card88, may provide a network tunneling mechanism for relaying the flow records and intercepted packets through secure tunnels.

To support routing functionality, accounting service cards84output packetized flow records to packet forwarding engine92, and also returns the original packets. Packet forwarding engine92forwards the packets out interface cards82in accordance with forwarding information96.

In one embodiment, each of packet-forwarding engine92and routing engine94may comprise one or more dedicated processors, hardware, and the like, and may be communicatively coupled by data communication channel36. Data communication channel36may be a high-speed network connection, bus, shared-memory or other data communication mechanism.

FIG. 7is a block diagram illustrating another embodiment of an accounting service card84in accordance with the principles of the invention. Accounting service card84receives inbound packet stream112via interface113, which may comprise a high-speed communication bus, back plane, switch fabric, or the like. Interface113allows accounting service card84to easily be inserted and removed from an interface slot within the chassis of router80. In this fashion, interface112allows multiple accounting service cards84to be added to router80to support monitoring of high data rate communication links.

Interface113extracts header information from packets112, and forwards the extracted header information115to accounting unit111for computation of flow records118. In addition, interface113redirects packets112to be returned to packet-forwarding engine92via loop-back path119.

Based on the received header information115, accounting unit111updates flow statistics, and output packets1188carrying flow records. Accounting unit72may comprise one or more microprocessors, FPGAs, ASICs, combinations thereof, and the like. Accounting unit111may store the flow records within buffer116, and may output the flow records periodically in accordance with a configurable period, such as fifteen, thirty or sixty seconds, maintained by timer117. Alternatively, accounting unit111may buffer the flow records until flow expire. In this configuration, accounting unit111allocates a corresponding timer117for each detected packet flow, and utilizes the timers to time periods of inactivity for each packet flow. Accounting unit111outputs flow records for a given packet flow upon detecting inactivity for the flow for a configurable period.

Interface113receives packets118carrying flow records, and merges packets118with packets112to form packet stream114. Interface113directs packet stream114to packet-forwarding engine92. In this fashion, accounting service card80outputs flow records118for a received packet stream112, and also returns the packet stream to control unit90for routing. Upon receiving the returned packet stream, packet-forwarding engine92forwards the packets in accordance with forwarding information96. More specifically, packet-forwarding engine92forwards the packets to interface cards82for output on communication links102. In this manner, router80can function as a fully functional core routing device having integrated traffic analysis and intercept features.

FIG. 8is a flowchart illustrating operation of router80that integrates traffic analysis and intercept features with routing functionality to dynamically react to network events, such as Denial of Service (DOS) attacks and other network security violations.

Packet-forwarding engine92receives packets via inbound communication links100, and mirrors each packet to produce duplicate packet streams (120). Next, packet-forwarding engine92distributes the packets of one stream to accounting service cards84for generation of flow records (122).

Packet-forwarding engine92receives the flow records from accounting service cards84, as well as the original packets (124). Next, packet-forwarding engine92forwards the packets in accordance with forwarding information96(126).

In addition, control unit90analyzes the flow records received from accounting service cards84to identify any suspicious packet flows (128). For example, control unit may determine whether any packet flows have significant traffic levels that may indicate the presence of a Denial of Service attack or other network security violation. If control unit90identifies any suspicious flows (130), the control unit90modifies intercept filter99to enable real-time packet interception and traffic analysis for the suspicious flow (132).

Simultaneously with the above-described accounting process, control unit90applies filter99to the second of the mirrored packet streams to produce an intercepted set of packets for select packet flows (134). Control unit90analyzes the packet flows in real-time to determine whether a network condition exists, such as a network security violation (136). Although the analysis features have been described in reference to control unit14, the features may readily be incorporated into one or more separate modules. For example, router80may comprise one or more packet analysis service cards to perform real-time analysis on the intercepted packets.

If a network condition exists that requires a response (138), control unit90updates forwarding information96(140). For example, routing engine94may regenerate forwarding information96from routing information98to adaptively terminate forwarding of one or more malicious packet flows. In other words, control unit90may dynamically update routing of packets based on flow records and real-time analysis of intercepted traffic. In this manner, router80integrates traffic analysis and intercept features with routing functionality to dynamically reacting to network events.

Control unit90may forward network condition information to other network devices, e.g., by generating a message to warn the other network devices of a network attack (142). Control unit90may, for example, forward specific flow information regarding terminated packet flows. Control unit14may forward the information in accordance with routing protocols, such as BGP, IS-IS, RIP, and the like. These messages may, for example, advertise or withdraw routes or carry other network information, such as link state information.

For exemplary purposes, the integrated traffic analysis and intercept features of router80have been described with reference to accounting service cards84, and, in particular, to the use of flow records that describe packet flow statistics. The techniques, however, may readily be applied to traffic analysis generally, and need not be based on packet flow statistics. In particular, router80may perform detailed analysis of traffic patterns and packet content, and may dynamically update forwarding information based on the analysis in response to the analysis. For example, accounting service cards84or dedicated traffic analysis cards may scan each packet received from packet-forwarding engine92to detect and filter any packets carrying a virus signature. Accounting service cards84may output to control unit90traffic analysis messages generally, possibly including packet flow records carrying flow statistics

FIG. 9is a schematic diagram illustrating an exemplary embodiment of a network router150that integrates traffic analysis and intercept features with routing functionality. In the illustrated embodiment, network router150includes a chassis152for housing control unit151having a routing engine and a packet forwarding engine (not shown). In the illustrated example, chassis150has nine slots for receiving a set of cards. In particular, chassis150receives four interface cards (IFCs)154, three accounting service cards156, an encryption service card158, and a tunnel service card160. Each card may be inserted into a corresponding slot of chassis152for electrically coupling the card to control unit151via a bus, backplane, or other electrical communication mechanism. Interface cards154include ports for coupling to communication links.