Methods, systems, and computer program products for selective layer 2 port blocking using layer 2 source addresses

• US 20070195793A1
• Filed: 02/17/2006
• Published: 08/23/2007
• Est. Priority Date: 02/17/2006
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Extreme Networks, Inc.
• Inventors: Wade, Daniel, Grosser, Donald
• Granted Patent: US 8,705,532 B2
• Time in Patent Office: Days
• US Class Current: 370/395.53
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/742 Route cache; Operation thereof
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL

Abstract

Methods, systems, and computer program products for selective layer 2 port blocking using layer 2 source addresses are disclosed. According to one method, a layer 2 frame is received. An I/O port block list is identified based on a layer 2 source address in the layer 2 frame. A set of ports to which the layer 2 fame should be forwarded is identified. The frame is blocked from being forwarded to ports in the set that are also in the I/O port block list.

Claims

1. A method for selective layer 2 port blocking based on a layer 2 source address, the method comprising:

(a) receiving a layer 2 frame;

(b) identifying, based on a layer 2 source address in the layer 2 frame, an input/output (I/O) port block list;

(c) performing a forwarding phase lookup to identify a set of ports to which the frame should be forwarded; and

(d) blocking forwarding of the layer 2 frame to ports in the set that are also in the I/O port block list.

2. The method of claim 1 wherein identifying, based on the layer 2 source address, an I/O port block list includes performing on a layer 2 learning phase lookup in a layer 2 forwarding table.

3. The method of claim 1 wherein performing the forwarding phase lookup includes performing a lookup in a layer 2 forwarding table and identifying the set of ports including members of a VLAN corresponding to a VLAN tag in the layer 2 frame.

4. The method of claim 1 wherein performing the forwarding phase lookup includes identifying the packet as a layer 3 multicast packet and performing a lookup in a layer 3 forwarding table to determine the set of layer 2 ports to which the frame should be forwarded.

5. The method of claim 1 wherein performing the forwarding phase lookup includes identifying the frame as a layer 3 unicast frame and performing a lookup in a layer 3 forwarding table to identify the set of ports to which the frame should be forwarded.

6. The method of claim 1 wherein the I/O port block list is represented by a bitmap having bits indicating ports to which the layer 2 frame should not be forwarded, wherein the set of ports identified during the forwarding phase lookup is represented by a bitmap having bits indicating the set of ports to which the layer 2 frame should be forwarded and wherein blocking forwarding of the layer 2 frame to ports in the set that are in the list includes masking the bitmap representing the ports to which the frame should be forwarded using the bitmap representing the I/O port block list.

7. The method of claim 1 wherein the layer 2 frame comprises an Ethernet frame and wherein receiving a layer 2 frame includes receiving the layer 2 frame at an Ethernet switch.

8. The method of claim 1 wherein the layer 2 frame comprises an Ethernet frame with an Internet protocol (IP) payload from wherein receiving a layer 2 frame includes receiving a layer 2 frame at an IP router.

9. A system for selective layer 2 port blocking using a layer 2 source address, the system comprising:

(a) a forwarding database including entries having layer 2 forwarding information, wherein at least one of the entries includes an input/output (I/O) port block list indicating ports to which a received layer 2 frame should not be forwarded; and

(b) a forwarding engine for receiving a layer 2 frame, for locating in the forwarding database based on a layer 2 source address in the layer 2 frame, the I/O port block list, for determining a set of ports to which a frame should be forwarded, and for blocking forwarding of the frame to ports in the set that are in the I/O port block list located for the frame.

10. The system of claim 9 wherein the forwarding engine is adapted to identify the I/O port block list by performing a layer 2 learning phase lookup in the forwarding database.

11. The system of claim 9 wherein the forwarding engine is adapted to identify the set of ports to which the frame should be forwarded by performing a lookup in the forwarding database based on a layer 2 destination address in the layer 2 frame.

12. The system of claim 9 wherein the forwarding engine is adapted to identify the frame as a layer 3 multicast frame and to identify the set of ports to which the frame should be forwarded by performing a lookup in a layer 3 forwarding table in the forwarding database.

13. The system of claim 9 wherein the forwarding engine is adapted to identify the frame as a layer 3 unicast frame and to identify the set of ports to which the frame should be forwarded by performing a lookup in a layer 3 forwarding table in the forwarding database.

14. The system of claim 9 wherein the I/O port block list is represented by a bitmap having bits indicating the ports to which the frame should not be forwarded, wherein the set of ports to which the frame should be forwarded is represented by a bitmap having bits indicating the ports to which the frame should be forwarded and wherein the forwarding engine is adapted to implement the blocking by masking the bitmap corresponding to the set of ports to which the frame should be forwarded with the I/O port block list bitmap.

15. The system of claim 9 wherein the forwarding engine comprises a layer 2 forwarding engine and wherein the forwarding database comprises a layer 2 forwarding database.

16. The system of claim 9 wherein the forwarding engine comprises a layer 3 forwarding engine and wherein the forwarding database comprises a layer 3 forwarding database.

17. The system of claim 9 wherein the forwarding engine comprises a layer 2 and layer 3 forwarding engine and wherein the forwarding database includes a layer 2 and a layer 3 forwarding table.

18. A computer program product comprising computer executable instructions embodied in a computer readable medium for performing steps comprising:

(a) receiving a layer 2 frame;

(b) identifying based on a layer 2 source address in the layer 2 frame, a layer 2 port blocking list;

(c) performing a forwarding phase lookup to identify a set of ports to which the frame should be forwarded; and

(d) blocking forwarding of the layer 2 frame to ports in the set that are also in the port blocking list.

19. The computer program product of claim 18 wherein identifying, based on the layer 2 source address, an I/O port block list includes performing a layer 2 learning phase lookup in a layer 2 forwarding table.

20. The computer program product of claim 18 wherein performing the forwarding phase lookup includes performing a lookup in a layer 2 forwarding table and identifying the set of ports including members of a VLAN corresponding to a VLAN tag in the layer 2 frame.

21. The computer program product of claim 18 wherein performing the forwarding phase lookup includes identifying the packet as a layer 3 multicast packet and performing a lookup in a layer 3 forwarding table to determine the set of layer 2 ports to which the frame should be forwarded.

22. The computer program product of claim 18 wherein performing the forwarding phase lookup includes identifying the frame as a layer 3 unicast frame and performing a lookup in a layer 3 forwarding table to identify the set of ports to which the frame should be forwarded.

23. The computer program product of claim 18 wherein the I/O port block list is represented by a bitmap having bits indicating ports to which the layer 2 frame should not be forwarded, wherein the set of ports identified during the forwarding phase lookup is represented by a bitmap having bits indicating the set of ports to which the layer 2 frame should be forwarded and wherein blocking forwarding of the layer 2 frame to ports in the set that are in the list includes masking the bitmap representing the ports to which the frame should be forwarded using the bitmap representing the I/O port block list.

24. The computer program product of claim 18 wherein the layer 2 frame comprises an Ethernet frame and wherein receiving a layer 2 frame includes receiving the layer 2 frame at an Ethernet switch.

25. The computer program product of claim 18 wherein the layer 2 frame comprises an Ethernet frame with an Internet protocol (IP) payload from wherein receiving a layer 2 frame includes receiving a layer 2 frame at an IP router.