WO2012078110A1

WO2012078110A1 - Method and system for providing adaptive statistical and time based quality of service over a network

Info

Publication number: WO2012078110A1
Application number: PCT/SG2010/000460
Authority: WO
Inventors: Soo Guan Simon Eng
Original assignee: Nanyang Polytechnic
Priority date: 2010-12-10
Filing date: 2010-12-10
Publication date: 2012-06-14
Also published as: SG190861A1

Abstract

A system and method for providing Quality of Service (QOS) rules for handling packets in a network. Each agent device in the network monitors packet traffic handled by the agent device to generate a statistics about the packet traffic. A Quality of Service controller receives the statistics from each of the agent devices and analyzes the statistics. Based upon the analysis of the statistics, the QOS controller generates and/or updates the QOS rules. The QOS rules are then transmitted to the agent devices and enforcer devices in the network for implementation.

Description

METHOD AND SYSTEM FOR PROVIDING ADAPTIVE STATISTICAL AND TIME BASED

QUALITY OF SERVICE OVER A NETWORK

Field of the Invention

This invention relates to transmission of packets over a network. More particularly, this invention relates to providing a quality of service hierarchy to packets sent in a best effort regime. Still more particularly, this invention relates to an automated system for generating quality of service rules for the packets based upon statistics of packet traffic over the network where the quality of service for packets may be adjusted based upon traffic during particular time periods.

Summary of the Prior Art

In packet switched networks, Quality of Service (QOS) often refers to providing a certain level of performance to a data flow of packets. To provide QOS, system resources are often reserved for particular applications to assure certain level of performance for metrics such as bit rate, delay, jitter, etc. This is because there is no uniform protocol for providing QOS of individual packets. Most packets are transmitted over a network Using a "best effort" standard in which all packets are treated equally. To give preferential treatment to some packets, some local networks allow packet marking. In packet marking, an identifier is placed into a field such as a Differentiated Services Code Point (DSCP) portion of a TOS field of an Internet Protocol (IP) header of a packet. The packet is then handled based upon the priority given by the identifier. The packets transmitted without identifiers are handled in the conventional "best effort" manner.

It is a problem that the rules for assigning the identifiers in these systems are often manually generated. Thus, the rules are often set to account only for the business or system needs of the local network. However, it is observed that traffic patterns of the packets handled by the network often change during different portions of the day. For example, users on a local network of a business may all need to access critical websites during business hours to get critical business operations or certain social network sites may be accessed at higher rates during evening hours on an Internet Service Provider (ISP) network. Further, these traffic patterns may change as business users shift to other information providers or new websites gain popularity with users. Thus, there is a need for a system that can differentiate packets transmitted to high volume sites during peak times to provide better service to users. Therefore, those skilled in the art are constantly striving to provide a

l system that provides better QOS than "best effort" to highly accessed sites during certain time periods to provide better reliability to users.

Summary of the Invention

The above and other problems are solved and an advance in the art is provided by a method and system for providing adaptive statistical and time based QOS over a network in accordance with this invention. A first advantage of a system and method in accordance with this invention is that a QOS that is better than best effort may be applied to packets transmitted to popular or business critical content providers. A second advantage of this invention is that the QOS rules for handling the packets may be updated based upon traffic analysis without the need of manual implementing of new rules. Thus, the QOS to users of these content providers is enhanced. A third advantage of this invention is that network resources do not need to be reserved to provide better QOS to packets transmitted to frequently occurring addresses.

A system and method for providing adaptive statistical and time based QOS in accordance with an embodiment of this invention is provided in the following manner. Agent devices in the network monitor packets handled by each agent device and collect statistics about the packets handled. The statistics collected by each agent device are transmitted to a QOS controller device. The QOS controller device then analyzes the statistics and generates QOS rules. The generated QOS rules are then transmitted to the agent devices and enforcer devices in the system for implementation.

In accordance with an embodiment of this invention, the QOS controller receives statistics about packets handled by an agent device over a predefined time period from each agent device in the network. The QOS controller than analyzes the statistics for each desired time slot during a predefined time period. The QOS then generates QOS rules for each time slot based upon the analysis of the statistics. The QOS rules are then transmitted to each agent device. Each agent device then applies QOS to packets transmitted over the network.

In accordance with some embodiments of this invention, the QOS rules create a hierarchy of packets given best effort treatment based upon an address in each packet. The predefined time period may be a month, a week or a day. The time slots may be a certain time interval of a day of the week or in a particular day of the week within a time period. In accordance with some embodiments of this invention, the statistics collected include an address from each received packet and time that each said packet was received. The address may be the source and/or destination address in the packet. In accordance with embodiments of this invention, the QOS controller also transmits the generated QOS rules to an enforcer device that applies the rules to packets handled by the enforcer device.

In accordance with embodiments of this invention, the QOS controller analyzes the statistics received from the agent devices in the following manner: The statistics received from each agent are read by the QOS controller. The statistics received from the agents are then aggregated for a current time period. The number of occurrences of each address detected is rank by frequency of occurrence for each time slot. The addresses are then ranked based on the frequency of occurrence in the time slots. The QOS controller then assigns a priority identifier to a predetermined number of the most frequently occurring addresses and the QOS rules are generated accordingly. The addresses ranked may be source addresses, destination addresses, or pairs of source and destination addresses.

In accordance with some embodiments of this invention, the analysis further includes calculating weighted results for the statistics for prior time periods monitored and aggregating the statistics of the current time period with the weighted results calculated for the statistics for prior time periods and using the aggregated results to rank the occurrences of addresses in each time slot. In accordance with some of these embodiments, the weighted results are calculated by applying a weighted function to the statistics for the current time period and a certain number of prior time measuring periods. The weighted function may be selected from the group consisting of a linear function, a non-linear function, an exponential function, and a squared function.

In accordance with some embodiments of this invention, each agent device collects statistics in the following manner. An agent device receives a packet over the network. An address is read from the packet and the transmission time of the packet is determined. An occurrence count for the address and current time slot stored in memory is then incremented. When the agent determines that the collection period has expired, the agent reads all of the occurrence counts from memory and transmits all of the read counts as statistics to the QOS controller. In accordance with some embodiments of this invention, the agents apply the rules to packets received in the following manner. The agent receives a packet. An address is then read from the packet by the agent and a time of transmission of the packet is determined. The agent then searches a stored set of QOS rules received from the QOS controller based upon the address and the transmission time. If a rule is found, a priority identifier for the address is read from the rule and the agent inserts the priority identifier into a field in the packet. Depending on the embodiment, the address may be the source address and/or the destination address in the packet. In accordance with some of these embodiments, the priority identifier is inserted into a DSCP field of the packet. In accordance with further ones of these embodiments, the identifier is a numeral between 11 and 22. In accordance with still further ones of these embodiments, the numerals in this range are assigned to the most frequently occurring addresses in descending order.

In accordance with some embodiments of this invention, an enforcement device applies the QOS rules received from a QOS controller in the following manner. The enforcement device receives a packet. The QOS identifier field is read from the packet. The enforcement device then determines if the field includes a recognized QOS identifier. If so, the packet is handled in accordance with the QOS determined by the QOS identifier. Otherwise, the enforcement device handles the packet in accordance with a conventional manner.

Brief Description of the Drawings

The above and other features and advantages of a method and system in accordance with this invention are described in the following detailed description and are shown in the following drawings:

Figure 1 illustrating a network incorporating a method and system in accordance with an embodiment of this invention;

Figure 2 illustrating a processing system representative of processing systems in devices that perform processes for providing a method and system in accordance with this invention;

Figure 3 illustrating a flow diagram of a process performed by a QOS controller to generate QOS rules based upon statistics of network traffic in accordance with an embodiment of this invention;

Figure 4 illustrating a flow diagram of a process for analyzing statistics by the QOS controller in accordance with an embodiment of this invention;

Figure 5 illustrating a flow diagram of a process performed by an agent device to collect statistics about packet traffic in accordance with an embodiment of this invention; Figure 6 illustrating a flow diagram of a process performed by an agent device to apply QOS rules received from a QOS controller to packets handled by the agent in accordance with an embodiment of this invention; and

Figure 7 illustrating a flow diagram of a process performed by an enforcer device to apply QOS rules received from a QOS controller to packets handled by the enforcer in accordance with an embodiment of this invention.

Detailed Description

Figure 1 illustrates a network 100 that implements a system for providing adaptive statistical and time based QOS over a network in accordance with this invention. Network 100 is a local network in which end user systems 120-123 are connected to agent devices 115-116. End user systems 120-123 may be personal desktop computer systems, laptop computer systems, Personal Digital Assistants (PDAs), mobile phones or any other device that may connect to a packet based communications network. End user systems 120-123 may be connected via conventional wired connections or communicatively connected by wireless connections via infrared and/or Radio Frequency (RF). The exact type of connection is not important to this invention. Agent device 115 and agent device 116 may be servers, routers, wireless routers, and/or any other type of system that connects end user systems 120-123 to a network. One skilled in the art will note that the shown network is given only as an example and any number of end user systems and/or agent devices may be included in the network without departing from this invention. Agent devices 115-1 16 connect to an enforcer device 110. In this embodiment, enforcer device 110 is a router, server or other device that connects agent devices 115-116 to the Internet 105. However, one skilled in the art will recognize that other network configurations are possible in which network 100 includes more than one enforcer device connected to Internet 105 and/or an enforcer device that is not directly connected to Internet 105. All that is required of an enforcer device 110 for purposes of this invention is that enforcer device 110 handles packets received from agent devices 115-116. Network 100 also includes QOS controller device 125. QOS controller device 125 is a processing device that is communicatively connected to agent devices 115-116 and enforcer device 110. In accordance with the shown embodiment of this invention, QOS controller device 125 receives statistics about packets handled by network 100 from agent devices 115 and 116; analyzes the statistics and generates and/or updates the QOS rules; and transmits the QOS rules to agent devices 115 and 116, and enforcer device 110. One skilled in the art will recognize that enforcer device 1 10, agent devices 115-116, and QOS controller device 125 are shown as different devices in this embodiments. However, the functions of more than one of these devices may be performed by one device without departing from this invention.

For illustrative purposes, websites 150 and 151 are shown as connected to Internet 105. Websites 150 and 151 are systems and or networks having a specific Internet address for providing a specific content to other devices. One skilled in the art will recognize that although websites are used for purposes of illustrating this invention, Internet 105 may be used to transmit data between device for other purposes without departing from this invention.

In the shown embodiment of this invention, the method and/or system are provided by software processes performed by the devices in network 100. Figure 2 illustrates an exemplary processing system including the components needed to execute the applications from instructions stored in memory in accordance with this invention. One skilled in the art will recognize that the exact configuration of each processing system may be different and the exact configuration executing processes in accordance with this invention may vary and processing system 200 shown in Figure 2 is provided by way of example only.

Processing system 200 includes Central Processing Unit (CPU) 205. CPU 205 is a processor, microprocessor, or any combination of processors and microprocessors that execute instructions to perform the processes in accordance with the present invention. CPU 205 connects to memory bus 210 and Input/Output (I/O) bus 215. Memory bus 210 connects CPU 205 to memories 220 and 225 to transmit data and instructions between the memories and CPU 205. I/O bus 215 connects CPU 205 to peripheral devices to transmit data between CPU 205 and the peripheral devices. One skilled in the art will recognize that I/O bus 215 and memory bus 210 may be combined into one bus or subdivided into many other busses and the exact configuration is left to those skilled in the art. A non-volatile memory 220, such as a Read Only Memory (ROM), is connected to memory bus 210. Non-volatile memory 220 stores instructions and data needed to operate various sub-systems of processing system 200 and to boot the system at start-up. One skilled in the art will recognize that any number of types of memory may be used to perform this function.

A volatile memory 225, such as Random Access Memory (RAM), is also connected to memory bus 210. Volatile memory 225 stores the instructions and data needed by CPU 205 to perform software instructions for processes such as the processes for providing a system in accordance with this invention. One skilled in the art will recognize that any number of types of memory may be used to provide volatile memory and the exact type used is left as a design choice to those skilled in the art.

I/O device 230, keyboard 235, display 240, memory 245, network interface 250 and any number of other peripheral devices connect to I/O bus 215 to exchange data with CPU 205 for use in applications being executed by CPU 205. I/O device 230 is any device that transmits and/or receives data from CPU 205. Keyboard 235 is a specific type of I/O device that receives user input and transmits the input to CPU 205. Display 240 receives display data from CPU 205 and display images on a screen for a user to see. Memory 245 is a device that transmits and receives data to and from CPU 205 for storing data to a media. Network interface 250 connects CPU 205 to a network for transmission of data to and from other processing systems.

This invention is provided by processes performed by the various devices in a network. The processes may be performed by hardware, software, or firmware in each of the devices without departing from this invention. In the shown embodiment, the processes provided by software instructions stored in a memory readable by the device and executed by the processing system of the device. Further, although more than one device is described, the processes of more than one of these devices may be performed by one device without departing from this invention. The processes performed in accordance with the shown embodiment of the invention are illustrated in Figures 3-7.

Figure 3 illustrates an embodiment of a process performed by QOS controller device 125 to generate and distribute QOS rules in accordance with the shown embodiment of the invention. Process 300 begins in step 305 with QOS controller device 125 receiving statistics regarding packet traffic over network 100 from each agent device 115-116. In the shown embodiment, the statistics include one or more address and the number of occurrences of an address in packets handled during each specific time slot over a measured time period. A time slot may be any quantifiable measure of time including, but not limited to, a week, a day, an hour of a particular day, or a particular portion of a day. The measured time period may be any quantifiable measure of time that is preferably larger than the time slots measured. Examples of time periods include, but are not limited to, days, weeks, months, and quarters of a year. In this embodiment, the addresses in the packets that are being monitored may be the source address of the packet, the destination address of the packet, or both the source and destination addresses. However, one skilled in the art will recognize that for purposes of this invention, the address may be a destination TCP port, a destination UDP port, or any other identifier in a packet that identifies a source and/or destination of the packet.

In step 310, QOS controller device 125 analyzes the statistics received from agent devices 115-116. An example of a process for analyzing the statistics is described below and is illustrated in Figure 4. Based upon the analysis of the statistics, QOS controller device 125 generates updated QOS rules in step 315. The rules are generated in a manner recognizable by a process implementing the rules in the other devices and may be stored in the form of a database entry, a look-up table, linked list, or any other data structure that is searchable by the processes. The exact configuration of the rules does not matter. However, each rule should specify an address or addresses, a time slot and a priority identifier as will be described below. However, other parameters may be used in generating the rules without departing from this invention.

After the QOS rules are generated, the rules are transmitted to each agent device in step 320 and to each enforcer device in step 325. One skilled in the art will recognize that although the rules are transmitted in steps 320 and 325 in this embodiment, the rules may only need to be made available to each device by means such as storing in a network database or library without departing from this invention. After the rules are transmitted, process 300 ends.

Figure 4 illustrates a flow diagram of process 400 that is an embodiment of a process performed by QOS controller device 125 to analyze the statistics about packet traffic over network 100 received from agent devices 115-116. One skilled in the art will recognize that analysis regarding other parameters of the network traffic may be performed without departing from this invention. All that is required is that metrics regarding the parameters measured are collected by agent devices 115-116 and transmitted to QOS controller 125. Other metrics include, but are not limited to, the length of packets transmitted to and/or from an address, or the total amount of data transmitted to and/or from an address. In process 400, the occurrence of an address in packets during a particular time slot is analyzed. In the shown embodiment, the occurrence of destination address in packets during the time slots is measured. However, in other embodiments, the occurrence of source addresses in the packets or the occurrence of a pair including a particular source and a particular address may be monitored and used to generate QOS rules.

Process 400 begins in step 405 by reading the statistics received from each of agent devices 115-116. The statistics are then aggregated in step 410. In this particular embodiment, the statistics are aggregated by summing the occurrence count over the monitored time period for each monitored address during each time slot received from agent devices 115-116. In some embodiments, steps 415 and 420 are performed to take into account the statistics from previously monitored periods to keep stability in the QOS rules. In step 415, the occurrence counts for each address in time slots from a previous time period are multiplied by a weight factor. In accordance with this embodiment, only the previous two time periods are considered. However, one skilled in the art will recognize that any number of previous time periods may be considered limited only by the capabilities of QOS controller device 125. In the present embodiment, the occurrence counts of the most previous time period are multiplied by a weight factor of 0.5 and the occurrence counts of the second most previous time period are multiplied by a weight factor of 0.25. However, one skilled in the art will recognize that any other weight factors of weighting functions may be used depending on the emphasis that a designer wants to give to previous occurrence counts. Examples of weighting functions that may be used include, but are not limited to, linear functions, nonlinear functions, exponential functions, and squared functions. Furthermore, one skilled in the art will recognize that other metrics, monitored by the agent devices may be used without departing from the invention. Examples of other metrics include, but are not limited to, the length of packets transmitted to and/or from an address, or the total amount of data transmitted to and/or from an address. In step 420, the weighted occurrences are aggregated or summed with the occurrences for the current time period to provide weighted results. Alternatively, only the current occurrence counts may be used or no weighting factors may be used without departing from this invention. In step 425, the metrics monitored are used to rank the monitored addresses in order of number of occurrences in each time slot. In the described embodiment, occurrence counts are used to rank the addresses. However, other metrics may be used without departing from this invention. In step 430, priority identifiers are assigned to a predetermined number of ranked addresses. In the shown, embodiment, the priority identifiers are assigned to a predetermined number of most frequently occurring addresses in step 430. For example, in the shown embodiment, a DSCP field is used to identify QOS. As there are no reserved uses for numerals 11-22 in DSCP field, these numerals may be used to identify the 12 most frequently used addresses for priority handling. Therefore, each value 11- 22 is assigned to a most frequently occurring address. In this embodiment, the values are assigned in ascending order. Thus, 22 is assigned to most frequently occurring address and 11 is assigned to the 11th most frequently occurring address. One skilled in the art will recognize that other fields may be used in which case the values and numbers of values that may be assigned may be different. Furthermore, other methods of assigning the values may be used without departing from this invention. After the priority identifiers are assigned, process 400 ends and process 300 may continue to step 315 to generate the QOS rules.

Figures 5 and 6 illustrate processes performed by agent devices 115 and 116 in accordance with the shown embodiment of this invention. In the shown embodiment, agent devices 115 and 116 perform the monitoring of network traffic to provide statistics to QOS controller device 120 and perform a process of inserting QOS identifier in packets received by each agent device for use in providing QOS to the packet. Figure 5 illustrates a flow diagram of process 500. Process 500 is an embodiment of a process performed by an agent device 115 or 116 to collect statistics about packet traffic handled by network 100 during a particular time period. Process 500 begins in step 505 by an agent device receiving a packet. One skilled in the art will recognize that the following step may be performed at the time a packet is handled. Alternatively, a copy of each packet handled may be stored and the following steps may be done at a later time.

In step 510, a monitored address is read from the packet. As stated above, the monitored address may be the source address of the packet or the destination address of the packet. Alternatively, both the source and destination address of the packet, individually or as a pair, may be monitored without departing from this invention. Further, the address may be any field that stores an identifier that identifies a source and/or destination of a packet including, but are not limited to, a destination TCP port or a destination UDP port. In step 515, the time of transmission of the packet is determined. The time of transmission may be determined by reading a field in the packet, from reading an internal clock maintained by the agent device, or any other means without departing from this invention. In step 520, a counter, stored in a memory of the agent device, for the monitored address during the time period that includes time of transmission is incremented. The process then determines whether the time period has ended in step 525. Alternatively, step 525 may determine if all the packets have processed if the packets are stored and read at a later time. If the monitoring time period has ended, the occurrence counts of the address in each time slot are read from memory and transmitted to QOS controller 125 in step 530 and process 500 ends. Otherwise, process 500 returns to step 505 and process 500 is repeated for the next packet received. Figure 6 illustrates a flow diagram of process 600. Process 600 is an embodiment of a process performed by an agent device to implement a QOS system in accordance with this invention. Process 600 begins in step 605 by the agent device receiving a packet. An address used to implement the QOS system in accordance with this invention is then read from the packet in step 610. In the shown embodiment, the destination address is read from the packet. However, other embodiments may read the source address; or both the source and destination address for use in determining a QOS rule that applies to the packet without departing from this invention. In step 615, the time of transmission of the packet is determined. The time of transmission may be determined by reading a field in the packet, from reading an internal clock maintained by the agent device, or any other means without departing from this invention.

In step 620, the agent searches the QOS rules received from the QOS controller device using the address and the time of transmission to determine if a QOS rule applies to the received packet. If a QOS rule is found that applies to the packet in step 625, the priority identifier for the rule is read in step 630 and is inserted into a field in the packet header in step 635. In the current embodiment, the priority identifier is inserted into the DCSP field of the packet. However, other fields in packets may be used to store a priority identifier without departing from this invention. One skilled in the art will recognize that the field will depend upon other factors including, but not limited to, the protocol used by the network and the requirements of the transmission system. Process 600 then ends and the packet is handled in accordance with QOS rule.

If no QOS rule that applies to the packet is found in step 625, process 600 ends and the packet is handled in a conventional manner. One skilled in the art will recognize that processes 500 and 600 may work concurrently or sequentially in agent devices 115 and 116, and the exact sequence is left to one skilled in the art. Figure 7 illustrates a flow diagram of process 700. Process 700 is an embodiment of a process performed by an enforcer device to implement a QOS system in accordance with this invention. Process 700 begins in step 705 by the enforcer device receiving a packet. In step 710, the enforcer device reads the priority identifier from the proper field in the packet. In the current embodiment, the priority identifier is read from the DCSP field of the packet. However, other fields in packets may be used to store a priority identifier without departing from this invention. In accordance with some embodiments, especially embodiments in which an agent device does not insert a QOS identifier in a DCSP field, the identifier may be an address read from an address field in the packets. Some examples of address include, but are not limited to, a source IP address, a destination IP address, a destination TCP port, and a destination UDP port. One skilled in the art will recognize that the field will depend upon other factors including, but not limited to, the protocol used by the network and the requirements of the transmission system.

In step 715, the enforcer device determines if the field included a priority identifier. If so, the QOS rules applying to the priority identifier are read in step 720 and the packet is handled in accordance with the identified QOS in step 725 and process 700 ends. If no priority identifier is found in step 715, the packet is handled in a conventional manner in step 730 and process 700 ends. The above is a description of a manner for providing QOS using rules for certain time slots generated based upon statistical analysis of packet traffic over a network. It is envisioned that those skilled in the art can and will design alternative systems that infringe upon this invention as set forth in the following claims.

Claims

What is claimed is:

1. A system that provides Quality of Service based upon statistical analysis of traffic over a network comprising:

instructions for directing a processing unit in a Quality of Service controller to:

receive statistics about a plurality of packets handled by one of a plurality of agent devices over a predefined time period from each of said plurality of agent devices,

analyze said statistics about said plurality packets handled by said plurality of agent devices for each of a plurality of time slots during said predefined time period; generate a plurality of Quality of Service rules for each of said plurality of time slots based upon said analysis of said statistics, and

transmit said plurality of Quality of Service rules to an enforcer device wherein said enforcer device applies said plurality of Quality of Service rules to packets transmitted over said network; and

a media readable by said processing unit in said Quality of Service controller that stores said instructions for directing said processing unit in said Quality of service controller.

2. The system of claim 1 wherein said plurality of Quality of Service rules generated create a hierarchy of packets given best effort treatment based upon an address.

3. The system of claim 1 wherein said predefined time period is one of a month, a week and a day. 4. The system of claim 1 wherein each of said plurality of time slots is a certain time period in a day of the week.

5. The system of claim 1 wherein each of said plurality of time slots is a certain time period of a particular day of the week.

6. The system of claim 1 wherein said statistics includes an address from each received packet and time that each said packet was received.

7. The system of claim 6 wherein said address from each received packet is a destination address.

8. The system of claim 6 wherein said address from each said packet is a sender address.

9. The system of claim 6 wherein said statistics include both said sender address and said destination address.

10. The system of claim 1 wherein said instructions for directing said Quality of Service controller further comprise:

instructions for directing said processing unit in said Quality of Service to:

transmit said plurality of Quality of Service rules to said plurality of agent devices wherein said plurality of agent devices apply said plurality of Quality of Service rules to packets transmitted over said network.

11. The system of claim 1 wherein said instructions to analyze said statistics comprise:

instructions for directing said processing unit in said Quality of Service controller to: read said statistics received from each of said plurality of agent devices, aggregate said statistics from said plurality of agent devices for a current time period,

rank a plurality of addresses in said statistics for each of a plurality of time slots, and

assign a priority identifier to each of a predetermined number of said plurality of addresses in each of a plurality of time slots according to said rankings. 12: The system of claim 11 wherein said instructions to generate said plurality of

QOS rules comprise:

instructions for directing said processing unit in said Quality of Service controller to: generate one of said plurality of Quality of Service rules for each priority identifier assigned to an address in each of said plurality of time slots.

13. The system of claim 11 wherein each of said plurality of addresses is a destination address.

14. The system of claim 11 wherein each of said plurality of addresses is a source address.

15. The system of claim 11 wherein said instructions to analyze said statistics further comprise:

instructions for directing said processing unit in said Quality of service controller to: calculate weighted results for statistics from each of a plurality of prior time measuring periods; and

aggregate said statistics for said current time period with said weighted results from each of plurality of prior time measuring periods wherein said instructions to rank said addresses is based upon said aggregate of said statistics from said current time period and said weighted results.

16. The system of claim 15 wherein said weighted results are determined by a weighted function applied to said statistics for said current time period and said plurality of prior time measuring periods wherein said weighted function is selected from the group consisting of a linear function, a non-linear function, an exponential function, and a squared function.

17. The system of claim 1 further comprising:

instructions for directing a processing unit in an agent device to:

receive a packet,

read an address from said packet,

determine a time of transmission of said packet, and

update a monitored metric in said statistics for said address in a time slot including said time of transmission; and

a media readable by said processing unit of said agent device that stores said instructions.

18. The system of claim 17 wherein said instructions for directing said processing unit in said agent device further comprise:

instructions for directing said processing unit in said agent device to:

determine a current period has ended, and

transmit said statistics stored by said agent device to said Quality of Service controller in response to a determination that said current period has ended.

The system of claim 17 wherein said address read is a destination address. The system of claim 17 wherein said address read is a source address.

21. The system of claim 17 wherein both source and destination addresses are read and a count is maintained for each source and destination address read.

22. The system of claim 17 wherein said metric comprises an occurrence count of said address in a packet.

23. The method of claim 17 wherein said metric comprises a total length of packets including said address. 24. The system of claim 1 further comprising:

instructions for directing a processing unit in an agent device to:

receive a packet,

read an address from said packet,

determine a time of transmission of said packet,

search for one of a plurality of Quality of Service rules relating to said address during said time slot of said time of transmission,

read a priority identifier for said packet from said one of said plurality of rules in response to finding said one of said plurality of Quality of Service rules applies to said address, and

insert said priority identifier into a field in said packet; and

a media readable by said processing unit in said agent device for storing said instructions.

25; The system of claim 24 wherein said address is a destination address of said packet.

26. The system of claim 24 wherein said address is said source address of said packet. 27. The system of claim 24 wherein both source address and destination address of said packet are read.

28. The system of claim 24 wherein said field is Differentiated Services Code Point field in said packet.

29. The system of claim 28 wherein said priority identifier is a numeral in a range between 11 and 22.

30. The system of claim 29 wherein numerals in said range are assigned to most occurring addresses in a descending order.

31. The system of claim 1 further comprising:

instructions for directing a processing unit in an enforcer device to:

receive a packet,

read a priority identifier from a field in said packet,

determine a Quality of Service to provide for said packet from said priority identifier read from said field and said Quality of Service rules received from said

Quality of Service controller, and

handle said packet in accordance with said Quality of Service determined; and

a media readable by said processing unit in said enforcer device for storing said instructions.

32. The system of claim 31 wherein said priority identifier is an address in a designated field of said packet. 33. The system of claim 31 wherein said priority identifier is an identifier in a

Differentiated Services Code Point field in said packet.

34. The system of claim 31 wherein said instructions for directing said processing unit in said enforcer device further comprise:

instructions for directing said processing unit to:

determine said priority identifier read does not indicate a Quality of Service to provide, and

handle said packet in a convention manner in response to a determination that no Quality of Service is indicated.

35. A method that provides Quality of Service based upon statistical analysis of traffic over a network comprising:

receiving statistics in a Quality of Service controller from each of a plurality of agent devices wherein said statistics are about a plurality of packets handled by each of said plurality of agent devices over a predefined time period;

analyzing said statistics about said plurality packets handled by said plurality of agent devices for each of a plurality of time slots during said predefined time period; generating a plurality of Quality of Service rules for each of said plurality of time slots based upon said analysis of said statistics; and

transmitting said plurality of Quality of Service rules from said Quality of Service controller to an enforcer device wherein said enforcer device applies said Quality of Service rules to packets handled by said enforcer device.

36. The method of claim 35 wherein said generated plurality of Quality of Service rules create a hierarchy of packets given best effort treatment based upon an address. 37. The method of claim 35 wherein said predefined time period is one of a month, a week and a day.

38. The method of claim 35 wherein each of said plurality of time slots is a certain time period in a day of the week.

39. The method of claim 35 wherein each of said plurality of time slots is a certain time period of a particular day of the week.

40. The method of claim 35 wherein said statistics includes an address from each received packet and time that each said packet was received.

41. The method of claim 40 wherein said address from each received packet is a destination address. 42. The method of claim 40 wherein said address from each said packet is a source address.

43. The method of claim 40 wherein said statistics include both a source address and a destination address.

44. The method of claim 35 further comprising:

transmitting said plurality of Quality of Service rules from said Quality of Service controller to said plurality of agent devices. 45. The method of claim 35 wherein said step of analyzing said statistics comprises:

reading said statistics received from each of said plurality of agent devices; aggregating said statistics from said plurality of agent devices for a current time period;

ranking a plurality of addresses in said statistics for each of a plurality of time slots; and

assigning a priority identifier to each of a predetermined number of said plurality of addresses in each of a plurality of time slots according to said rankings.

46. The method of claim 45 wherein said step generating said plurality of QOS rules comprises:

generating one of said plurality of Quality of Service rules for each priority identifier assigned to an address in each of said plurality of time slots.

47. The method of claim 45 wherein each of said plurality of addresses is a destination address.

48. The system of claim 45 wherein each of said plurality of addresses is a source address.

49. The method of claim 45 wherein said step of analyzing said statistics further comprises:

calculating weighted results for statistics from each of a plurality of prior time measuring periods; and

aggregating said statistics for said current time period with said weighted results from each of plurality of prior time measuring periods wherein the instructions to rank said addresses is based upon said aggregate of said statistics from said current time period and said weighted results.

50. The method of claim 49 wherein said weighted results are determined by a weighted function applied to said statistics for said current time period and said plurality of prior time measuring periods wherein said weighted function is selected from the group consisting of a linear function, a non-linear function, an exponential function, and a squared function.

51. The method of claim 35 further comprising:

receiving a packet in an agent device;

reading an address from said packet in said agent device;

determining a time of transmission of said packet; and updating a monitored metric in said statistics for said address in a time slot including said time of transmission.

52. The method of claim 51 further comprising:

determining a current period has ended; and

transmitting said statistics stored by said agent device to said Quality of Service controller responsive to a determination that said current period has ended.

53. The method of claim 51 wherein said address read is a destination address.

54. The method of claim 51 wherein said address read is a source address.

55. The method of claim 51 wherein both source and destination addresses are read and a count is maintained for each source and destination address read.

56. The method of claim 51 wherein said metric comprises an occurrence count of said address in a packet.

57. The method of claim 51 wherein said metric comprises a total length of packets including said address.

58. The method of claim 35 further comprising:

receiving a packet in an agent device;

reading an address from said packet;

determining a time of transmission of said packet;

searching for one of a plurality of Quality of Service rules relating to said address during said time slot of said time of transmission;

reading a priority identifier for said packet from said one of said plurality of rules in response to finding said one of said plurality of Quality of Service rules applies to said address; and

inserting said priority identifier into a field in said packet.

59. The method of claim 58 wherein said address is a destination address of said packet.

60. The method of claim 58 wherein said address is said source address of said packet. 61^'. The method of claim 58 wherein both source address and destination address of said packet are read. 62. The method of claim 58 wherein said field is Differentiated Services Code

Point field in said packet.

63. The method of claim 62 wherein said priority identifier is a numeral in a range between 11 and 22.

64. The method of claim 63 wherein numerals in said range are assigned to most occurring addresses in a descending order.

65. The method of claim 35 further comprising:

receiving a packet in an enforcer device;

reading a priority identifier from a field in said packet;

determining a Quality of Service to provide for said packet from said priority identifier read from said field and said Quality of Service rules received from said Quality of Service controller; and

handling said packet in accordance with said Quality of Service determined.

66: The method of claim 65 wherein said priority identifier is an address in a designated field of said packet. 67. The method of claim 65 wherein said priority identifier is an identifier in a

Differentiated Services Code Point field in said packet.

68. The method of claim 65 further comprising:

determining said priority identifier read does not indicate a Quality of Service to provide; and

handling said packet in said enforcer device in a convention manner in response to a determination that no Quality of Service is indicated.

69. A system that provides Quality of Service based upon statistical analysis of traffic over a network comprising: circuitry in a Quality of Service controller configured to receive statistics about a plurality of packets handled by each of a plurality of agent devices over a predefined time period from each of a plurality of agent systems;

circuitry in a Quality of Service controller configured to analyze said statistics about said plurality packets handled by said plurality of agent devices for each of a plurality of time slots during said predefined time period;

circuitry in a Quality of Service controller configured to generate a plurality of Quality of Service rules for each of said plurality of time slots based upon said analysis of said statistics; and

circuitry in a Quality of Service controller configured to transmit said plurality of

Quality of Service rules to an enforcer device wherein said enforcer device applies said plurality of Quality of Service rules to packets transmitted over said network.

70. The system of claim 69 wherein said plurality of Quality of Service rules generated create a hierarchy of packets given best effort treatment based upon an address.

71. The system of claim 69 wherein said predefined time period is one of a month, a week and a day. 72. The system of claim 69 wherein each of said plurality of time slots is a certain time period in a day of the week.

73. The system of claim 69 wherein each of said plurality of time slots is a certain time period of a particular day of the week.

74. The system of claim 69 wherein said statistics includes an address from each received packet and time that each said packet was received.

75. The system of claim 69 wherein said address from each received packet is a destination address.

76. The system of claim 75 wherein said address from each said packet is a sender address. 77. The system of claim 75 wherein said statistics include both sender address and destination addresses.

78. The system of claim 69 further comprises:

circuitry in a Quality of Service controller configured to transmit said plurality of Quality of Service rules to said plurality of agent devices. 79. The system of claim 69 wherein said circuitry in a Quality of Service controller configured to analyze said statistics comprises:

circuitry in a Quality of Service controller configured to read said statistics received from each of said plurality of agent devices,

circuitry in a Quality of Service controller configured to aggregate said statistics from said plurality of agent devices for a current time period,

circuitry in a Quality of Service controller configured to rank occurrences of a plurality of addresses in said statistics for each of a plurality of time slots, and

circuitry in a Quality of Service controller configured to assign a priority identifier to each of a predetermined number of said plurality of addresses in each of a plurality of time slots according to said rankings.

80. The system of claim 79 wherein said circuitry in a Quality of Service controller configured to generate said plurality of QOS rules comprises:

circuitry in a Quality of Service controller configured generate one of said plurality of Quality of Service rules for each priority identifier assigned to an address in each of said plurality of time slots.

81. The system of claim 79 wherein each of said plurality of addresses is a destination address.

82. The system of claim 79 wherein each of said plurality of addresses is a source address.

83. The system of claim 79 wherein said circuitry in a Quality of Service controller configured to analyze said statistics further comprises:

circuitry in a Quality of Service controller configured to calculate weighted results for statistics from each of a plurality of prior time measuring periods; and

circuitry in a Quality of Service controller configured to aggregate said statistics for said current time period with said weighted results from each of plurality of prior time measuring periods wherein the instructions to rank said addresses is based upon said aggregate of said statistics from said current time period and said weighted results.

84. The system of claim 83 wherein said weighted results are determined by a weighted function applied to said statistics for said current time period and said plurality of prior time measuring periods wherein said weighted function is selected from the group consisting of a linear function, a non-linear function, an exponential function, and a squared function.

85. The system of claim 69 further comprising:

circuitry in an agent device configured to receive a packet;

circuitry in said agent device configured to read an address from said packet;

circuitry in said agent device configured to determine a time of transmission of said packet; and

circuitry in said agent device configured to update a monitored metric in said statistics for said address in a time slot including said time of transmission. 86. The system of claim 85 further comprising:

circuitry in said agent device configured to determine a current period has ended, and

circuitry in said agent device configured to transmit said statistics stored by said agent device to said Quality of Service controller response to a determination that said current period has ended.

87. The system of claim 85 wherein said address read is a destination address.

88. The system of claim 85 wherein said address read is a source address.

89. The system of claim 85 wherein both source and destination addresses are read and a count is maintained for each source and destination address read.

90. The system of claim 85 wherein said metric comprises an occurrence count of said address in a packet.

91. The method of claim 85 wherein said metric comprises a total length of packets including said address. 92. The system of claim 69 further comprising:

circuitry in an agent device configured to receive a packet;

circuitry in said agent device configured to read an address from said packet; circuitry in said agent device configured to determine a time of transmission of said packet;

circuitry in said agent device configured to search for one of a plurality of Quality of Service rules relating to said address during said time slot of said time of transmission;

circuitry in said agent device configured to read a priority identifier for said packet from said one of said plurality of rules in response to finding said one of said plurality of Quality of Service rules applies to said address; and

circuitry in said agent device configured to insert said priority identifier into a field in said packet.

93. The system of claim 92 wherein said address is a destination address of said packet.

94. The system of claim 92 wherein said address is said source address of said packet.

95. The system of claim 92 wherein both source address and destination addresses of said packet are read. 96. The system of claim 92 wherein said field is Differentiated Services Code

Point field in said packet.

97. The system of claim 92 wherein said priority identifier is a numeral in a range between 11 and 22.

98. The system of claim 97 wherein numerals in said range are assigned to most occurring addresses in a descending order.

99. The system of claim 69 further comprising:

circuitry in an enforcer device configured to receive a packet,

circuitry in said enforcer device configured to read a priority identifier from a field in said packet;

circuitry in said enforcer device configured to determine a Quality of Service to provide for said packet from said priority identifier read and said field from Quality of Service rules received from said Quality of Service controller; and

circuitry in said enforcer device configured to handle said packet in accordance with said Quality of Service determined.

100. The system of claim 99 wherein said priority identifier is an address in a designated field of said packet. 101. The system of claim 99 wherein said priority identifier is an identifier in a

Differentiated Services Code Point field in said packet.

102. The system of claim 99 further comprising:

circuitry in said enforcer device configured to determine said priority identifier read does not indicate a Quality of Service to provide; and

circuitry in said enforcer device configured to handle said packet in a convention manner in response to a determination that no Quality of Service is indicated.