A method and system for distributive flow control and bandwidth management in networks is disclosed. The method includes: providing multiple Internet Protocol (IP) Gateways (IPGWs) that each have a maximum send rate and one or more sessions with associated throughput criteria, wherein each IPGW performs flow control by limiting information flows by the respective maximum send rate and throughput criteria; providing multiple Code Rate Organizers (CROs) that each have a bandwidth capacity, wherein each CRO performs bandwidth allocation of its respective bandwidth capacity to one or more IPGWs of the multiple IPGWs; interconnecting the multiple IPGWs with the multiple CROs; and performing bandwidth management across the multiple CROs and IPGWs. In the method, an IPGW of the multiple IPGWs provides flow control across a plurality of the CROs of the multiple CROs, and a CRO of the multiple CROs allocates bandwidth to a plurality of the IPGWs of the multiple IPGWs.

A communication control system includes a plurality of layer 2 switches (SWs); and a communication control device that controls communication of the SWs. Each SW includes one or more queues that each have a variable queue length for accumulating input frames, and a transmission unit that has a shaping function of transmitting the frames accumulated in the queues to a desired destination at a desired rate. The communication control device includes a correction processing unit that acquires an amount of discarded data generated in each queue of the SW, and multiplies the acquired amount of discarded data by a correction coefficient weighted by the cumulative number of times of discarding occurrences for which the amount of discarded data is not 0 to obtain a corrected amount of discarded data; and an adjustment processing unit that determines adjustment values for the queue length of each queue and shaping rate of the SW based on the corrected amount of discarded data, and notifies each SW of the adjustment values.

This application provides a traffic shaping method and apparatus. The method includes: A packet marking apparatus receives a first packet; the packet marking apparatus determines an enqueuing queue of the first packet; and the packet marking apparatus marks a queue identifier of the first packet as a queue identifier of the enqueuing queue of the first packet, and then sends the queue identifier of the first packet to a packet output apparatus, where the packet output apparatus is configured to send, based on the queue identifier of the first packet, the first packet to a corresponding queue for outputting. Therefore, packet output time after traffic shaping can be determined.

This application provides a traffic shaping method and apparatus. The method includes: A packet marking apparatus receives a first packet; the packet marking apparatus determines an enqueuing queue of the first packet; and the packet marking apparatus marks a queue identifier of the first packet as a queue identifier of the enqueuing queue of the first packet, and then sends the queue identifier of the first packet to a packet output apparatus, where the packet output apparatus is configured to send, based on the queue identifier of the first packet, the first packet to a corresponding queue for outputting. Therefore, packet output time after traffic shaping can be determined.

In an embodiment, header information of messages is altered to specify a window within which to receive information, so that the messages sent by a remote device will be sent at a rate that a network can receive messages. The sending of acknowledgements of messages are paced to control window growth. Bandwidth is allocated to a plurality of flows such that the satisfied flows require less bandwidth than an amount of bandwidth allocated to each unsatisfied flow.

Some embodiments provide a method for performing deep packet inspection (DPI) for an SD-WAN (software defined, wide area network) established for an entity by a plurality of edge nodes and a set of one or more cloud gateways. At a particular edge node, the method uses local and remote deep packet inspectors to perform DPI for a packet flow. Specifically, the method initially uses the local deep packet inspector to perform a first DPI operation on a set of packets of a first packet flow to generate a set of DPI parameters for the first packet flow. The method then forwards a copy of the set of packets to the remote deep packet inspector to perform a second DPI operation to generate a second set of DPI parameters. In some embodiments, the remote deep packet inspector is accessible by a controller cluster that configures the edge nodes and the gateways. In some such embodiments, the method forwards the copy of the set of packets to the controller cluster, which then uses the remote deep packet inspector to perform the remote DPI operation. The method receives the result of the second DPI operation, and when the generated first and second DPI parameters are different, generates a record regarding the difference.

Some embodiments provide a method for performing deep packet inspection (DPI) for an SD-WAN (software defined, wide area network) established for an entity by a plurality of edge nodes and a set of one or more cloud gateways. At a particular edge node, the method uses local and remote deep packet inspectors to perform DPI for a packet flow. Specifically, the method initially uses the local deep packet inspector to perform a first DPI operation on a set of packets of a first packet flow to generate a set of DPI parameters for the first packet flow. The method then forwards a copy of the set of packets to the remote deep packet inspector to perform a second DPI operation to generate a second set of DPI parameters. In some embodiments, the remote deep packet inspector is accessible by a controller cluster that configures the edge nodes and the gateways. In some such embodiments, the method forwards the copy of the set of packets to the controller cluster, which then uses the remote deep packet inspector to perform the remote DPI operation. The method receives the result of the second DPI operation, and when the generated first and second DPI parameters are different, generates a record regarding the difference.

An ingress packet processor in a device corresponds to a group of ports and receives network packets from ports in its port group. A traffic manager in the device manages buffers storing packet data for transmission to egress packet processors. An ingress arbiter is associated with a port group and connects the port group to an ingress packet processor coupled to the ingress arbiter. The ingress arbiter determines a traffic rate at which the associated ingress packet processor transmits packets to the traffic manager. The ingress arbiter controls an associated traffic shaper to generate a number of tokens that are assigned to the port group. Upon receiving packet data from a port in the group, the ingress arbiter determines, using information from the traffic shaper, whether a token is available. Conditioned on determining that a token is available, the ingress arbiter forwards the packet data to the ingress packet processor.

An ingress packet processor in a device corresponds to a group of ports and receives network packets from ports in its port group. A traffic manager in the device manages buffers storing packet data for transmission to egress packet processors. An ingress arbiter is associated with a port group and connects the port group to an ingress packet processor coupled to the ingress arbiter. The ingress arbiter determines a traffic rate at which the associated ingress packet processor transmits packets to the traffic manager. The ingress arbiter controls an associated traffic shaper to generate a number of tokens that are assigned to the port group. Upon receiving packet data from a port in the group, the ingress arbiter determines, using information from the traffic shaper, whether a token is available. Conditioned on determining that a token is available, the ingress arbiter forwards the packet data to the ingress packet processor.

A system and method for managing network traffic in a distributed environment. the system including: a plurality of logic modules configured to determine policy data related to bandwidth management and at least one split criteria for a basis for shaping network traffic; a control processor associated with each one of the plurality of logic modules, each control processor configured to determine data associated with each of a plurality of traffic flows at the associated logic module and to coordinate traffic actions over the plurality of logic modules; a packet processor associated with each control processor and configured to determine a traffic action based on each traffic flow and received policy data; and at least two shaper objects configured to receive a split of the traffic flows and enforce the determined traffic action on their respective traffic flow.