RELATED APPLICATIONS

Benefit is claimed under 35 U.S.C. 119(a)-(d) to Foreign Application Serial No. 201941051487 filed in India entitled “COLLECTING AND ANALYZING DATA REGARDING FLOWS ASSOCIATED WITH DPI PARAMETERS” on Dec. 12, 2019, by VMWARE, Inc., which is herein incorporated in its entirety by reference for all purposes.

In recent years, several companies have brought to market solutions for deploying software defined (SD) wide-area networks (WANs) for enterprises. Some such SD-WAN solutions use external third-party private or public cloud datacenters (clouds) to define different virtual WANs for different enterprises. These solutions typically have edge forwarding elements (called edge devices) at edge nodes of an enterprise that connect with one or more gateway forwarding elements (called gateway devices or gateways) that are deployed in the third-party clouds.

In such a deployment, an edge device connects through one or more secure connections with a gateway, with these connections traversing one or more network links that connect the edge device with an external network. Examples of such network links include MPLS links, 5G LTE links, commercial broadband Internet links (e.g., cable modem links or fiber optic links), etc. The edge nodes include branch offices (called branches) of the enterprise, and these offices are often spread across geographies with network links to the gateways of various different network connectivity types. These SD-WAN solutions employ deep packet inspection to inform some of the operations that they perform.

BRIEF SUMMARY

Some embodiments provide a method for performing deep packet inspection (DPI) for an SD-WAN (software defined, wide area network) established for an entity by a plurality of edge nodes and a set of one or more cloud gateways. At a particular edge node, the method uses local and remote deep packet inspectors to perform DPI for a packet flow. Specifically, the method initially uses the local deep packet inspector to perform a first DPI operation on a set of packets of a first packet flow to generate a set of DPI parameters for the first packet flow.

The method then forwards a copy of the set of packets to the remote deep packet inspector to perform a second DPI operation to generate a second set of DPI parameters. In some embodiments, the remote deep packet inspector is accessible by a controller cluster that configures the edge nodes and the gateways. In some such embodiments, the method forwards the copy of the set of packets to the controller cluster, which then uses the remote deep packet inspector to perform the remote DPI operation. The method receives the result of the second DPI operation, and when the generated first and second DPI parameters are different, generates a record regarding the difference.

In some embodiments, the method uses the generated record to improve the local deep packet inspector's operation. For instance, in some embodiments, the local deep packet inspector is a third-party inspector that is used by the particular edge node, and the generated record is used to identify different flows for which the third-party inspector has poor DPI performance. When the generated record specifies a discrepancy between the first and second sets of generated DPI parameters, the method in some embodiments sends data regarding the discrepancy to a remote machine to aggregate with other data regarding other discrepancies in the DPI operations performed for other packet flows through the WAN.

In some embodiments, the method specifies a generated first set of DPI parameters as the set of DPI parameters associated with the first packet flow, after the first DPI operation is completed. When the first and second DPI parameter sets are different, the method in some embodiments modifies the set of DPI parameters associated with the first packet flow based on the generated second set of DPI parameters. For instance, in some embodiments, the method modifies the set of DPI parameters by storing the second set of DPI parameters as the set of DPI parameters associated with the first packet flow.

In some embodiments, the method forwards each packet to its destination after the local deep packet inspector has processed the packet. In other embodiments, however, the method delays the forwarding of packets of the first flow to the destination of the flow while performing the first DPI operation. During this time, the method stores the delayed packets in a storage queue of the particular edge node. Once the first DPI operation has been completed, the method forwards the set of packets stored in the storage queue as well as subsequent packets of the first flow to the destination. It also then forwards a copy of the set of packets to the remote deep packet inspector.

In some embodiments, the method forwards the packets of the first packet flow based on the generated first set of DPI parameters. For example, in some embodiments, the method uses at least one parameter in the generated first set of DPI parameters to select a path through the WAN to forward the packets of the first packet flow. When the generated first and second sets of DPI parameters are different, the method in some embodiments modifies the forwarding of the packets of the first packet flow, by using the second set of DPI parameters to forward (e.g., to select a path for) the packets of the first packet flow.

In some embodiments, the method forwards, from the particular edge node, at least a subset of the generated DPI parameters to other edge nodes directly or indirectly through the controller set. Also, in some embodiments, the method forwards, from the particular edge node, at least a subset of the generated DPI parameters to at least one gateway, again directly or indirectly through the controller set. In some embodiments, a generated DPI parameter set includes an identifier that identifies a type of traffic carried in payloads of the packets.

In these or other embodiments, a generated DPI parameter set includes an identifier that identifies an application that is a source of the first packet flow and/or an identifier that identifies a class of application to which this source belongs. In some embodiments, the remote or local deep packet inspector does not generate an identifier for the source application or class. In these embodiments, the edge node or controller cluster generates one or both of these identifiers by mapping the traffic type identifier produced by the DPI operations to the application or class identifiers.

The particular edge node in some embodiments is an edge machine (e.g., virtual machine (VM), container, standalone appliance, a program executing on a computer, etc.) that operates at an office (e.g., branch office) or datacenter of an entity with several computers, and this edge node connects the computers to the WAN. In some of these embodiments, the local deep packet inspector operates (e.g., as a VM or container) on a first computing device along with the edge node machine, while the remote deep packet inspector operates on a separate, second computing device in a remote location (e.g., in a different building, neighborhood, city, state, etc. than the location at which the particular edge node operates). In some embodiments, the first and second computing devices are computers, while in other embodiments, they are standalone DPI appliances. Still in other embodiments, the first computing device is an appliance, while the second computing device is a computer on which the remote deep packet inspector executes.

Some embodiments provide a method that uses DPI-generated parameters to assess, and in some cases to modify, how flows associated with particular applications traverse an SD-WAN that is defined by several edge nodes and one or more cloud gateways. At a set of one or more servers, the method receives sets of DPI parameters collected for packet flows processed by a first set of two or more edge nodes for which DPI operations were performed. From these collected sets, the method identifies a subset of DPI parameters associated with a plurality of flows relating to a particular application identifier specified by the DPI operations.

The received DPI parameters sets in some embodiments include operational statistics and metrics (e.g., packet transmission time, payload size, current number of packets processed by the node, etc.) relating to the packet flows processed by the first-set edge nodes. The statistics in some embodiments are accompanied by other data such as the flow identifiers, application classification details and forwarding decisions (e.g., identifying selected paths), etc. In some embodiments, the operational statistics, metrics and other data are collected and provided by the edge nodes and/or the gateways. The method then analyzes the identified subset of parameters to determine whether any packet flow associated with one or more particular DPI parameters had an undesirable metric relating to its flow through the WAN.

When this analysis produces a decision that the edge nodes should use different paths for the flows associated with the particular application identifier, the method then distributes adjusted next-hop forwarding records to a second set of one or more edge nodes to modify the paths that the edge nodes use to forward flows associated with the particular application identifier. In some embodiments, the first and second set of edge nodes are identical, while in other embodiments the first set of edge nodes is a subset of the second set of edge nodes (e.g., the second set includes at least one node not in the first edge).

In some embodiments, the DPI operations for a flow are performed at the source edge node (also called ingress edge node) where the flow enters the WAN and from where it is passed to another edge node or to a cloud gateway. Conjunctively with the DPI operations, the source edge node collects operational metrics and statistics (e.g., packet transmission time, payload size, current number of packets processed by the node, etc.) for the packets of the flow that it passes to another edge node or a cloud gateway, and provides the DPI generated parameters along with the collected statistics to the server set for its analysis.

In some embodiments, the source edge node collects statistics for a flow based on a number of initial packets that it uses to perform its DPI operations. The source edge node in some of these embodiments provides to the server set the initial set of packets that it uses for its DPI operations for a flow, along with the operational metrics and statistics that it provides to the server set for a new flow. In some embodiments, the number of packets in the initial packet set that is analyzed by the source edge node's DPI operation is dependent on the application that is being identified as the source of the flow by the DPI operations. Accordingly, the DPI operations analyze different number of packets for different flows that are from different applications or different types of applications.

The destination edge nodes (also called egress edge nodes) in some embodiments also perform DPI operations and collect operational metrics/statistics for the flows at the start of flows that they received through the WAN (i.e., from cloud gateways or other edge nodes). In other embodiments, the destination edge nodes do not perform DPI operations, but collect operational metrics/statistics for the flows at the start of flows. In some embodiments, the destination edge nodes receive (e.g., in-band with the packets through tunnel headers, or out-of-band through other packets) one or more DPI parameters (e.g., application identifiers) generated by the source edge node's DPI operation.

Conjunctively or alternatively to performing DPI operations at the edge nodes, some embodiments perform DPI operations outside of the edge nodes (e.g., at physical locations that are remote form physical locations at which the edge nodes operate). In some embodiments, the method also collects statistics/metrics from the gateways regarding the processing of the flows. In some embodiments, the source edge nodes set flags in the tunnel encapsulation headers that they use to forward packets to the gateways, in order to direct the gateways to collect statistics for certain flows.

In some embodiments, the server set uses the flow identifiers (e.g., five tuple identifiers of the flows) to correlate the metrics/statistics that it collects from the different forwarding elements of the SD-WAN (e.g., from the source edge nodes, destination edge nodes and/or the gateways). Once the collected metrics/statistics are correlated for a particular flow, the server set then analyzes the collected metrics/statistics to derive additional operational data that quantifies whether the particular flow is getting the desired level of service. The correlated metric/statistic data in some embodiments are associated with specific DPI generated parameters (e.g., application identifier, etc.) so that the analysis can be done on the DPI-parameter basis. For instance, the derived data in some embodiments is used to ascertain whether a particular flow associated with a particular application identifier reaches its destination within desired duration of time, whether the particular flow was delayed too much at a particular gateway, etc.

When the derived data demonstrates that the particular flow is not getting the desired level of service (e.g., a flow associated with a particular application identifier is not reaching its destination fast enough), the server set then distributes to the edge nodes and/or gateways adjusted next hop forwarding records that direct the edge nodes and/or gateways to modify the forwarding of the particular flow, or similar future flows (e.g., flows from with the same DPI identified application and/or to the same destination). For instance, based on the distributed new hop forwarding record, the source edge node selects a different gateway to forward the packets of the particular flow and other similar subsequent flows in some embodiments. In other embodiments, the source edge node uses the adjusted next hop forwarding record to select the gateway(s) to use for forwarding subsequent flows that are similar to the particular flow (e.g., flows with the same DPI identified application and to the same destination).

The preceding Summary is intended to serve as a brief introduction to some embodiments of the invention. It is not meant to be an introduction or overview of all inventive subject matter disclosed in this document. The Detailed Description that follows and the Drawings that are referred to in the Detailed Description will further describe the embodiments described in the Summary as well as other embodiments. Accordingly, to understand all the embodiments described by this document, a full review of the Summary, the Detailed Description, the Drawings, and the Claims is needed. Moreover, the claimed subject matters are not to be limited by the illustrative details in the Summary, the Detailed Description, and the Drawings.

