Address routing in a protocol analyzer

[0002] 1. Field of the Invention

[0003] The invention is related to the field of packet routing, and in particular, to a protocol analyzer that deletes packets or routes packets to other protocol analyzers based on destination addresses.

[0004] 2. Statement of the Problem

[0005] The demand for communication network services is growing dramatically and there is a corresponding growth in the need for communication test systems. A common test system uses protocol analyzers to monitor traffic on communication links in a communication network. The protocol analyzers process the traffic to produce test packets that are transferred to a test computer. The test computer processes the test packets to produce test results for communication network operators. The test computer also transfers test packets to the protocol analyzers to control testing. As the communication network grows, so does the number of protocol analyzers and test packets that are needed to monitor the network traffic.

[0006] In some test systems, the protocol analyzers are daisy-chained together. The protocol analyzer at the end of the daisy-chain is connected to a packet network. The packet network is connected to the test computer. The packet network exchanges the test packets between the protocol analyzers and the test computer, but the packet network also transfers other packet traffic that can get into the daisy-chain. In some cases, the test packets only represent a small percentage of the total traffic within the packet network. To avoid processing the other packet traffic, the protocol analyzers only process packets that contain their respective Media Access Control (MAC) address in the destination field.

[0007] Increased traffic within the daisy-chain adversely affects the performance of the test system by slowing down communications between the protocol analyzers and the test computer. The traffic increase is due in part to the increased number of protocol analyzers within the daisy-chain, but the traffic increase is also due to the increased amount of other packet traffic within packet network.

[0008] To lower the packet traffic within the daisy-chain, the protocol analyzer at the end of the daisy-chain is connected to the packet network through a device, such as a router or hub. The device prevents the other packet traffic from entering the daisy-chain. Unfortunately, the device represents additional cost and complexity that is required for the test system.

[0009] To avoid the additional device, routing software or hub circuitry can be added to the protocol analyzer at the end of the daisy-chain. The software router requires additional processing capacity within the protocol analyzer and additional network provisioning by the network operator. The hub circuitry requires additional components and connectors in the protocol analyzer. Unfortunately, the software router or hub circuitry significantly increases the cost and complexity of the protocol analyzer.

[0010] The invention solves the above problem with a cost-effective test system that controls the traffic in a daisy-chain of protocol analyzers. The test system screens packets entering the daisy-chain based on the destination addresses in the packets. Advantageously, the system is implemented with simple control processing that does not add significant cost or complexity to the packet network or to the protocol analyzers.

[0011] Some examples of the invention include a protocol analyzer that has a control system coupled to a first interface and a second interface. In operation, the first interface receives a packet from a packet network. The control system receives the packet from the first interface and either deletes the packet or transfers the packet to the second interface based on a destination address in the packet. The second interface transfers the packet to another protocol analyzer.

[0012] In variations of the invention, the control system may transfer the packet to the second interface if the destination address is on an address list. The address list may be compiled from source addresses in other packets received by the second interface.

[0013] The control system may also transfer the packet to the second interface if the destination address is within an address range.

[0014] FIG. 1 is a block diagram that illustrates a test system in an example of the invention.

[0015] FIG. 2 is a block diagram that illustrates protocol analyzers in an example of the invention.

[0016] FIG. 3 is a flow diagram that illustrates the operation of a protocol analyzer in an example of the invention.

[0017] FIG. 4 is a flow diagram that illustrates the operation of a protocol analyzer in an example of the invention.

[0018] FIG. 5 is a flow diagram that illustrates the operation of a protocol analyzer in an example of the invention.

[0019] Test System Configuration and Operation—FIGS. 1-2

[0020] FIGS. 1-2 depict a specific example of a test system in accord with the present invention. Those skilled in the art will appreciate numerous variations from this example that do not depart from the scope of the invention. Those skilled in the art will also appreciate that various features described below could be combined to form multiple variations of the invention.

[0021] FIG. 1 illustrates test system 100 coupled to lines-under-test 151 of target communication device 150. Test system 100 comprises protocol analyzer 110, protocol analyzer 120, protocol analyzer 130, and test computer 140. Additional protocol analyzers are indicated by the ellipses, but are not shown for clarity. Protocol analyzers 110, 120, and 130 are daisy-chained together. Protocol analyzer 130 is connected to test computer 140 through packet network 152. In some examples of the invention, protocol analyzer 130 is coupled to test computer 140 through both packet network 152 and target communication device 150.

[0022] Protocol analyzers 110, 120, and 130 monitor traffic on lines-under-test 151 to generate and transfer test packets to test computer 140. Test computer 140 processes the test packets to generate test results regarding target communication device 150 for network operators. Test computer 140 also transfers test packets to protocol analyzers 110, 120, and 130 to control testing. Protocol analyzer 130 receives the test packets from test computer 140. Protocol analyzer 130 also receives other packets carried by packet network 152. Protocol analyzer 130 processes some packets internally, transfers some packets to protocol analyzers 110 and 120, and deletes the other packets.

[0023] In some examples of the invention, protocol analyzer 130 transfers a packet to protocol analyzers 110 and 120 if the packet is a certain packet type or if the packet's destination MAC address is on a list or within a range. Protocol analyzer may compile the address list using source MAC addresses in packets from the daisy-chain. Test computer 140 may transfer and modify the address list or range in protocol analyzer 130. Test computer 140 may also transfer and modify the packet types that can be passed to the daisy-chain.

[0024] FIG. 2 illustrates protocol analyzers 110, 120, and 130 in an example of the invention. Protocol analyzer 130 comprises first interface 131, second interface 132, control system 133, protocol stack 134, and internal systems 135. Control system 133 is coupled to interfaces 131-132 and to protocol stack 134. Protocol stack 134 is coupled to internal system 115. Internal systems 135 represent the other operational components of protocol analyzer 130. Those skilled in the art are familiar with internal systems 135.

[0025] Protocol stack 134 exchanges information with internal systems 135 and exchanges packets containing the information with control system 133. Interfaces 131-132 communicate with external communication links to exchange packets between the external communication links and control system 133. Control system 133 includes processing and memory circuitry that direct the exchange of packets. Control system 133 operates based on instructions stored in memory.

[0026] Protocol analyzer 110 comprises first interface 111, second interface 112, control system 113, protocol stack 114, and internal systems 115. Protocol analyzer 120 comprises first interface 121, second interface 122, control system 123, protocol stack 124, and internal systems 125. These components are connected and operate as described for the corresponding components of protocol analyzer 130.

[0027] Protocol analyzers 110, 120, and 130 are daisy-chained together as follows. First interface 111 is coupled to second interface 122. First interface 121 is coupled to the second interface of the next device represented by the ellipses. The devices represented by the ellipses are connected in a similar fashion, and the first interface in the last device represented by the ellipses is coupled to second interface 132. First interface 131 is coupled to packet network 152.

[0028] Control system 133 in protocol analyzer 130 receives packets from packet network 152. Control system 133 passes a packet to the daisy-chain if the packet is needed by a device in the daisy-chain. Control system 130 could use various techniques to pass the packets. For example, control system 130 may pass packets with certain packet types. In some examples of the invention, devices on the daisy-chain are configured with MAC addresses within a given range, and control system 130 passes packets with destination MAC addresses that are within the range. In some examples of the invention, control system 130 maintains a list of MAC addresses and passes packets with destination MAC addresses that are on the address list. The address list is compiled from the MAC addresses in the source field of packets that are received from the daisy-chain. Thus, the address list includes devices in the daisy-chain that send packets to packet network 152.

[0029] Protocol analyzers 110 and 120 are connected to packet network 152 through protocol analyzer 130. Protocol analyzers 110 and 120 do not need the screening function of protocol analyzer 130 and may simply keep packets that are addressed to them and transfer other packets up or down the chain. Protocol analyzers 110 and 120 may also process packets of a certain type, such as broadcast packets. If desired, protocol analyzers 110 and 120 could be configured with the screening function, so all protocol analyzers have the same general configuration.

[0030] FIGS. 3-5 depict a specific example of protocol analyzer operation in accord with the present invention. Those skilled in the art will appreciate numerous variations from this example that do not depart from the scope of the invention. Those skilled in the art will also appreciate that various features described below could be combined to form multiple variations of the invention.

[0031] FIGS. 3-5 illustrate the operation of the control system 133 in protocol analyzer 130 in an example of the invention. On FIG. 3, operation starts when a packet is received from the daisy-chain through second interface 132. The destination MAC address from the packet is checked for a match with the MAC address for protocol analyzer 130. Note that if protocol analyzers do not communicate with one another, then there is no need to check the destination MAC address for packets that are transferred in the direction toward packet network 152. If there is a match, then the packet is transferred to protocol stack 134. If there is not a match, then the packet is transferred to packet network 152 through first interface 131. The source MAC address from the packet is also added to a list. Over time, the address list indicates all of the devices in the daisy-chain that communicate with packet network 152.

[0032] On FIG. 4, operation starts when a packet is received from packet network 152 through first interface 131. The packet is stored in memory. The destination MAC address from the packet is checked for a match with the MAC address for protocol analyzer 130. If there is a match, then the packet is transferred to protocol stack 134. If there is not a match, then the type field of the packet is checked. If the type indicates that the packet should be passed to the daisy-chain, such as a broadcast type, then the packet is transferred to both protocol stack 134 and the daisy-chain through second interface 132. If the type does not indicate that the packet should be passed, then the destination MAC address from the packet is checked against a range of MAC addresses. If the destination MAC address from the packet is within the range, then the packet is transferred to the daisy-chain through second interface 132. If the destination MAC address from the packet is not within the range, then the destination MAC address from the packet is checked against the address list of MAC addresses. If the destination MAC address from the packet is on the address list, then the packet is transferred to the daisy-chain through second interface 132. If the destination MAC address from the packet is not on the address list, then the packet is deleted. The operation depicted on FIG. 4 can vary in different examples of the invention. There are three types of checks for packets from packet network 152: 1) packet type, 2) MAC range, and 3) MAC list. Any of these checks could be used by itself or in combination with one or both of the other checks.

[0033] FIG. 5 depicts another variation when a packet is received from packet network 152 through first interface 131. The destination MAC address from the packet is checked for a match with the MAC address for protocol analyzer 130. If there is a match, then the packet is transferred to protocol stack 134. If there is not a match, then the type field of the packet is checked. If the type indicates that the packet should be passed to the daisy-chain, such as a broadcast type, then the packet is transferred to protocol stack 134 and to the daisy-chain through second interface 132. If the type does not indicate that the packet should be passed, then the destination MAC address from the packet is checked against a range of MAC addresses. If the destination MAC address from the packet is within the range, then the destination MAC address from the packet is checked against the address list of MAC addresses. If the destination MAC address from the packet is on the address list, then the packet is transferred to the daisy-chain through second interface 132. If the destination MAC address from the packet is not within the range or is not on the address list, then the packet is deleted.

[0034] Those skilled in the art will appreciate variations of the above-described embodiments that fall within the scope of the invention. For example, devices other than protocol analyzers and addresses other than MAC addresses could be used to implement the invention. As a result, the invention is not limited to the specific examples and illustrations discussed above, but only by the following claims and their equivalents.