Removing lead filter from serial multiple-stage filter used to detect large flows in order to purge flows for prolonged operation

摘要

A network device to detect large flows includes a card to receive packets of flows. The device includes a large flow detection module including a serial multiple-stage filter module including series filter modules including a lead filter module and a tail filter module. Each filter module includes counters. The serial filter module is to serially increment the counters to reflect the flows, and is to increment counters that correspond to flows of subsequent filter modules only after all counters that correspond to the flows of all prior filter modules have been incremented serially up to maximum values. The serial filter module is to detect flows that correspond to counters of the tail filter module that have been incremented up to maximum values as the large flows. The large flow detection module includes a lead filter removal module to remove the lead filter module from the start of the series.

主权项

1. A network device, the network device operable to be deployed in a network to receive packets of different flows, the network device operable to detect large flows of packets, the network device comprising:
at least one card operable to receive the packets of the different flows from the network; and a large flow detection module including: a serial multiple-stage filter module including a plurality of filter modules coupled together in series, the plurality of filter modules including a lead filter module at a start of the series and a tail filter module at an end of the series, each of the filter modules including a plurality of counters, the serial multiple-stage filter module operable to serially increment the counters of the filter modules to reflect the packets of the different flows, in which the serial multiple-stage filter module is operable to increment counters that correspond to packets of flows of subsequent filter modules in the series only after all counters that correspond to the packets of the flows of all prior filter modules in the series have been incremented serially up to corresponding maximum values, and in which the serial multiple-stage filter module is operable to detect flows of packets that correspond to counters of the tail filter module that have been incremented up to corresponding maximum values as the large flows of packets; and a lead filter removal module coupled with the serial multiple-stage filter module, the lead filter removal module operable to remove the lead filter module from the start of the series.