Marked packet forwarding

• US 20080259924A1
• Filed: 04/19/2007
• Published: 10/23/2008
• Est. Priority Date: 04/19/2007
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Albrecht, Alan R., Gooch, Mark, LaVigne, Bruce E., Jorgensen, Steven G.
• Granted Patent: US 7,903,655 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

A network, network devices, and methods are described for marked packet forwarding. A network device includes a network chip having a number of network ports for receiving and transmitting packets. The network chip includes logic to decapsulate a packet received from a tunnel, mark the packet with a handle associated with an originating network device of the packet using information from an encapsulation header, and forward the marked packet to a checking functionality having a destination address different from an original destination address of the packet.

Claims

1. A network device, comprising:

a network chip including a number of network ports for receiving and transmitting packets therefrom, and logic to;

decapsulate a packet received from a tunnel;

mark the packet with a handle associated with an originating network device of the packet using information from an encapsulation header; and

forward the marked packet to a checking functionality having a destination address different from an original destination address of the packet.

2. The network device of claim 1, wherein the network chip includes logic to insert the handle into the packet as a service virtual local area network (VLAN) tag.

3. The network device of claim 1, wherein the network chip includes logic to:

perform a lookup, using the handle to determine an IP address of the packet'"'"'s originating network device;

encapsulate the packet, using the IP address as an IP destination address; and

forward the encapsulated packet to the originating network device.

4. The network device of claim 3, wherein the network chip includes logic to extract a service VLAN tag containing the handle prior to forwarding the encapsulated packet.

5. The network device of claim 3, wherein the network chip includes logic to forward the encapsulated packet using a secure tunnel.

6. The network device of claim 3, wherein the network chip includes logic to recognize the packet being returned from the checking functionality in association with the packet being received to a particular port on the device.

7. The network device of claim 6, wherein the network chip includes logic to ignore the original destination address of the packet upon return from the checking functionality.

8. The network device of claim 1, wherein the network chip includes logic to determine the handle from the generic routing encapsulation (GRE) header portion of the encapsulation header.

9. A network, comprising:

a number of first network devices;

a checking functionality; and

a second network device communicatively coupled to the number of first network devices and the checking functionality, the second network device having a network chip including a number of network ports for receiving and transmitting packets therefrom, and logic to;

ascertain from a packet having an original destination address and an encapsulation header, the identity of the first network device originating the packet'"'"'s encapsulation header;

mark the packet with a handle associated with the originating first network device using information from the encapsulation header; and

forward the packet to the checking functionality notwithstanding the packet'"'"'s original destination address.

10. The network of claim 9, wherein the network chip includes logic operable on a packet returned from the checking functionality to:

perform a lookup, using the handle to determine an IP address of the packet'"'"'s originating first network device;

encapsulate the packet, using the IP address as an IP destination address; and

forward the encapsulated packet to the originating first network device.

11. The network of claim 9, wherein the checking functionality virtualizes its location as being localized to the originating first network device determined from the handle.

12. The network of claim 9, wherein the network chip includes logic to extract the handle from the packet after return from the checking functionality.

13. The network of claim 12, wherein the network chip includes logic to mark the packet with a handle having more than one portion, a first portion corresponding to the packet'"'"'s originating first network device, and a second portion corresponding to other packet-specific information.

14. The network of claim 13, wherein the second portion of the handle corresponds to identifying information associated with the packet'"'"'s initial port of ingress to the originating first network device.

15. A method for packet forwarding, comprising:

receiving on a network device, a packet having a tunnel-encapsulation header;

removing the packet'"'"'s tunnel-encapsulation header;

marking the packet with a handle indicative of the packet'"'"'s originating network device using information from the tunnel-encapsulation header; and

forwarding the marked packet to a checking functionality having a destination address different from an original destination address of the packet.

16. The method recited in claim 15, further comprising:

determining the identity of the packet'"'"'s originating network device corresponding to the handle, after return to the network device from the checking functionality; and

returning the packet to the originating network device.

17. The method recited in claim 16, wherein:

determining the identity includes performing a lookup, using the handle to determine an IP address of the packet'"'"'s originating network device; and

returning the packet includes encapsulating the packet, using the IP address as an IP destination address, and forwarding the encapsulated packet to the IP destination address.

18. The method recited in claim 16, wherein the marked packet is forwarded to the originating network device through a secure virtual tunnel.

19. The method recited in claim 16, further comprising:

receiving the packet at the originating network device; and

forwarding the packet to its original destination address after return of the packet to the originating network device from the checking functionality.

20. The method recited in claim 15, wherein a portion of the handle corresponds to the identity of a port of initial ingress of the packet to the originating network device before being diverted to the checking functionality.