1. Field of the Invention
The present invention is directed in general to the field of packet inspection in a computer network. In one aspect, the present invention relates to a standalone cache memory device which is connected between one or more host machines and a storage device and which inspects packets to identify predetermined patterns which are used to implement predetermined caching policies.
2. Description of the Related Art
Data storage technology over the years has evolved from a direct attached storage model (DAS) to using remote computer storage models, such as Network Attached Storage (NAS) and a Storage Area Network (SAN). With the direct storage model, the storage is directly attached to the workstations and application servers, but this creates numerous difficulties with the administration, backup, compliance and maintenance of the directly stored data. These difficulties are alleviated at least in part by separating the application server/workstations from the storage medium. For example, FIG. 1 depicts a typical NAS system 100 in which a number of PCs, workstations and application servers (clients) use a network 10 to access storage resources on a number of remote network attached storage and file servers (or filers). In the depicted system 100, each of the networked PC or workstation devices 12-14 and application servers 16-18 may act as a storage client that is connected to the network 10 by the appropriate routers 11 and switches 15 to remotely store and retrieve data with one or more NAS filers 1-6, which in turn are connected to the network 10 by the appropriate routers 9 and switches 7-8. Typically, the storage clients (e.g., 14) use an IP-based network protocol, such as CIFS and NFS, to communicate store, retrieve and modify files on an NAS filer (e.g., 5).
Conventional NAS devices are designed with data storage hardware components (including a plurality of hard disk drives, one or more processors for controlling access to the disk drives, I/O controller and high speed cache memory) and operating system and other software that provides data storage and access functions. Even with a high speed internal cache memory, the access response time for NAS devices continues to be outpaced by the faster processor speeds in the client devices 12-14, 16-18, especially where any one NAS device may be connected to a plurality of client storage devices. In part, this performance problem is caused by the lower cache hit rates that result from a combination of increased disk capacity and high-density mounting on the NAS storage device. The performance of conventional NAS devices is also impaired by the amount of CPU processing cycles that are required to process and search incoming storage requests that arrive as a plurality of data packets. For example, empirical testing has shown that data indexing operations in commercial off-the-shelf (COTS) server appliances consume 35% of the CPU cycles, TCP reassembly consumes 30% of the CPU cycles, patterning searching consumes 20% of the CPU cycles, and content matching consumes 10% of the CPU cycles. As a result, the COTS appliances can only process ⅕ of a Gigabit Ethernet connection.
While a number of solutions have been proposed to address these problems, they are, for a variety of reasons, not entirely satisfactory. For example, faster disk drives have been developed, but the increased disk drive access speeds are not enough to overcome the performance gap. Other solutions have proposed increasing the size and speed of the cache memory at the NAS device(s), but this results in increased costs in terms of expense, chip size and power consumption. Even with improvements in hardware performance speed, there remain data processing performance limitations associated with monitoring and routing packet data, especially in communication networks where there are a large number of potential connections. For example, a communication node in a large network which inspects and routes network transport packets or frames will typically be required to perform an extensive search of a large connection table (e.g., a 3 GB file that holds connection information for 1 M connections) to determine if the packet needs to be forwarded or not. And while there have been solutions proposed to expedite the connection table search process, such solutions can result in false positives and/or false negatives when the incoming packets are not efficiently and correctly inspected. Accordingly, there is a need for a system and method for improving the disk storage access time and/or network packet processing to overcome the problems in the art, such as outlined above. Further limitations and disadvantages of conventional solutions will become apparent to one of skill in the art after reviewing the remainder of the present application with reference to the drawings and detailed description which follow.