System and method for intercepting packets in a pipeline network processor

• US 7,046,663 B1
• Filed: 08/17/2001
• Issued: 05/16/2006
• Est. Priority Date: 08/17/2001
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Mitchell, Nathan A., Temoshenko, Leo, Nhan, Hugh, King, Robert L., Douglas, Jonathan D., Currie, Douglas W., Parker, Charles M., Everhart, George R.
• Primary Examiner(s): Kizou, Hassan
• Assistant Examiner(s): Cho, Hong Sol
• Application Number:
  US09/932,490
• Time in Patent Office: 1,733 Days
• Field of Search: 370/389, 370/390, 370/392, 379/35, 379/85
• US Class Current: 370/390
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks

Abstract

In a pipeline network processor, a packet intercept feature determines whether a packet is to be intercepted based on the inbound and outbound port through which the packet travels and based on the source and destination of the packet. When a packet enters the pipeline network processor, a determination is made as to whether the inbound and outbound ports are enabled for packet intercept. If so, a source and/or destination media access control address is compared to a list of configured intercept addresses. If a match is found, a copy of the packet is diverted to an intercept receiver and the original packet is forwarded to its intended destination.

Claims

1. A method for intercepting packets in a pipeline network processor, comprising:

receiving an information packet from an inbound port;

determining an outbound port for the information packet;

determining whether the outbound port has been identified for intercept processing;

determining whether the destination has been identified for intercept processing in response to the outbound port being identified for intercept processing;

making a copy of the information packet in response to the destination being identified for intercept processing.

2. The method of claim 1, further comprising:

placing an identity of a destination into the information packet for subsequent determination of intercept processing.

3. The method of claim 1 further comprising:

forwarding the copy of the information packet to an intercept receiver.

4. The method of claim 1, further comprising:

forwarding the information packet to the destination through the destination port.

5. The method of claim 1, further comprising:

forwarding the copy of the information packet to a routing processor for destination routing.

6. The method of claim 1, further comprising:

comparing the destination to a list of reference destinations desired for interception.

7. The method of claim 6, wherein the destination is individually compared to each reference destination with a match is found.

8. The method of claim 7, further comprising:

forwarding the information packet to the destination without copying in response to the destination not matching any of the reference destinations.

9. The method of claim 8, further comprising:

comparing the source to a list of reference sources in order to determine whether the source has been identified for intercept processing.

10. The method of claim 1, further comprising:

determining whether the inbound port has been identified for intercept processing;

determining whether a source of the information packet has been identified for intercept processing in response to the inbound port being identified for intercept processing;

making a copy of the information packet in response to the source being identified for intercept processing.

11. A pipeline network processor implementing code for intercepting packets, the code comprising:

a first set of instructions operable to receive and classify an information packet, the first set of instructions operable to determine whether an inbound port from which the information packet is received has been identified for intercept processing;

a second set of instructions operable to determine an outbound port for routing of the information packet, the second set of instructions operable to determine whether the outbound port has been identified for intercept processing;

a third set of instructions operable to determine whether the packet satisfies input access requirements, the third set of instructions operable to forward the information packet along an intercept path in response to the inbound port being identified for intercept processing, the third set of instructions operable to determine whether a source of the information packet has been identified for intercept processing upon feedback of the information packet on the intercept path, the third set of instructions operable to determine whether the information packet satisfies output access requirements, the third set of instructions operable to forward the information along the intercept path in response to the outbound port being identified for intercept processing, the third set of instructions operable to determine whether a destination of the information packet has been identified for intercept processing upon feedback of the information packet on the intercept path;

a fourth set of instructions operable to set up feedback of the information packet on the intercept path, the fourth set of instructions operable to save appropriate bytes of the information packet to permit feedback processing of the information packet on the intercept path;

a fifth set of instructions operable to place an address of the source of the information packet into a compare area of the information packet, the fifth set of instructions operable to determine an address for the destination of the information packet, the fifth set of instructions operable to place the address of the destination into a compare area of the information packet;

a sixth set of instructions operable to feedback the information to the first set of instructions on the intercept path.

12. The pipeline network processor of claim 11, wherein the third set of instructions is operable to construct a copy of the information packet upon feedback of the information packet on the intercept path in response to either the address of the source or the address of the destination being identified for intercept processing.

13. The pipeline network processor of claim 11, wherein the address of the source and the address of the destination are compared to a configured list of intercept addresses in order to determine whether the information packet is to be intercepted.

14. The pipeline network processor of claim 11, wherein the sixth set of instructions is operable to forward the information packet to the destination upon completion of intercept processing.

15. The pipeline network processor of claim 11, wherein the fifth set of instructions determines the address of the destination from a re-encapsulated Layer 2 header associated with the information packet.

16. A system for intercepting packets, comprising:

a packet interface operable to receive an information packet from a source at an inbound port;

a pipeline network processor operable to forward the information packet to a destination through an outbound port, the pipeline network processor including a plurality of processing columns operable to determine a destination for the information packet, the plurality of processing columns operable to determine whether the source, the inbound port, the outbound port, and the destination are identified for intercept processing, the plurality of processing columns operable to build a copy of the packet in response to the source, the inbound port, the outbound port, or the destination for the information packet being identified for intercept processing;

a route processor operable to configure the pipeline network processor for intercept processing.

17. The system of claim 16, wherein the plurality of processing columns are configured to compare an address for the source and the destination to a configured list of intercept addresses.

18. The system of claim 16, wherein the pipeline network processor is operable to route the copy of the information packet to the route processor for forwarding to an intercept receiver in response to either the source or destination being identified for intercept processing.

19. The system of claim 16, wherein the pipeline processor is operable to forward the copy of the information packet to an intercept receiver in response to the source or destination being identified for intercept processing.

20. The system of claim 16, wherein the pipeline network processor forwards the information packet to the destination.

21. A system for intercepting packets in a pipeline network processor, comprising:

means for receiving an information packet from an inbound port;

means for determining an outbound port for the information packet;

means for determining whether the outbound port has been identified for intercept processing;

means for determining whether the destination has been identified for intercept processing in response to the outbound port being identified for intercept processing;

means for making a copy of the information packet in response to the destination being identified for intercept processing.