Route processor adjusting of line card admission control parameters for packets destined for the route processor

• US 20070014276A1
• Filed: 07/12/2005
• Published: 01/18/2007
• Est. Priority Date: 07/12/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Ward, David, Mattes, Paul, Bettink, John, Chen, Jianyu, Brotz, Norbert
• Granted Patent: US 7,522,521 B2
• Time in Patent Office: Days
• US Class Current: 370/351
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/645 Splitting route computation layer and forwarding layer, e.g. routing according to path computational element [PCE] or based on OpenFlow functionality
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for a route processor adjusting admission control policies for packets destined for the route processor and enforced on line cards. Individual line cards can identify offending packet flows that pass through them. However, for example, it is possible that an attack on the route processor might comprise packets being forwarded to the route processor from different line cards, with these packets belonging to a same or different packet flow. By monitoring and identifying offending packet flows, the route processor can inform at least the line cards corresponding to these offending packet flows in order to adjust their corresponding admission control policies to combat such an attack, while typically allowing legitimate traffic to continue to flow at the desired rate to the route processor.

Claims

1. A routing device, comprising:

a route processor for processing route updates; and

a plurality of line cards communicatively coupled to the route processor;

wherein the route processor includes a route processing mechanism, packet storage for storing packets received from the plurality of line cards, and one or more resource monitoring mechanisms for identifying one or more resource utilization values representative of traffic destined for the route processor and received from the plurality of line cards;

wherein each of the plurality of line cards includes one or more external interfaces for sending and receiving packets;

a forwarding lookup mechanism for identifying packets of said received packets destined for the route processor; and

an admission control enforcement mechanism for limiting traffic it respectively sends to the route processor; and

wherein the route processor is configured to communicate with the plurality of line cards in order to cause said admission control enforcement mechanisms of one or more offending line card sources of said line cards to reduce traffic being sent to the route processing mechanism in response to said resource utilization values reaching or exceeding a predetermined value.

2. The routing device of claim 1, wherein each of the plurality of line cards includes a lookup mechanism for identifying admission control parameters for said packets destined for the route processor;

and wherein said admission control enforcement mechanism of each of said line cards is configured to enforce said identified admission control parameters for said packets; and

wherein said communicating with said line cards in order to cause said admission control enforcement mechanisms of one or more of the said line cards to reduce traffic being sent to the route processing mechanism includes communicating values or instructions for causing modification of at least one of said admission control parameters.

3. The routing device of claim 1, wherein the route processor is configured to said communicate with said line cards in order to said reducing traffic only if the utilization of the route processing mechanism equals or exceeds a predetermined threshold value.

4. The routing device of claim 1, wherein said communicating with said line cards includes broadcasting a packet including said values or instructions.

5. The routing device of claim 1, wherein said resource utilization values include a measurement of the storage utilization for said storing packets in said storage.

6. The routing device of claim 1, wherein said storage stores said packets in one or more queues;

and wherein said resource utilization values include at least one measurement of a queue depth of packets stored in at least one of said queues.

7. The routing device of claim 1, wherein said traffic being sent to the route processing mechanism includes offending and non-offending flows of traffic, and said route processor is configured to identify said offending flows of traffic;

wherein said communicating to reduce traffic includes communicating indications of the offending flows to said offending line card sources; and

wherein said offending line card sources are configured to reduce the traffic of the offending flow while not reducing the traffic of the non-offending flows in response to said indications.

8. The routing device of claim 7, wherein said communicating with the plurality of line cards includes sending messages only to said offending line card sources.

9. The routing device of claim 1, wherein said route processor is configured to identify a flow characterization of offending traffic;

and wherein said communicating with the plurality of line cards includes providing an indication of the flow characterization; and

wherein said admission control enforcement mechanisms of said one or more line cards are configured to react to the indication of the flow characterization in order to reduce or eliminate traffic being sent to the route processor corresponding to the flow characterization.

10. The routing device of claim 1, wherein the route processor is configured to communicate with the plurality of line cards in order to cause said admission control enforcement mechanisms of said one or more of said line cards to increase traffic being sent to the route processing mechanism in response to said resource utilization values equaling or falling below a second predetermined value.

11. The routing device of claim 1, wherein the route processor is configured to process communications application requests originated from remote devices for communicating with the routing device, said applications requests including an offending flow of communications application requests and a non-offending flow of communications application requests;

and wherein said route processor is configured to identify the offending flow; and

wherein said communicating to reduce traffic includes communicating one or more indications of the offending flow to said offending line card sources; and

wherein said offending line card sources are configured to reduce the traffic of the offending flow while not reducing the traffic of the non-offending flows in response to said indications of the offending flows.

12. A routing device comprising:

a route processor for processing route updates; and

a plurality of line cards communicatively coupled to the route processor, each of the plurality of line cards includes means for identifying, admission control enforcement and forwarding packets of said received packets destined for the route processor, said means for admission control enforcement including means for modifying its admission control parameters in response to communication from the route processor; and

wherein the route processor includes a means for processing route processor requests and route updates, means for storing packets received from the plurality of line cards, means for monitoring flows of said traffic in order to identify an offending flow, and means for communicating to said line cards to cause at least one of said line cards to modify one or more of its said admission control parameters associated with the offending flow.

13. The routing device of claim 12, wherein said causing at least one of said line cards to modify said admission control parameters associated with the offending flow includes causing two or more of said line cards to modify their respective said admission control parameters associated with the offending flow.

14. The routing device of claim 12, wherein said resource utilization values include a load utilization value of said means for processing route processor requests and route updates, and wherein the route processor only said communicates to said line cards to cause at least one of said line cards to modify one or more of its said admission control parameters associated with the offending flow when the load utilization value equals or exceeds a predetermined threshold value.

15. The routing device of claim 12, wherein said means for communicating with said line cards includes means for sending a broadcasting packet to each of the plurality of line cards of an indication of the offending flow.

16. The routing device of claim 12, wherein said means for communicating with said line cards includes means for sending packets only to those line cards associated the offending flow.

17. The routing device of claim 12, wherein the route processor includes means for identifying resource utilization values representative of traffic destined for the route processor and received from the plurality of line cards, said resource utilization values including a measurement of the storage utilization for said means for storing packets;

and wherein in response to the storage utilization exceeding a threshold, the route processor is configured to identify the offending flow and to communicate to said line cards to cause at least one of said line cards to modify one or more of its said admission control parameters associated with the offending flow.

18. The routing device of claim 17, wherein said resource utilization values include a load utilization value of said means for processing route processor requests and route updates, and wherein the route processor only said communicates to said line cards to cause at least one of said line cards to modify one or more of its said admission control parameters associated with the offending flow when the load utilization value equals or exceeds a predetermined threshold value.

19. The routing device of claim 18, wherein the route processor is configured to communicate with the plurality of line cards in order to cause said admission control enforcement mechanisms of said one or more of said line cards to increase traffic being sent to the route processing mechanism in response to said resource utilization values equaling or falling below a second predetermined value.

20. The routing device of claim 12, wherein the route processor is configured to communicate with the plurality of line cards in order to cause said admission control enforcement mechanisms of said one or more of said line cards to increase traffic being sent to the route processing mechanism in response to said resource utilization values equaling or falling below a second predetermined value.