US 11,757,739 B2
Aggregation of select network traffic statistics
David Anthony Hughes, Los Altos Hills, CA (US); and Pawan Kumar Singh, Los Altos, CA (US)
Assigned to Hewlett Packard Enterprise Development LP, Spring, TX (US)
Filed by HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, Houston, TX (US)
Filed on Jan. 28, 2021, as Appl. No. 17/161,225.
Application 17/161,225 is a continuation of application No. 16/581,637, filed on Sep. 24, 2019, abandoned.
Application 16/581,637 is a continuation of application No. 15/180,981, filed on Jun. 13, 2016, granted, now 10,432,484, issued on Oct. 1, 2019.
Prior Publication US 2021/0160159 A1, May 27, 2021
Int. Cl. H04L 43/062 (2022.01); H04L 43/045 (2022.01); H04L 43/067 (2022.01); G06F 16/22 (2019.01); G06F 16/248 (2019.01); G06F 16/28 (2019.01); H04L 43/026 (2022.01)
CPC H04L 43/062 (2013.01) [G06F 16/22 (2019.01); G06F 16/248 (2019.01); G06F 16/284 (2019.01); H04L 43/026 (2013.01); H04L 43/045 (2013.01); H04L 43/067 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for aggregating network traffic statistics comprising:
receiving, at a network appliance, a SYN network packet;
storing, at the network appliance, header information from the SYN network packet in a
flow data table;
for each of the data packets related to the SYN network packet, storing header information of the data packets in the flow table;
In response to receiving a FIN network packet is that is associated with the SYN network packet:
accessing the flow data table for network information regarding packets that are
processed through the network appliance for related data-packets, wherein the network
information includes a network characteristic for the SYN network
packet, the data packets related to the SYN network packet, and the FIN network packet,
grouping related packets by aggregating the network information by the network characteristic and corresponding network metric, and
storing a single row for the related data packets by the network characteristic and the corresponding network metric;
after a predetermined amount of time or a predetermined number of rows is reached,
invoking an eviction policy on the flow data table, wherein the eviction policy removes the
related data packets from the flow data table; and
populating an accumulating map with the flow data table.