Abstract:
Duplicate packet detection and discard employs hash values and time stamps of received packet data, wherein the hash value is employed as an index to a table, and if data at a table entry has a time stamp near a time of the packet data, a duplicate is determined.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority of U.S. provisional patent application 61/035,018, filed Mar. 9, 2008, and U.S. provisional patent application 61/035,021, filed Mar. 9, 2008. 
     
    
     BACKGROUND OF THE INVENTION 
       [0002]    This invention relates to network test and measurement, and more particularly to an apparatus and method for detecting duplicate packets in network traffic. 
         [0003]    In operation and maintenance of networks, determination of where issues or problem points arise can be complex. A network engineer or technician looking to resolve problems would be interested in having accurate network protocol statistics. Network analyzers that employ multiple ports may be connected to a network such that packets on a network may be seen at two or more ports of the analyzer. Misinterpreting these duplicate packets in protocol analysis can lead to erroneous statistics and false conclusions. 
         [0004]    While it might be considered to store copies of each packet seen on a network and compare the contents thereof to determine duplicates, this would require large amounts of memory to store the packets and many processing cycles to perform the comparison. The requirements become greater as network speeds increase, making such method undesirable. 
         [0005]    A software-calculated hash over the contents of each packet could reduce the memory requirements to perform such comparison, but would but do little to reduce the processing cycles required. 
       SUMMARY OF THE INVENTION 
       [0006]    In accordance with the invention, an apparatus and method of detecting duplicate packets is provided, whereby the duplicate packets may be discarded. 
         [0007]    Accordingly, it is an object of the present invention to provide an improved method and apparatus for network test and measurement. 
         [0008]    It is a further object of the present invention to provide an improved method and apparatus for detecting and discarding duplicate packets seen on multiple ports. 
         [0009]    It is yet another object of the invention to eliminate these “duplicate” packets seen on multiple ports of a network analyzer in a manner that minimizes execution time. 
         [0010]    The subject matter of the present invention is particularly pointed out and distinctly claimed in the concluding portion of this specification. However, both the organization and method of operation, together with further advantages and objects thereof, may best be understood by reference to the following description taken in connection with accompanying drawings wherein like reference characters refer to like elements. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1  is a block diagram of a network with a test instrument installed thereon; 
           [0012]      FIG. 2  is a block diagram of a test instrument; and 
           [0013]      FIG. 3  is a block diagram of an implementation of the apparatus and method. 
       
    
    
     DETAILED DESCRIPTION 
       [0014]    The system according to a preferred embodiment of the present invention comprises a method and apparatus to detect and discard duplicate packets in a network test instrument. 
         [0015]    Referring to  FIG. 1 , a block diagram of a network with an apparatus in accordance with the disclosure herein, a network may comprise plural network devices  10 ,  10 ′, etc., which communicate over a network  12  by sending and receiving network traffic  18 . The traffic may be sent in packet form, with varying protocols and formatting thereof. 
         [0016]    A network analyzer  14  is also connected to the network, and may include a remote network analyzer interface  16  that enables a user to interact with the network analyzer to operate the analyzer and obtain data therefrom remotely from the physical location of the analyzer. 
         [0017]    The network analyzer comprises hardware and software, CPU, memory, interfaces and the like to operate to connect to and monitor traffic on the network, as well as performing various testing and measurement operations, transmitting and receiving data and the like. The remote network analyzer typically is operated by running on a computer or workstation interfaced with the network. 
         [0018]      FIG. 2  is a block diagram of a test instrument/analyzer  40 , wherein the instrument may include network interfaces  22  which attaches the device to a network  12  via multiple ports, one or more processors  23  for operating the instrument, memory such as RAM/ROM  24  or persistent storage  26 , display  28 , user input devices  30  (such as, for example, keyboard, mouse or other pointing devices, touch screen, etc.), power supply  32  which may include battery or AC power supplies, other interface  34  which attaches the device to a network or other external devices (storage, other computer, etc.). Packet processing module  25  provides processing of packets to assist in the duplicate detection and discard, as discussed further hereinbelow. Memory  24  is accessible to module  25  for transfer of data. 
         [0019]    In operation, the network test instrument is attached to the network, and observes transmissions on the network to collect statistics thereon. 
         [0020]    Packet processor module  25 , which may be implemented as a FPGA, for example, observes incoming packet data received on the network, and calculates two hashes (‘hashA’ and ‘hashB’) on octets contained in the packets that would be sufficient to determine uniqueness, and maintains a high-resolution timestamp relative to the packet data. In a particular embodiment, determination of the hashes comprise discarding the MAC frame and CRC of each packet, and determining the hashes on data portions that include packet length and content. As each packet arrives on the network, module  25  writes the hashes, the packet data, and its arrival timestamp to memory. 
         [0021]    Meanwhile, a software module is operating and maintains a fast lookup table whose entries contain the hashes with their corresponding packet timestamps. For each packet, software uses ‘hashA’ as an index into the table. Entries at the table index are compared against the ‘hashB’. If not found, ‘hashB’ is added to an available entry at the table index with its corresponding timestamp and the packet is passed for further analysis. If an entry is found for ‘hashB’, the corresponding timestamps are compared against a pre-determined period. If within the period, the packet is deemed duplicate and discarded, otherwise ‘hashB’ entry&#39;s corresponding timestamp is updated and the packet is passed for further analysis. 
         [0022]    The hash comprises a unique signature for each packet, for example, a 64 bit value. For an incoming packet in accordance with a particular embodiment, the source and destination MAC (12 bytes) at the beginning of the packet is discarded. Also, the end CRC data (4 bytes) is discarded as well. A rolling hash value is calculated on the remaining data, and the resultant value, data and time stamp are placed into memory. 
         [0023]    Software maintains a fast lookup table whose entries contain the hardware-calculated hashes with their corresponding packet timestamps. For each packet, the software uses the least-significant 16-bits of the hardware-calculated hash as an index into this table. Entries at the table index are compared against the full hardware-calculated hash for a match. 
         [0024]    If no match found, the packet is deemed not a duplicate. The hash and its corresponding timestamp are added to an available entry at the table index. The packet passes for further analysis. 
         [0025]    If a match is found, the corresponding timestamps are then compared. If the timestamps are within a given time, for example, 50 ms, the packet is deemed duplicate and discarded. Otherwise, the packet is deemed not a duplicate, the entry&#39;s corresponding timestamp is updated and the packet is passed for further analysis. 
         [0026]    When a duplicate packet is discarded, the next packet from memory is tested in the same manner for duplicate. This continues until a non-duplicate packet is encountered or no more packets are available from server memory. 
         [0027]    Duplicate packet detection is performed across all physical Ethernet interfaces within a logical channel, but not across logical channels. This is to maintain correct flow/transaction layer analysis in the event that the user splits the same logical traffic across the configured logical interfaces. 
         [0028]    Referring to  FIG. 3 , the method and apparatus may suitably be implemented as a network monitoring card  42  that plugs into a PCIe slot in a high-performance server  44 , to filter, aggregate, and buffer Ethernet traffic from network  12  over multiple ports at line rates, and a device driver. Packet, hash and time stamp data from the card  42  is supplied via DMA to the server memory  46 . The device driver operating on the server is called to obtain network packet data, wherein when called to read a next packet data from the server memory, the device driver implements the above-discussed checking to determine if a packet is duplicate, discarding duplicates and passing non-duplicates on to the requesting process or devices in response to the read request. 
         [0029]    Thus, in accordance with the method and apparatus, detection and discard of duplicate data packets is enabled, to provide more accurate network analysis by a network test instrument. 
         [0030]    While a preferred embodiment of the present invention has been shown and described, it will be apparent to those skilled in the art that many changes and modifications may be made without departing from the invention in its broader aspects. The appended claims are therefore intended to cover all such changes and modifications as fall within the true spirit and scope of the invention.