WO2003017580A1

WO2003017580A1 - Method and apparatus for determining aal type

Info

Publication number: WO2003017580A1
Application number: PCT/US2002/023812
Authority: WO
Inventors: Paul W. Cushman; Gregory V. Rose; Sid H. Sacek
Original assignee: Networks Associates Technology Inc
Current assignee: McAfee LLC
Priority date: 2001-08-16
Filing date: 2002-07-25
Publication date: 2003-02-27
Anticipated expiration: 2004-02-16

Abstract

A system, method and computer program product are provided for copying data from an asynchronous transfer mode (ATM) connection table (116). In use, an ATM connection table (116) on an ATM network (106) is monitored. During such monitoring, it is determined whether entries of the ATM connection table (116) are active. If the entries are active, associated data is periodically transferred from the active entries of the ATM connection table to memory (202). Identifiers associated with the data are utilized for identification purposes. The transferred data in the memory (202) may then be subsequently utilized with an application program. Another system, method and computer program product are provided for determining a type of ATM adaptation layer (AAL) associated with an ATM connection for analysis purposes.

Description

METHOD AND APPARATUS FOR DETERMINING AAL TYPE

FIELD OF THE INVENTION

The present invention relates to network analysis systems, and more particularly to monitoring a network for analysis purposes.

BACKGROUND OF THE INVENTION

With the advent of the Internet, there has been a sharp increase in the demand for network bandwidth which has been principally driven by two trends: (i) the increasing number of networked computers exchanging data; and (ii) the increasing need for networked computers to exchange ever-increasing quantities of data. In response to this demand, a variety of new computer network technologies have been developed that improve upon existing technologies by increasing the efficiency of data transmission, increasing the speed of data transmission, or both. Although such technologies achieve increased network bandwidth, they also create a need for new and improved technologies to analyze networks incorporating these technologies.

Network assessment tools referred to as "analyzers" are often relied upon to analyze networks during use. One example of such analyzers is the SNIFFER ANALYZER® device manufactured by NETWORK ASSOCIATES, INC®. All analyzers have similar objectives such as determining why network performance is slow, understanding the specifics about excessive traffic, and/or gaining visibility into various parts of the network.

Analyzers are often used to monitor networks which are based on an asynchronous transfer mode (ATM) switching protocol. ATM switching is used in communications systems for switching voice, data, and video information. Frequently, these services are supported simultaneously by the same switch. In use, ATM switches are capable of switching small elements of information, called cells, rapidly between an input port and an output port. A header at the beginning of each cell contains identifying information that may also be modified in the course of this switching. During operation, the switches typically track the switching using connection tables, stored in a specialized memory in the switch.

In the prior art, each connection supported by the switch occupies at least one entry in one or more of the connection tables. Typical analyzer tools extract these entries for gathering statistics and monitoring various network parameters. To date, such entries have been extracted one-at-a-time. In other words, typically analyzers issue one call command to extract one entry from the connection table. This one-to-one relation thus results in a vast number of calls being made to extract the necessary data.

Since typical scanning is carried out in real-time, it is often difficult to extract all of the required information in a manner efficient enough to keep up with the operation of the switch. Often, the analyzer must take incomplete "snap shots" of the contents of the connection tables. This, in turn, results in incomplete statistics and substandard scanning results.

There is thus a need for an apparatus and method for more efficiently and effectively collecting information from ATM connection tables for analysis purposes. The ATM switching protocol consists of three layers: the physical layer, ATM layer, and ATM adaptation layers (AAL). In use, convergence, and segmentation and reassembly for each connection at a switch is supported by multiple AALs which reside above the physical layer and ATM layer. Table 1 sets forth the currently defined AALs.

Table 1

• AAL1 - Supports connection-oriented services that require constant bit rates and have specific timing and delay requirements. Examples are constant bit rate services like DS 1 or DS3 transport.

• AAL2 - Supports connection-oriented services that do not require constant bit rates. In other words, variable bit rate applications like some video schemes.

AAL3/4 - This AAL is intended for both connectionless and connection oriented variable bit rate services. Originally two distinct adaptation layers AAL3 and 4, they have been merged into a single AAL which name is AAL3/4 for historical reasons.

• AAL5 - Supports connection-oriented variable bit rate data services. It is a substantially lean AAL compared with AAL3/4 at the expense of error recovery and built in retransmission. This tradeoff provides a smaller bandwidth overhead, simpler processing requirements, and reduced implementation complexity. Some organizations have proposed AAL5 for use with both connection-oriented and connectionless services. Typical analyzers must extract information about each connection in order to gather statistics and monitor various network parameters for analysis purposes. At the AAL level, however, this collection of information is impossible without first identifying the specific AAL type associated with a connection. Without knowing the AAL type, the data is undecipherable since each AAL type has its own format.

There is thus a further need for a network analyzer capable of determining an AAL type for analysis purposes.

DISCLOSURE OF THE INVENTION

A system, method and computer program product are provided for copying data from an asynchronous transfer mode (ATM) connection table. In use, an ATM connection table on an ATM network is monitored. During such monitoring, it is determined whether entries of the ATM connection table are active. If the entries are active, associated data is periodically transferred from the active entries of the ATM connection table to memory. Identifiers associated with the data are utilized for identification purposes. The transferred data in the memory may then be subsequently utilized with an application program.

In one embodiment, the data may be transferred from the active entries of a plurality of ATM connection tables. Such plurality of ATM connection tables may include one ATM connection table for each of a plurality of ATM links. As an option, the plurality of ATM connection tables may include at least one common ATM connection table.

In another embodiment, the entries of the ATM connection table may be deemed active if the entries have been just created since a previous transfer of data. Further, the entries of the ATM connection table may be deemed active if the entries have been altered since a previous transfer of data. As an option, the data from the active entries of the ATM connection table may include statistical information and/or state information.

In still another embodiment, a period with which the data is periodically transferred from the active entries of the ATM connection table to the memory may be configurable. Moreover, the period may be configurable within a predetermined range. Optionally, the predetermined range may be between 1 transfer/second to 4 transfers/second.

As an option, the periodic transfer of the data may be initiated utilizing an application program interface between the application program and the memory. The periodic transfer of the data may also be ceased utilizing the application program interface between the application program and the memory. Such application program interface may be capable of identifying a location in the memory to which the data is to be transferred. Further, the application program interface may identify a period at which the data is to be transferred to the memory. Still yet, the data from each entry of the ATM connection table may be transferred independently.

In still yet another embodiment, the memory may be interrupted in order for the application program to use the transferred data. Optionally, multiple instances of the data may be stored in the memory. Moreover, the memory may store the data in a circular manner.

It should be noted that the aforementioned identifiers may include ATM connection identifiers. During use, such identifiers may be translated per the desires of the user. In use, an age of the data may be tracked so that the data may be deleted upon the age reaching a predetermined amount.

Another system, method and computer program product are provided for determining a type of asynchronous transfer mode (ATM) adaptation layer (AAL) associated with an ATM connection for analysis purposes. First, an ATM connection is identified. Thereafter, a plurality of tests is performed for determining a particular AAL type of the ATM connection. The AAL type of the ATM connection is then deduced based on results of the tests. By this technique, the deduced AAL type may be used by an application program for analysis purposes.

In one embodiment, the application program may include an analyzer. Such analyzer may analyze communications on the ATM connection in accordance with the deduced AAL type.

As an option, the ATM connection may be forced to a particular AAL type. The performance of the tests and the deduction of the AAL type may be skipped if the ATM connection is forced to a particular AAL type.

In another embodiment, it may be determined whether an AAL type of the ATM connection is specified. Further, the performance of the tests and the deduction of the AAL type may be skipped if it is determined that the AAL type of the ATM connection is already specified.

In still another embodiment, the tests may be performed in parallel. Moreover, the tests may be performed in series. As an option, one test may be performed for each existent AAL type. In particular, four (4) tests may be performed for four (4) existent AAL types.

A first test may be performed for determining whether the ATM connection is a first AAL type (i.e. AAL1). Such first test may include checking a predetermined number of cells at the ATM connection. The present test further indicates that the ATM connection is of the first AAL type if the predetermined number of cells at the ATM connection follows a predetermined sequence. A second test may be performed for determining whether the ATM connection is of a second AAL type (i.e. AAL2). Such second test may include checking whether there is an odd parity in a parity field of a cell. It is also determined whether an offset value of the cell is within a predetermined range associated with the second AAL type. The present test then indicates that an ATM connection associated with the cell is of the second AAL type if there is an odd parity in the parity field of the cell and the offset value of the cell is within the predetermined range associated with the second AAL type. As an option, the second test may further involve a CID value and an HEC valid flag per the desires of the user.

Still yet, a third test may be performed for determining whether the ATM connection is of a third AAL type (i.e. AAL3/4). In operation, the third test may include checking whether an "LI" field of a cell is equal to a predetermined number and a type associated with the cell is a first predetermined type. The instant test then indicates that an ATM connection associated with the cell is of the third AAL type if the "LI" field of the cell is equal to the predetermined number and the type associated with the cell is the first predetermined type.

The third test may further include checking whether a "SeqNum" field of the cell is equal to a predetermined number and the type associated with the cell is a second predetermined type. The present test subsequently indicates that the ATM connection associated with the cell is of the third AAL type if the "SeqNum" field of the cell is equal to the predetermined number and the type associated with the cell is the second predetermined type.

A fourth test may be performed for determining whether the ATM connection is of a fourth AAL type (i.e. AAL5). Such fourth test may include checking whether a "SDUT bit associated with a cell is set, and indicating that the ATM connection is of the fourth AAL type if the "SDUl" bit is set.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a schematic diagram of a network architecture, in accordance with one embodiment.

Figure 2 illustrates the transfer of the entries between the connection table and analyzer memory, in accordance with one embodiment.

Figure 3 shows a method for copying data from the connection table such as the

ATM connection table shown in Figures 1 and 2.

Figure 4 illustrates a method that is executed in parallel with the method of Figure 3 for clearing the entries that have been transferred to the memory.

Figure 5 is a flow chart illustrating a method for determining a type of asynchronous transfer mode (ATM) adaptation layer (AAL) associated with an ATM connection for analysis purposes.

Figure 6 illustrates a first test associated with the tests of Figure 5.

Figure 7 illustrates a second test associated with the tests of Figure 5.

Figure 8 illustrates a third test associated with the tests of Figure 5.

Figure 9 illustrates a fourth test associated with the tests of Figure 5. DESCRIPTION OF THE PREFERRED EMBODIMENTS

Figure 1 illustrates an exemplary architecture 100, in accordance with one embodiment. As shown, at least one input device 102 is provided along with at least one output device 104. In the context of the present description, the input device 102 and the output device 104 may be any networked device that is capable of receiving and sending communications, respectively. For example, the input and output devices may include a desktop computer, lap-top computer, hand-held computer, printer or any other type of logic.

Each input device 102 and output device 104 of the present architecture 100 is coupled by way of a network 106. In the context of the present architecture 100, the network 106 may take any form including, but not limited to a local area network (LAN), a wide area network (WAN) such as the Internet, etc.

As shown in Figure 1, coupled to the network 106 is an analyzer 108. Such analyzer may be coupled to a gateway, switch, input device 102, output device 104, or any other networked device or logic. In an embodiment where the analyzer 108 is coupled to an Internet switch, the switch may be an Asynchronous Transfer Mode (ATM) switch, a Frame Relay switch or any other switch that acts on units of user data usually called data cells.

As is well known, each cell has an identifying section such as a header, used for routing or identifying purposes. The data cells can represent actual data as from a computer, voice, video, or any other type of information. The present embodiment is described in terms of an ATM switch. However, the same technology can be applied to other types of switches as well.

As shown, the analyzer 108 includes at least one input port 110 and an output port 112 coupled to the input device 102 and the output device 104, respectively. An ATM core 114 is coupled between the input port 110 and the output port 112. In use, each input port 110 interfaces and connects to one or more of the input devices 102 for passing fully formed ATM cells to the ATM core 114. The output port 112 accepts fully formed cells and emits them to one or more of the output devices 104. It should be noted that the ATM core 114 may emit cells to a plurality of output ports represented by output port 112, and may send a plurality of copies of the cell to a single output port 112, each with a different header.

The ATM core 114 includes a certain number of connection slots to be configured for connecting the input ports represented by input port 110 and the output ports represented by the output port 112, or to be idle. Also included is a connection table 116 coupled to the ATM core 114 for tracking each connection supported by the ATM core 114 in a plurality of entries.

It should be noted that the analyzer 108 may be separate from or integral with the aforementioned components. In one embodiment, the analyzer 108 may be a standalone device which monitors the traffic/segment between two ATM switches [Network to Network Interface (NNI)] or between an ATM end-station and a switch [User to Network Interface (UNI)].

A computer 118 may be coupled to the analyzer 108 or constitute a component of the analyzer 108 for extracting such entries from the connection table 116 for gathering statistics and monitoring various network parameters. Such statistics and network parameters may then be used to troubleshoot, monitor network performance, and/or enhance security provisions, i.e. detect attacks, vulnerabilities, malicious code, etc.

Unlike prior art analyzers, the present embodiment extracts the entries from the connection table 116 by copying multiple entries into memory. This allows a more comprehensive collection of statistics with respect to the prior art method of extracting entries one-at-a-time.

Figure 2 illustrates the transfer of the entries between the connection table 116 and analyzer memory 202, in accordance with one embodiment. It should be noted that the analyzer memory 202 may be a component of the computer 118 of Figure 1, dedicated memory, or any other desired memory located in any desired location. In use, the data stored in the ATM connection table may include statistical information, state information, protocol information, or any other data capable of being used to enhance the operation and security of the architecture 100. In one embodiment, the analyzer memory 202 may include at least 4Kbytes.

As shown in Figure 2, the connection table 116 includes a plurality of active entries 204 and a plurality of idle entries 206. In one embodiment, the entries of the connection table 116 may be deemed active if the entries have been just created since a previous transfer of data. Further, the entries of the connection table 116 may be deemed active if the entries have been altered since a previous transfer of data. Still yet, a portion of the connection table 116 may be left unused.

It should be noted that a plurality of such connection tables 116 may be provided. In such embodiment, one ATM connection table may be provided for each of a plurality of ATM links. Further, the plurality of ATM connection tables may include at least one common ATM connection table.

Figure 3 illustrates a method 300 for copying data from a connection table such as the ATM connection table shown in Figures 1 and 2. In operation 302, the ATM connection table is monitored. Upon a triggering event, the entries in the ATM connection table are copied over into memory. In one embodiment, the triggering event may be a periodic interrupt signal generated by the analyzer. It should be noted, however, that the triggering event may be produced by any desired logic that determines when it is appropriate for the entries in the ATM connection table to be copied over into memory.

In one embodiment, a period with which the interrupt signal is generated may be configurable. Moreover, the period may be configurable within a predetermined range. Optionally, the predetermined range may be between 1 transfer/second to 4 transfers/second. This range may ensure optimal transfer of data to enable a comprehensive statistical analysis by the analyzer.

Once it is determined in decision 304 that the interrupt is received, the various entries of the ATM connection table are identified. Note operation 306. The purpose of such identification process may be to identify which entries of the ATM connection table are suitable for transfer to the memory. In particular, it is determined in decision 310 whether the identified entries are active. As mentioned earlier, the entries of the connection table may be deemed active if the entries have been just created since a previous transfer of data, the entries have been altered since a previous transfer of data, or the entries are in any other way ready to be transferred. If the entries are deemed active in decision 310, data is transferred from such entries of the ATM connection table to memory. See operation 312. Next, in decision 314, it is determined whether any additional entries exist. If so, a next entry of the ATM connection table is identified in operation 315, and operation 312 is repeated for any additional active entries. Optionally, multiple instances of the data of each entry may be stored in the memory, if the resources of the memory are sufficient. While an independent transfer of entries is set forth hereinabove, it should be understood that contiguous entries may be transferred at once if supported by the accompanying hardware.

Moreover, the memory may store the data in a circular manner. In other words, the data may be transferred from the ATM connection table to the entries in the memory in sequential order from a first entry to a last entry in the memory. Once the last entry in the memory is filled, the process may be repeated at the first entry.

As mentioned earlier, the data may be transferred from the active entries of a plurality of ATM connection tables, where each ATM connection table corresponds to one of a plurality of ATM links. Further, the plurality of ATM connection tables may include at least one common ATM connection table from which entries are extracted.

Once it is has been determined in decision 314 that no further additional entries exist, an application program associated with the analyzer may be prompted to use the entries transferred to the memory. See operation 316. So that the application program may use the entries transferred to the memory, identifiers associated with the data may be utilized for identification purposes. It should be noted that such identifiers may include ATM connection identifiers. As an option, such identifiers may be translated into a "CAM ID" which is traditionally used by the ATM core. As an option, the periodic transfer of the data may be initiated utilizing an application program interface between the application program and the memory. The periodic transfer of the data may also be ceased utilizing the application program interface. Such application program interface may be further capable of identifying a location in the memory to which the entry data is to be transferred. Further, the application program interface may identify a period at which the data is to be transferred to the memory.

By periodically initiating the transfer of all active entries to memory, a more complete set of data is collected for use by the analyzer when monitoring an associated architecture. Further, by storing the entries in the memory, the application program is given adequate time to adequately analyze the entry data. As an option, the memory transfer method 300 may be interrupted in order to further ensure that the application program has adequate time to use the transferred data.

Figure 4 illustrates a method 400 that is executed in parallel with the method 300 of Figure 3 for clearing the entries that have been transferred to the memory. It should be noted that the method 400 may be continuously executed while the method 300 of Figure 3 is being used to extract entries from the connection table.

As shown, one of the entries is identified in operation 402 after which it is determined in decision 404 whether the age thereof has exceeded a predetermined amount. Such predetermined age may be selected based on when the usefulness of an entry is conventionally depleted. If such age has been exceeded, the entry may be cleared in operation 406.

After the entry is cleared or it is determined in decision 404 that the age of the present entry has not exceeded the predetermined amount, a next entry is identified. Note operation 408. By this design, the entries may be sequentially checked to determine whether the age has exceeded the threshold, and deleted accordingly in order to make room for additional incoming transferred data.

As mentioned earlier, the ATM switching protocol consists of three layers: the physical layer, ATM layer, and ATM adaptation layer (AAL). In use, convergence and segmentation and reassembly for each connection at the switch is supported by multiple AAL types which reside above the physical layer and ATM layer. Before the aforementioned statistics and network parameters collected from the connection table 116 may be organized and used, the associated AAL type must be ascertained so that the analysis may be adequately administered. This determination is completed for each element (i.e. cell) of information. As is well known, a header at the beginning of each cell contains identifying information associated with the cell.

Figure 5 is a flow chart illustrating a method 1200 for determining a type of

AAL associated with an ATM connection for analysis purposes. First, in operation 1202, an ATM connection is identified. This may be accomplished by simply inspecting the aforementioned connection table 116. Of course, any other means of identifying a connection may be employed per the desires of the user.

Thereafter, in operation 1204, a plurality of tests is performed for determining a particular AAL type of the ATM connection. As an option, the tests may be performed in parallel. In other words, the tests may be performed at the same time. Moreover, the tests may be performed in series, i.e. sequentially. It should be noted that the tests may be performed for each cell associated with an ATM connection, or any desired number of cells required to deduce a type of the ATM connection. As an option, one test may be performed for each existent AAL type. In particular, four (4) tests may be performed for four (4) existent AAL types. As mentioned earlier, such AAL types may include AAL1, AAL2, AAL3/4, and AAL5. In one embodiment, such tests may each utilize specific protocol characteristics and/or parameters that are specific to each AAL type. Various examples of such tests will be set forth later during reference to Figures 6-9.

It should be noted that a register of flags may be maintained during the administering of the above tests in order to track which of the AAL types is applicable. In particular, each of the tests is capable of setting an associated AAL type flag. Such flags may thus include an AAL1 flag, AAL2 flag, AAL3/4 flag, and AAL5 flag. For reasons that will soon become apparent, additional flags may be included to indicate that a particular connection is NOT of a particular AAL type. Such flags may include a NOT AAL1 flag, NOT AAL2 flag, NOT AAL3/4 flag, and NOT AAL5 flag.

After the tests have been performed in operation 1204, it is determined in decision 1206 whether the AAL1 flag has been set. If so, it is deduced that the ATM connection is of an AALl type. Note operation 1208. If not, it is determined in decision 1210 whether the AAL2 flag has been set by the tests of operation 1204. If so, it is deduced in operation 1212 that the ATM connection is of an AAL2 type. If not, it is then determined in decision 1214 whether the AAL3/4 flag has been set. If so, it is deduced that the ATM connection is of an AAL3/4 type. Note operation 1216. If not, it is then determined in decision 1218 whether the AAL5 flag has been set. If so, it is deduced that the ATM connection is of an AAL5 type. Note operation 1220.

With the AAL type of the ATM connection deduced based on results of the tests, an application program associated with the analyzer 108 may then properly utilize the collected information for analysis purposes. Note operation 1222. As mentioned earlier, the statistics and network parameters may be used to troubleshoot, monitor network performance, and/or enhance security provisions, i.e. detect attacks, vulnerabilities, malicious code, etc.

As an option, the ATM connection may be forced to a particular AAL type. The performance of the tests and the deduction of the AAL type may thus be skipped if the ATM connection is forced to a particular AAL type.

As yet another option, it may be determined whether an AAL type of the ATM connection is specified. Further, the performance of the tests and the deduction of the AAL type may be skipped if it is determined that the AAL type of the ATM connection is already specified in the gathered data. By this feature, the resource-expensive tests may be avoided when not needed.

Figure 6 illustrates a first test 1300 associated with the tests of operation 1204 of

Figure 5. Initially, in operation 1302, it is determined whether the AALl type has been eliminated. In one embodiment, this may be determined by inspecting whether the aforementioned NOT AALl flag has been set. One situation where the NOT AALl flag maybe set is when the cell information itself indicates the specific AAL type, and such AAL type is not AALl . Of course, the NOT AAL 1 may be set in other situations, or not used at all per the desires of the user.

If it is determined that the AALl has been eliminated, the operation 1204 of Figure 5 moves onto another test associated with the next AAL type. See operation 1304. If, however, it is not determined that the AALl has been eliminated in decision 1302, it is determined whether an AAL good count variable is equal to "0." Note decision 1306. If so, in operation 1308, the good_count variable is set to "1" and the sequence counter of the current cell is saved. Next, the current method is complete for the current cell. See operation 1310. It should be noted that by setting the good_count variable to "1," decision 1306 will conclude differently upon inspecting another associated cell.

In a case where it is determined that the AAL good_count variable is not equal to "0," it is then determined in decision 1312 whether a SeqCnt variable is equal to an appropriate next SeqCnt (i.e. SeqCnt + 1). In other words, it is determined in decision 1312 whether a next cell is of an appropriate sequence associated with the AALl type. If not, the NOT AALl flag may be set in operation 1314 and the operation 1204 of Figure 5 moves onto another test associated with the next AAL type. See operation 1316.

If, however, it is determined in decision 1312 that a next cell is of the appropriate sequence associated with the AALl type, the good count variable is incremented once again in operation 1318. Next, in decision 1320, it is determined whether the good count variable has reached a predetermined threshold. Reaching such threshold would indicate that a sufficient number of cells have been received in the appropriate sequence to constitute the AALl type. If such threshold has not been reached as determined by decision 1320, the SeqCnt variable of the current cell is saved in operation 1321 and the current method 1300 is complete for the current cell. Note operation 1322. If, however, the threshold has been reached as determined by decision 1320 the AALl flag may be set for the deduction process of method 1200 of Figure 5. See operation 1324.

In summary, the first test may be performed for determining whether the ATM connection is of a first AAL type. Such first test may include checking a predetermined number of cells at the ATM connection. The present test further indicates that the ATM connection is of the first AAL type if the predetermined number of cells at the ATM connection follows a predetermined sequence.

Figure 7 illustrates a second test 1400 associated with the tests of operation 1204 of Figure 5. Initially, in operation 1402, it is determined whether the AAL2 type has been eliminated. Similar to the first test 1300, this may be determined by inspecting whether the aforementioned NOT AAL2 flag has been set.

If it is determined that the AAL2 has been eliminated, the operation 1204 of Figure 5 moves onto another test associated with the next AAL type. See operation 1404. If, however, it is not determined that the AAL2 has been eliminated in decision 1402, it is determined in decision 1405 whether an offset (i.e. "OSF") value of a cell is within a predetermined range associated with the second AAL type. For the cell associated with the ATM connection to indicate an AAL2 type, the aforementioned range must be less than "45." If the offset value is not within the predetermined range (in other words, >= "45"), it is determined in decision 1406 whether the offset value is greater than "47." If so, the NOT AAL2 flag is set in operation 1408. If not, however, the current method 1400 is complete for the current cell. Note operation 1409.

If the offset value is less than "45," it is then determined in decision 1410 whether there is an odd parity in a parity field associated with a first byte of the cell associated with the ATM connection. It should be noted that the parity field is a commonly known portion of each cell of the AAL2 type, and such field is odd parity in the case of the AAL2 type. If the odd parity is not discovered in decision 1410, the NOT AAL2 flag is set in operation 1408. If, however, the odd parity is discovered in decision 1410, further tests are performed. In particular, it is determined whether a "CID" value is valid for the current cell as well as whether a "HEC" value is valid. Note operations 1411 and 1412, respectively. It should be noted that such values are conventional AAL protocol values that are valid if the cell is of the AAL2 type.

If decisions 1411 and 1412 both produce positive results in terms of valid values, it is determined in decision 1414 whether a predetermined threshold number of cells have passed the aforementioned tests. Similar to the first test, reaching such threshold would indicate that a sufficient number of cells have passed for the ATM connection to constitute the AAL2 type. If such threshold has not been reached as determined by decision 1414, the current method 1400 is complete for the current cell. Note operation 1416. If, however, the threshold has been reached as determined by decision 1414, the AAL2 flag may be set for the deduction process of method 1200 of Figure 5. See operation 1418.

Figure 8 illustrates a third test 1500 associated with the tests of operation 1204 of Figure 5. Initially, in operation 1502, it is determined whether the AAL3/4 type has been eliminated. Similar to the foregoing tests, this may be determined by inspecting whether the aforementioned NOT AAL3/4 flag has been set.

If it is determined that the AAL3/4 has been eliminated, the operation 1204 of Figure 5 moves onto another test associated with the next AAL type. See operation 1504. If, however, it is not determined that the AAL3/4 has been eliminated in decision 1502, it is determined in decision 1506 whether an whether an "LI" field is greater than a predetermined number (i.e. "44"). It should be noted that the "LI" field is a commonly known portion of each cell and such field is greater than "44" in the case of AAL3/4- type communications. If decision 1506 passes, the NOT AAL3/4 flag is set in operation 1508. If, however, the decision 1506 fails, further tests are performed. In particular, it is determined in decision 1510 whether the "LI" field is equal to a predetermined number and a type associated with the cell is a predetermined type. It should be noted that the "LI" field is a commonly known portion of each cell of the AAL3/4 type ,and such field is equal to "44" in the case of the AAL3/4 type, if the type of the cell is either of a "BOM" or "COM" type.

If the test at decision 1510 passes, it is determined in decision 1512 whether a predetermined threshold number of cells have passed the aforementioned tests. Reaching such threshold would indicate that a sufficient number of cells have passed to decide that the present ATM connection is of the AAL3/4 type. If such threshold has not been reached as determined by decision 1512, the current method 1500 is complete for the current cell. Note operation 1514. If, however, the threshold has been reached as determined by decision 1512, the AAL3/4 flag may be set. See operation 1516.

If the test at decision 1510 fails, however, a further test is performed. Specifically, in decision 1518 it is checked whether a "SeqNum" field of the cell is equal to a predetermined number (i.e. "1") and the type associated with the cell is a predetermined type (i.e. "SSM"). If the test at decision 1518 fails, the NOT AAL3/4 flag is set in operation 1520 and the operation 1204 of Figure 5 moves onto another test associated with the next AAL type. See operation 1521. If, however, the decision 1518 passes, the decision 1512 is encountered in the aforementioned manner. Table 2 provides a list of definitions for the various fields and cells of the AAL3/4 type.

Table 2

LI field is the Length Indicator field ST field is the Segment Type field SN field is the Sequence Number field MID field is the Multiplex Identification field BOM cells are Beginning Of Message cells COM cells are Continuation of Message Cells EOM cells are End Of Message cells

Note : The BOM and COM cells have a length (LI ) of 44 because they use the entire data area (which is 44 bytes) for the message data . The EOM cells can have any length up to 44 . The SSM cells are Single Segment Messages and they are for frames that completely fit into one AAL3/4 cell .

Figure 9 illustrates a fourth test 1600 associated with the tests of operation 1204 of Figure 5. Initially, in operation 1602, it is determined whether the AAL5 type has been eliminated. Similar to the foregoing tests, this may be determined by inspecting whether the aforementioned NOT AAL5 flag has been set.

If it is determined that the AAL5 has been eliminated, the operation 1204 of Figure 5 moves onto another test associated with the next AAL type. See operation 1604. If, however, it is not determined that the AAL5 has been eliminated in decision 1602, it is determined in decision 1606 whether an whether a "SDUl" bit is set in the PTI. It should be noted that the "SDUl" bit is a commonly known portion of each cell and such bit is set in the PTI if the ATM connection is of the AAL5 type. If decision 1606 passes, the AAL3/4 flag is set in operation 1608.

The AAL5 type of AAL is thus deduced if a cell is seen with a PTI value which identifies the cell as an SDUl. The PTI is a 3-bit value found in a standard ATM cell header. Table 2 shows the two possible PTI values which identify that the cell is a SDUl.

Table 2 0x01 for User data cell , no congest , SDU-type=l 0x03 for User data cell , congestion, SDU-type=l

If, however, the decision 1606 fails, it is determined in decision 1610 whether a predetermined threshold number of cells have failed the aforementioned test. Reaching such threshold would indicate that a sufficient number of cells have failed to eliminate the AAL5 type as an option. If such threshold has not been reached as determined by decision 1610, the current method 1600 is complete for the current cell. Note operation 1612. If, however, the threshold has been reached as determined by decision 1610, the NOT AAL5 flag may be set. See operation 1614.

There may be a limit to the number of cells that the deduction process needs to look at before a cell with the SDUl PTI value should be seen. This is based on the maximum size of an AAL5 frame (which is 64K). It has been observed where the SDU-type=l flag has been set for other AAL types. Although this is not part of the definitions for these other AAL types one may want to design the deductions to handle this case. To handle this, one should require that the other AAL types are deduced first before starting the AAL5 deduction process.

While various embodiments have been described above, it should be understood that they have been presented by way of example only, and not limitation. Thus, the breadth and scope of a preferred embodiment should not be limited by any of the above- described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.

Claims

CLAIMSWhat is claimed is:

1. A method for copying data from an asynchronous transfer mode (ATM) connection table, comprising: (a) monitoring an ATM connection table on an ATM network; (b) determining whether entries of the ATM connection table are active; (c) periodically transferring data from active entries of the ATM connection table to memory; (d) utilizing identifiers associated with the data for identification purposes; and (e) utilizing the transferred data in the memory with an application program.

2. The method as recited in claim 1, wherein the data is transferred from the active entries of a plurality of ATM connection tables.

3. The method as recited in claim 2, wherein the plurality of ATM connection tables include one ATM connection table for each of a plurality of ATM links.

4. The method as recited in claim 3, wherein the memory includes 4Kbtyes of memory.

5. The method as recited in claim 2, wherein the plurality of ATM connection tables include at least one common ATM connection table.

6. The method as recited in claim 1, wherein the entries of the ATM connection table are active if the entries have been just created since a previous transfer of data.

7. The method as recited in claim 1 , wherein the entries of the ATM connection table are active if the entries have been altered since a previous transfer of data.

8. The method as recited in claim 1, wherein the data from the active entries of the ATM connection table includes statistical information.

9. The method as recited in claim 1 , wherein the data from the active entries of the ATM connection table includes state information.

10. The method as recited in claim 1, wherein a period with which the data is periodically transferred from the active entries of the ATM connection table to the memory is configurable.

11. The method as recited in claim 10, wherein the period is configurable within a predetermined range.

12. The method as recited in claim 11, wherein the predetermined range is between 1 transfer/second to 4 transfers/second.

13. The method as recited in claim 1, and further comprising initializing the periodic transfer of the data utilizing an application program interface between the application program and the memory.

14. The method as recited in claim 1, and further comprising ceasing the periodic transfer of the data utilizing an application program interface between the application program and the memory.

15. The method as recited in claim 13, wherein the application program interface identifies a location in the memory to which the data is to be transferred.

16. The method as recited in claim 13, wherein the application program interface identifies a period at which the data is to be transferred to the memory.

17. The method as recited in claim 1, wherein the data from each entry of the ATM connection table is transferred independently.

18. The method as recited in claim 1 , wherein the memory is interrupted in order for the application program to use the transferred data...

19. The method as recited in claim 1, wherein multiple instances of the data are stored in the memory.

20. The method as recited in claim 1, wherein the memory stores the data in a circular manner.

21. The method as recited in claim 1 , and further comprising identifying a last entry of the ATM connection table.

22. The method as recited in claim 1, wherein the identifiers are ATM connection identifiers.

23. The method as recited in claim 22, and further comprising translating the identifiers.

24. The method as recited in claim 1, and further comprising determining an age of the data.

25. The method as recited in claim 24, wherein the data is deleted upon the age reaching a predetermined amount.

26. A computer program product for copying data from an asynchronous transfer mode (ATM) connection table, comprising: (a) computer code for monitoring an ATM connection table on an ATM network; (b) computer code for determining whether entries of the ATM connection table are active; (c) computer code for periodically transferring data from active entries of the ATM connection table to memory; (d) computer code for utilizing identifiers associated with the data for identification purposes; and (e) computer code for utilizing the transferred data in the memory with an application program.

27. The computer program product as recited in claim 26, wherein the data is transferred from the active entries of a plurality of ATM connection tables.

28. The computer program product as recited in claim 27, wherein the plurality of ATM connection tables include one ATM connection table for each of a plurality of ATM links.

29. The computer program product as recited in claim 28, wherein the memory includes at least 4Kbtyes of memory.

30. The computer program product as recited in claim 27, wherein the plurality of ATM connection tables include at least one common ATM connection table.

31. The computer program product as recited in claim 26, wherein the entries of the ATM connection table are active if the entries have been just created since a previous transfer of data.

32. The computer program product as recited in claim 26, wherein the entries of the ATM connection table are active if the entries have been altered since a previous transfer of data.

33. The computer program product as recited in claim 26, wherein the data from the active entries of the ATM connection table includes statistical information.

34. The computer program product as recited in claim 26, wherein the data from the active entries of the ATM connection table includes state information.

35. The computer program product as recited in claim 26, wherein a period with which the data is periodically transferred from the active entries of the ATM connection table to the memory is configurable.

36. The computer program product as recited in claim 35, wherein the period is configurable within a predetermined range.

37. The computer program product as recited in claim 36, wherein the predetermined range is between 1 transfer/second to 4 transfers/second.

38. The computer program product as recited in claim 26, and further comprising initializing the periodic transfer of the data utilizing an application program interface between the application program and the memory.

39. The computer program product as recited in claim 26, and further comprising ceasing the periodic transfer of the data utilizing an application program interface between the application program and the memory.

40. The computer program product as recited in claim 39, wherein the application program interface identifies a location in the memory to which the data is to be transferred.

41. The computer program product as recited in claim 40, wherein the application program interface identifies a period at which the data is to be transferred to the memory.

42. The computer program product as recited in claim 26, wherein the data from each entry of the ATM connection table is transferred independently.

43. The computer program product as recited in claim 26, wherein the memory is interrupted in order for the application program to use the transferred data...

44. The computer program product as recited in claim 26, wherein multiple instances of the data are stored in the memory.

45. The computer program product as recited in claim 26, wherein the memory stores the data in a circular manner.

46. The computer program product as recited in claim 26, and further comprising identifying a last entry of the ATM connection table.

47. The computer program product as recited in claim 26, wherein the identifiers are ATM connection identifiers.

48. The computer program product as recited in claim 47, and further comprising translating the identifiers.

49. The computer program product as recited in claim 26, and further comprising determining an age of the data.

50. The computer program product as recited in claim 49, wherein the data is deleted upon the age reaching a predetermined amount.

51. A system for copying data from an asynchronous transfer mode (ATM) connection table, comprising: (a) logic for monitoring an ATM connection table on an ATM network; (b) logic for determining whether entries of the ATM connection table are active; (c) logic for periodically transferring data from active entries of the ATM connection table to memory; and (d) logic for utilizing identifiers associated with the data for identification purposes; (e) wherein the transferred data in the memory is capable of being used with an application program.

52. A method for copying data from a connection table, comprising: (a) receiving a signal indicating that data is ready to be received by an application program; (b) identifying entries of a connection table in response to the signal; (c) determining whether the entries of the connection table are active; (d) transferring data from active entries of the connection table to memory; and (e) allowing the transferred data in the memory to be used by the application program.

53. A computer program product for copying data from a connection table, comprising: (a) computer code for receiving a signal indicating that data is ready to be received by an application program; (b) computer code for identifying entries of a connection table in response to the signal; (c) computer code for determining whether the entries of the connection table are active; (d) computer code for transferring data from active entries of the connection table to memory; and (e) computer code for allowing the transferred data in the memory to be used by the application program.

54. A method for determining a type of asynchronous transfer mode (ATM) adaptation layer (AAL) associated with an ATM connection, comprising: (a) identifying an ATM connection; (b) performing a plurality of tests for determining a particular AAL type of the ATM connection; (c) deducing the AAL type of the ATM connection based on results of the tests; and (d) allowing use of the deduced AAL type by an application program.

55. The method as recited in claim 54, wherein the application program includes an analyzer.

56. The method as recited in claim 54, wherein the analyzer analyzes communications on the ATM connection in accordance with the deduced AAL type.

57. The method as recited in claim 54, and further comprising forcing the ATM connection to a particular AAL type.

58. The method as recited in claim 57, and further comprising skipping the performance of the tests and the deduction of the AAL type if the ATM connection is forced to a particular AAL type.

59. The method as recited in claim 54, and further comprising determining whether an AAL type of the ATM connection is specified, and skipping the performance of the tests and the deduction of the AAL type if it is determined that the AAL type of the ATM connection is already specified.

60. The method as recited in claim 54, wherein the tests are performed in parallel.

61. The method as recited in claim 54, wherein the tests are performed in series.

62. The method as recited in claim 54, wherein one test is performed for each existent AAL type.

63. The method as recited in claim 62, where four (4) tests are performed for four (4) existent AAL types.

64. The method as recited in claim 63, wherein a first test is performed for determining whether the ATM connection is of a first AAL type, the first test including checking a predetermined number of cells at the ATM connection, and indicating that the ATM connection is of the first AAL type if the predetermined number of cells at the ATM connection follows a predetermined sequence.

65. The method as recited in claim 64, wherein a second test is performed for determining whether the ATM connection is of a second AAL type, the second test including checking whether there is an odd parity in a parity field of a cell, determining whether an offset value of the cell is within a predetermined range associated with the second AAL type, and indicating that the ATM connection associated with the cell is of the second AAL type if there is an odd parity in the parity field of the cell and the offset value of the cell is within the predetermined range associated with the second AAL type.

66. The method as recited in claim 65, wherein a third test is performed for determining whether the ATM connection is of a third AAL type, the third test including checking whether an LI field of a cell is equal to a first predetermined number and a type associated with the cell is a first predetermined type, and indicating that the ATM connection associated with the cell is of the third AAL type if the LI field of the cell is equal to the first predetermined number and the type associated with the cell is the first predetermined type.

67. The method as recited in claim 66, wherein the third test further includes checking whether a SeqNum field of the cell is equal to a second predetermined number and the type associated with the cell is a second predetermined type, and indicating that the ATM connection associated with the cell is of the third AAL type if the SeqNum field of the cell is equal to the second predetermined number and the type associated with the cell is the second predetermined type.

68. The method as recited in claim 67, wherein a fourth test is performed for determining whether the ATM connection is of a fourth AAL type, the fourth test including checking whether a SDUl bit associated with a cell is set, and indicating that the ATM connection is of the fourth AAL type if the SDUl bit associated with the cell is set.

69. A computer program product for determining a type of asynchronous transfer mode (ATM) adaptation layer (AAL) associated with an ATM connection, comprising: (a) computer code for identifying an ATM connection; (b) computer code for performing a plurality of tests for determining a particular AAL type of the ATM connection; (c) computer code for deducing the AAL type of the ATM connection based on results of the tests; and (d) computer code for allowing use of the deduced AAL type by an application program.

70. The computer program product as recited in claim 69, wherein the application program includes an analyzer.

71. The computer program product as recited in claim 69, wherein the analyzer analyzes communications on the ATM connection in accordance with the deduced AAL type.

72. The computer program product as recited in claim 69, and further comprising computer code for forcing the ATM connection to a particular AAL type.

73. The computer program product as recited in claim 72, and further comprising computer code for skipping the performance of the tests and the deduction of the AAL type if the ATM connection is forced to a particular AAL type.

74. The computer program product as recited in claim 69, and further comprising computer code for determining whether an AAL type of the ATM connection is specified, and skipping the performance of the tests and the deduction of the AAL type if it is determined that the AAL type of the ATM connection is already specified.

75. The computer program product as recited in claim 69, wherein the tests are performed in parallel.

76. The computer program product as recited in claim 69, wherein the tests are performed in series.

77. The computer program product as recited in claim 69, wherein one test is performed for each existent AAL type.

78. The computer program product as recited in claim 77, where four (4) tests are performed for four (4) existent AAL types.

79. The computer program product as recited in claim 78, wherein a first test is performed for determining whether the ATM connection is of a first AAL type, the first test including checking a predetermined number of cells at the ATM connection, and indicating that the ATM connection is of the first AAL type if the predetermined number of cells at the ATM connection follows a predetermined sequence.

80. The computer program product as recited in claim 79, wherein a second test is performed for determining whether the ATM connection is of a second AAL type, the second test including checking whether there is an odd parity in a parity field of a cell, determining whether an offset value of the cell is within a predetermined range associated with the second AAL type, and indicating that the ATM connection associated with the cell is of the second AAL type if there is an odd parity in the parity field of the cell and the offset value of the cell is within the predetermined range associated with the second AAL type.

81. The computer program product as recited in claim 80, wherein a third test is performed for determining whether the ATM connection is of a third AAL type, the third test including checking whether an LI field of a cell is equal to a first predetermined number and a type associated with the cell is a first predetermined tyP^e _> and indicating that the ATM connection associated with the cell is of the third AAL type if the LI field of the cell is equal to the first predetermined number and the type associated with the cell is the first predetermined type.

82. The computer program product as recited in claim 81 , wherein the third test further includes checking whether a SeqNum field of the cell is equal to a second predetermined number and the type associated with the cell is a second predetermined type, and indicating that the ATM connection associated with the cell is of the third AAL type if the SeqNum field of the cell is equal to the second predetermined number and the type associated with the cell is the second predetermined type.

83. The computer program product as recited in claim 82, wherein a fourth test is performed for determining whether the ATM connection is of a fourth AAL type, the fourth test including checking whether a SDUl bit associated with a cell is set, and indicating that the ATM connection is of the fourth AAL type if the SDUl bit associated with the cell is set.

84. A system for determining a type of asynchronous transfer mode (ATM) adaptation layer (AAL) associated with an ATM connection, comprising: (a) logic for identifying an ATM connection, performing a plurality of tests for determining a particular AAL type of the ATM connection, and deducing the AAL type of the ATM connection based on results of the tests; and (b) an application program in communication with the logic for analyzing data associated with the ATM connection based on the deduced AAL type.

85. A method for deducing a particular adaptation layer type (AALl), comprising: (a) checking a predetermined number of cells at an ATM connection; and (b) indicating that the ATM connection is of a particular AAL type if the predetermined number of cells at the ATM connection follows a predetermined sequence.

86. A method for deducing a particular adaptation layer type (AAL2), comprising:

(a) checking whether there is an odd parity in a parity field of a cell;

(b) determining whether an offset value of the cell is within a predetermined range associated with a particular AAL type; and

(c) indicating that the ATM connection associated with the cell is of the particular AAL type if there is an odd parity in the parity field of the cell and the offset value of the cell is within the predetermined range associated with the particular AAL type.

87. A method for deducing a particular adaptation layer type (AAL3/4), comprising:

(a) checking whether an LI field of a cell is equal to a first predetermined number and a type associated with the cell is a first predetermined type;

( ) indicating that a ATM connection associated with the cell is of a particular AAL type if the LI field of the cell is equal to the first predetermined number and the type associated with the cell is the first predetermined type;

(c) checking whether a SeqNum field of the cell is equal to a second predetermined number and the type associated with the cell is a second predetermined type; and

(d) indicating that the ATM connection associated with the cell is of the particular AAL type if the SeqNum field of the cell is equal to the second predetermined number and the type associated with the cell is the second predetermined type.

88. A method for deducing a particular adaptation layer type (AAL5), comprising: (a) checking whether a SDUl bit associated with a cell is set; and (b) indicating that an ATM connection is of a particular AAL type if the SDUl bit associated with the cell is set.