Network packet processing using multi-stage classification

• US 20080205403A1
• Filed: 02/28/2007
• Published: 08/28/2008
• Est. Priority Date: 01/19/2007
• Status: Active Grant

• Current Assignee: Avago Technologies General IP PTE Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Kalkunte, Mohan, Agarwal, Puneet, Baird, Brian, Buduma, Venkateshwar, Akyol, Bora
• Granted Patent: US 7,813,337 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 45/7453 using hashing
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 49/30 Peripheral units, e.g. input or output ports
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for processing packets in data network using multistage classification are disclosed. An example method for processing packets includes receiving a data packet at a first processing stage and examining the packet at the first processing stage to determine a first attribute of the packet. Based on the first attribute, a first classification is assigned to the packet. In the example method, the packet and the first classification are communicated from the first processing stage to a second processing stage and the packet is examined at the second processing stage to determine a second attribute of the packet. Based on the second attribute, a second classification is assigned to the packet. The example method further includes processing the packet based on the first classification and the second classification.

Claims

1. A method comprising:

receiving a data packet at a first processing stage;

examining the packet at the first processing stage to determine a first attribute of the packet;

assigning a first classification to the data packet based on the first attribute;

communicating the packet and the first classification to a second processing stage;

examining the packet at the second processing stage to determine a second attribute of the packet;

assigning a second classification based on the second attribute; and

processing the packet based on the first classification and the second classification.

2. The method of claim 1, wherein examining the packet at the first processing stage and the second processing stage comprises examining an Ethernet header of the packet.

3. The method of claim 1, wherein the first attribute and the second attribute each are selected from the group consisting of an identification of a port on which the packet was received, an Ethernet Media Access Controller (MAC) source address, an Ethernet MAC destination address, an Internet Protocol (IP) source address, an IP destination address, a Virtual LAN tag, and a Multicast Group Identifier.

4. The method of claim 1, wherein processing the packet based on the first classification and the second classification comprises at least one of communicating the packet to a destination address included in the packet, dropping the packet, and communicating the packet to an address other than the destination address.

5. The method of claim 1, wherein the first processing stage and the second processing stage each comprise a lookup table associating the first attribute and the second attribute, respectively, with the first classification and the second classification.

6. The method of claim 1, wherein the first processing stage and the second processing stage each comprises a content-addressable memory (CAM) storing a lookup table, the CAM of the first stage associating the first attribute with the first classification, and the CAM of the second stage associating the second attribute with the second classification.

7. The method of claim 1, wherein receiving the packet comprises receiving the packet from an end user device in a data network.

8. The method of claim 1, further comprising:

communicating the packet to a third processing stage;

examining the packet at the third processing stage to determine a third attribute of the packet;

assigning a third classification based on the third attribute; and

processing the packet based on the first classification, the second classification and the third classification.

9. The method of claim 1, wherein:

the first classification identifies a first group of users in a data network;

the second classification identifies an intended destination for the packet; and

the method further comprises;

implementing a set of packet processing rules for processing the packet based on the first classification and the second classification.

10. The method of claim 9, wherein the set of packet processing rules includes one or more exceptions for a particular user of the first group of users, such that one or more rules of the set of packet processing rules are not applied to data packets associated with the particular user.

11. The method of claim 1, wherein processing the packet based on the first classification and the second classification comprises processing the packet in accordance with a set of packet processing rules implemented in the second processing stage.

12. A data network node comprising:

a first packet processing stage; and

a second packet processing stage operatively coupled with the first processing stage,

wherein the first processing stage is adapted to;

receive a data packet from a data network;

examine the packet to determine a first attribute of the packet;

assign a first classification based on the first attribute; and

communicate the first classification to the second processing stage, and wherein the second processing stage is adapted to;

receive the packet from one of the data network and the first processing stage;

receive the first classification from the first processing stage;

examine the packet to determine a second attribute of the packet;

assign a second classification based on the second attribute; and

process the packet based on the first classification and the second classification.

13. The system of claim 12, wherein the first processing stage comprises a content-addressable memory implementing a lookup table associating the first attribute with the first classification.

14. The system of claim 12, wherein the second processing stage comprises a content-addressable memory implementing a lookup table associating the second attribute with the second classification.

15. The system of claim 12, wherein the second processing stage is further adapted to implement a set of packet processing rules for processing the packet based on the first classification and the second classification.

16. The system of claim 15, wherein the set of packet processing rules includes at least one exception, for one or more particular users of the data network, to one or more rules of the set.

17. The system of claim 12, wherein the second processing stage is further adapted to, when processing the packet, carry out one of communicating the packet to a destination address included in the packet, dropping the packet, and communicating the packet to an address other than the destination address.

18. An Ethernet data packet switch comprising:

a first packet processing stage including a first content-addressable memory (CAM) implementing a first lookup table, the first lookup table associating a first set of packet attributes with a first set of respective classes; and

a second packet processing stage including a second CAM implementing a second lookup table, the second lookup table associating a second set of packet attributes with a second set of respective classes,

wherein the first processing stage is adapted to;

receive a data packet from a data network;

examine the packet to determine a first attribute of the packet, the first attribute being one of the first set of packet attributes;

assign a first classification from the first set of classes based on the first attribute; and

communicate the packet and the first classification to the second processing stage; and

wherein the second processing stage is adapted to;

receive the packet from one of the first processing stage and the data network;

receive the first classification from the first processing stage;

examine the packet to determine a second attribute of the packet, the second attribute being one of the second set of packet attributes;

assign a second classification based on the second attribute; and

process the packet based on the first classification, the second classification and a set of packet processing rules.

19. The Ethernet switch of claim 18, wherein the first and second CAMs comprise ternary CAMs.

20. The Ethernet switch of claim 18, wherein the second processing stage is further adapted to, based on the first classification, the second classification and a set of packet processing rules;

carry out one of communicating the packet to a destination address included in the packet, dropping the packet, and communicating the packet to an address other than the destination address.