PACKET FORWARDING DEVICE WITH PACKET FILTER

• US 20100128729A1
• Filed: 01/27/2010
• Published: 05/27/2010
• Est. Priority Date: 08/26/2005
• Status: Active Grant

• Current Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Original Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Inventors: SHIMOJO, Toshio, YAZAKI, Takeki
• Granted Patent: US 7,894,441 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

To provide a packet forwarding device which minimizes degradation in packet forwarding performance at the time of execution of filtering there is provided a technique in which a destination decision processing unit of a destination decision and filtering unit decides whether to execute filtering on the basis of at least one of an input interface, an input port number, an output interface, and an output port number of an input packet and a plurality of pieces of information constituting the header of the packet. A filtering unit executes filtering only for a packet for which execution of filtering is decided. The packet forwarding device with the destination decision and filtering unit need not execute filtering for all packets and can minimize degradation in packet forwarding performance caused by filtering.

Claims

1. A forwarding device which forwards a packet, comprising:

a packet receiving unit which receives a first packet from a port and specifies input source information of the first packet;

a routing information unit having routing information of address information and first output destination information corresponding to the address information;

a output destination decision unit for searching, based on destination address information included in the first packet, the routing information for first output destination information corresponding to the destination address information;

a filtering decision unit for deciding whether or not to execute filtering to the first packet on the basis of the first output destination information; and

a filtering execution unit for searching, when the filtering decision unit decides to execute filtering to the first packet, based on source address information included in the first packet, the routing information for second output destination information corresponding to the source address information,

wherein the filtering execution unit decides whether or not the second output destination information matches the input source information of the first packet received by the packet receiving unit;

wherein, when the filtering decision unit decides that the second output destination information matches the input source information, the filtering execution unit allows forwarding the first packet, whereas, when the filtering decision unit decides that the second output destination information does not match the input source information, the filtering execution unit discards the first packet.

2. The forwarding device according to claim 1, wherein

the output destination information includes an interface number indicating a network to which the first packet is to be output, an output port number indicating a number of a port to which the first packet is to be output, and at least a part of a next hop address indicating an address of a next forwarding device to which the first packet is to be transmitted.

3. The forwarding device according to claim 1, wherein

the input source information of said receiving unit includes one of an input port number indicating a number of a port from which the first packet is input and an input interface number indicating a number of an interface from which the first packet is input.

4. A forwarding device which forwards a packet, comprising:

a packet receiving unit which receives a first packet from a port and specifies input source information of the first packet;

a routing information unit having routing information of address information and first output destination information corresponding to the address information;

a output destination decision unit for searching, based on destination address information included in the first packet, the routing information for first output destination information corresponding to the destination address information;

a filtering decision unit for deciding whether or not to execute filtering to the first packet on the basis of the input source information of the first packet; and

a filtering execution unit for searching, when the filtering decision unit decides to execute filtering to the first packet, based on source address information included in the first packet, the routing information for second output destination information corresponding to the source address information,

wherein the filtering execution unit decides whether or not the second output destination information matches the input source information of the first packet received by the packet receiving unit;

wherein, when the filtering decision unit decides that the second output destination information matches the input source information, the filtering execution unit allows forwarding the first packet, whereas, when the filtering decision unit decides that the second output destination information does not match the input source information, the filtering execution unit discards the first packet.

5. The forwarding device according to claim 4, wherein

the output destination information includes an interface number indicating a network to which the first packet is to be output, an output port number indicating a number of a port to which the first packet is to be output, and at least a part of a next hop address indicating an address of a next forwarding device to which the first packet is to be transmitted.

6. The forwarding device according to claim 4, wherein

the input source information of said receiving unit includes one of an input port number indicating a number of a port from which the first packet is input and an input interface number indicating a number of an interface from which the first packet is input.