Packet forwarding device with packet filter

• US 20070047548A1
• Filed: 03/03/2006
• Published: 03/01/2007
• Est. Priority Date: 08/26/2005
• Status: Active Grant

• Current Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Original Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Inventors: Shimojo, Toshio, Yazaki, Takeki
• Granted Patent: US 7,680,114 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

To provide a packet forwarding device which minimizes degradation in packet forwarding performance at the time of execution of filtering there is provided a technique in which a destination decision processing unit of a destination decision and filtering unit decides whether to execute filtering on the basis of at least one of an input interface, an input port number, an output interface, and an output port number of an input packet and a plurality of pieces of information constituting the header of the packet. A filtering unit executes filtering only for a packet for which execution of filtering is decided. The packet forwarding device with the destination decision and filtering unit need not execute filtering for all packets and can minimize degradation in packet forwarding performance caused by filtering.

Claims

1. A forwarding device which forwards a packet, comprising:

a packet receiving unit which receives a packet from a port; and

a destination decision and filtering unit which decides whether to execute filtering on the basis of one of information of a first packet received by said packet receiving unit and input information of said packet receiving unit.

2. The forwarding device according to claim 1, wherein

said destination decision and filtering unit has a destination decision unit which decides output destination information indicating an output destination of the packet depending on destination information contained in the first packet and

decides whether to execute filtering on the basis of the output destination information decided by said destination decision unit.

3. The forwarding device according to claim 2, wherein

the output destination information includes an interface number indicating a network to which the first packet is to be output, an output port number indicating a number of a port to which the first packet is to be output, and at least a part of a next hop address indicating an address of a next forwarding device to which the first packet is to be transmitted.

4. The forwarding device according to claim 1, wherein

the input information of said receiving unit includes one of an input port number indicating a number of a port from which the first packet is input and an input interface number indicating a number of an interface from which the first packet is input.

5. The forwarding device according to claim 1, wherein

said packet receiving unit has an internal header adding unit which adds, to the first packet, an input port number corresponding to a port from which the first packet is received, and

said destination decision and filtering unit decides whether to execute filtering on the basis of the input port number added by said internal header adding unit.

6. The forwarding device according to claim 1, wherein

said packet receiving unit has an interface decision unit which decides an input interface number on the basis of one of header information and an input port number contained in the first packet, and

said destination decision and filtering unit decides whether to execute filtering on the basis of the interface number decided by said interface decision unit.

7. The forwarding device according to claim 1, wherein

the one of the information of the first packet received by said packet receiving unit and the input information of said packet receiving unit specifies a flow of the first packet.

8. The forwarding device according to claim 7, wherein

the flow of the first packet includes at least one of an input port number indicating a port from which the first packet is input, an output port number indicating a port to which the first packet is to be output, an input interface number indicating an interface from which the first packet is input, an output interface number indicating an interface to which the first packet is to be output, and a source address and a destination address contained in a header of the first packet.

9. The forwarding device according to claim 1, further comprising:

a filtering execution information store unit which stores the one of the information of the first packet received by said packet receiving unit and the input information of said packet receiving unit; and

a filtering execution condition setting input unit which sets and inputs data to said filtering execution information store unit.

10. The forwarding device according to claim 1, wherein

said destination and filtering unit has a filtering result decision unit which decides a result of filtering including decision of discard if a source address contained in header information of the first packet does not match a predetermined condition.

11. A forwarding device having a plurality of interface units each connected to an extra-device port and an intra-device line, comprising:

a packet receiving unit which receives a first packet from a first extra-device port of a first interface unit of the plurality of interface units;

an input-side destination decision unit which decides output destination information corresponding to a destination contained in the first packet received by said packet receiving unit; and

a filtering execution decision unit which decides whether to execute filtering on the basis of the output destination information decided by said input-side destination decision unit.

12. The forwarding device according to claim 11, further comprising:

a filtering result decision unit which decides whether to allow forwarding of the first packet if said filtering execution decision unit decides execution of filtering; and

a packet transmitting unit which transmits information of the first packet to the output destination information decided by said input-side destination decision unit through the intra-device line if said filtering execution decision unit decides non-execution of filtering and if said filtering result decision unit decides allowance of forwarding.

13. The forwarding device according to claim 12, wherein

said filtering result decision unit decides whether to allow forwarding on the basis of a source address contained in the first packet.

14. The forwarding device (200) according to claim 12, further having

an interface number decision unit which decides a first input interface number on the basis of one of a port number corresponding to the first extra-device port from which the first packet is received and information in a header of the packet, wherein

said filtering result decision unit decides whether to allow forwarding on the basis of the first interface number corresponding to the first extra-device port decided by said interface number decision unit in addition to the source address contained in the first packet.

15. A forwarding device having a plurality of interface units each connected to an extra-device port and an intra-device line, comprising:

a packet receiving unit which receives a first packet from a first extra-device port of a first interface unit of the plurality of interface units;

an intra-device forwarding unit which forwards information of the first packet, to which input source information corresponding to the first extra-device port is added, to a second interface unit corresponding to a destination contained in the first packet received by said packet receiving uni; and

a filtering execution decision uni which decides whether to execute filtering on the basis of at least one of the information of the first packet received by the second interface unit and the input source information.

16. The forwarding device according to claim 15, further comprising:

a filtering result decision unit which decides whether to allow forwarding of the first packet if said filtering execution decision unit decides execution of filtering; and

a packet transmitting unit which transmits the first packet through an extra-device port of the second interface unit if said filtering execution decision unit decides non-execution of filtering and if said filtering result decision unit decides allowance of forwarding.

17. The forwarding device according to claim 15, wherein

the input source information includes one of an input interface number and an input port number.