Compressed IP flow recognition for in-line, integrated mobile DPI

摘要

Various exemplary embodiments comprise a method and related device and computer-readable medium including one or more of the following: receiving an uncompressed packet sent from the source node to the destination node during a compression negotiation stage; storing information extracted from the uncompressed packet, the stored information sufficient to uniquely identify flows; receiving a compressed packet sent from the source node to the destination node; associating the compressed packet with an active flow by accessing the stored information and information in the compressed packet; performing deep packet inspection (DPI) to identify an application associated with the active flow; and performing application-specific processing on at least one packet belonging to the active flow. In various exemplary embodiments, the information extracted from the uncompressed packet includes a context identifier used to establish a compression context between a compressor and a decompressor.

主权项

1. A method of processing packets sent from a source node to a destination node with a Deep Packet Inspection (DPI) device comprising a storage device, a processor, and a communication module, the method comprising:
receiving, in the communication module, an uncompressed packet sent from the source node to the destination node during a compression negotiation stage; storing, in the storage device, information extracted from the uncompressed packet, the stored information being sufficient to uniquely identify flows and containing at least a context identifier (ID) that uniquely identifies a compression context between the source node and the destination node; receiving, in the communication module, at least one subsequent compressed packet sent from the source node to the destination node, wherein the at least one subsequent compressed packet comprises information including at least the context ID; associating, with the processor, the at least one subsequent compressed packet with an active flow by accessing the stored information and the information in the at least one subsequent compressed packet; performing, with the processor based on the associating step, DPI to identify an application associated with the active flow, wherein the DPI device stores the context ID; and performing application-specific processing on at least one packet belonging to the active flow.