System and method for hierarchical metering in a virtual router based network switch

• US 7,161,904 B2
• Filed: 06/04/2002
• Issued: 01/09/2007
• Est. Priority Date: 06/04/2002
• Status: Expired due to Fees

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Fortinet Inc.
• Inventors: Cheng, Joseph, Alam, Naveed, Desai, Sachin, Hussain, Zahid, Millet, Tim
• Primary Examiner(s): Phan, Man U.
• Application Number:
  US10/163,162
• Publication Number:
  US 20030223361A1
• Time in Patent Office: 1,680 Days
• Field of Search: 370230-235, 370238-252, 370386-395, 370429-468, 709220-224, 709236-238
• US Class Current: 370/230
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/11 Identifying congestion

Abstract

A virtual routing platform includes a line interface a plurality of virtual routing engines (VREs) to identify packets of different packet flows and perform a hierarchy of metering including at least first and second levels of metering on the packet flows. A first level of metering may be performed on packets of a first packet flow using a first metering control block (MCB). The first level of metering may be one level of metering in a hierarchy of metering levels. A second level of metering on the packets of the first packet flow and packets of a second flow using a second MCB. The second level of metering may be another level of metering in the hierarchy. A cache-lock may be placed on the appropriate MCB prior to performing the level of metering. The first and second MCBs may be data structures stored in a shared memory of the virtual routing platform. The cache-lock may be released after performing the level of metering using the MCB. The cache-lock may comprise setting a lock-bit of a cache line index in a cache tag store, which may identify a MCB in the cache memory. The virtual routing platform may be a multiprocessor system utilizing a shared memory having a first and second processors to perform levels of metering in parallel. In one embodiment, a virtual routing engine may be shared by a plurality of virtual router contexts running in a memory system of a CPU of the virtual routing engine. In this embodiment, the first packet flow may be associated with one virtual router context and the second packet flow is associated with a second virtual router context. The first and second routing contexts may be of a plurality of virtual router contexts resident in the virtual routing engine.

Claims

1. A method of metering packet flows in a virtual routing engine comprising:

performing a first level of metering on packets of a first packet flow using a first metering control block (MCB), the first level of metering being one level of metering in a hierarchy of metering levels;

performing a second level of metering on the packets of the first packet flow and packets do second packet flow using a second MCB, the second level of metering being another level of metering in the hierarchy, the first and second MCBs being data structures stored in a shared memory of the virtual routing engine;

identifying packets of the first packet how, the first packet flow having the first MCB associated therewith stored in a cache memory;

placing a cache-lock on the first MCB prior to performing the first level of metering;

placing a cache-lock on the second MCB prior to performing the second level of metering of packets of either the first or second packet flow using the second MCB;

releasing the cache-lock on the first MCB after performing the first level of metering on the first packet flow using the first MCB; and

releasing the cache-lock on the second MCB after performing the second level of metering on either the first or second packet flows using the second MCB.

2. The method of claim 1 further comprising performing a first level of metering on packets of the second packet flow using a third MCB prior to performing the second level of metering on packets of the second packet flow, the third MCB being associated with the first level of metering in the hierarchy.

3. The method of claim 2 further comprising placing a cache-lock on the third MCB prior to performing the first level of metering on the packets of the second packet flow using the third MCB.

4. The method of claim 3 further comprising:

retrieving The first MCB from memory prior to placing the cachet-lock on the first MCB;

retrieving the second MCB from memory prior to placing the cache-lock on the second MCB;

retrieving the third MCB from memory prior to placing the cache-lock on the third MCB; and

releasing the cache-lock on the third MCB after performing the first level of metering on packets of the second packet flow using the thud MCB.

5. The method of claim 1 wherein placing the cache-lock on the first MCB comprises setting a clock-bit of a first cache line index in a cache tag store, the first cache line index identifying the first MCB in the cache memory.

6. The method of claim 1 wherein the virtual muting engine comprises a multiprocessor system utilizing a shared memory and wherein a first processor performs the first level of metering for the first packet flow and a second processor performs a first level of metering for the second packet flow, the first and second MCBs being stared in a memory shared by the first and second processors.

7. The method of claim 6 wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of a central processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual router context, the first and second routing con texts being of a plurality of virtual router contexts resident in the virtual routing engine.

8. The method of claim 7 wherein the fast level of metering for the first packet flow is performed concurrently with the first level of metering for the second packet flow as part of a parallel processing operation.

9. The method of claim 1 wherein performing the first level of metering comprises:

measuring a packet rate of the first packet flow against a first set of rate parameters established for the first packet flew and stored in the first MCB; and

marking packets of the first packet flow in accordance with a result of the measuring,

and wherein performing the second level of metering comprises;

measuring packet rates of both the first and second packet flows against a second set of rate parameters established for the second level of metering end stored in the second MCB;

dropping packets of both the first and second packet flows when packets of the find or second packet flows together exceed at least one of the parameters of the second set; and

refraining from dropping packets of the first packet flow when packets of the first packet flow exceed rate parameters of the first set and when packets of the first or second packet flows together do not exceed the at least one of the parameters of the second set.

10. The method of claim 9 wherein the rate parameters of the first and second set include at least one of either a peak information rate (PIR) or a committed information, rate (CIR) established for the associated packet flow, anti wherein measuring comprises removing tokens from a taken bucket established based on the measured packet rate, the token bucket having a size based on one of either the PIR or CIR for the associated packet flow.

11. The method of claim 1 further comprising:

identifying packet;

of the first and second packet flows that support a service;

performing a third level of metering on packets identified as supporting the service, wherein the service comprises one or more of IP security (IPSec) packets, ACL packets, and video packets.

12. The method of claim 1 further comprising identifying packets of the first packet flow by performing a hash on a received packet to determine an index corresponding with a flow classification block for the first packet flow.

13. A method of metering packet flows in a virtual routing engine comprising;

performing a first level of metering on packets of a first packet flow using a first metering control block (MCB), the first level of metering being one level of metering in a hierarchy of metering levels;

performing a second level of metering on the packets of the first packet flow and packets of a second packet flow using a second MCB, the second level of meeting being another level of metering in the hierarchy;

performing a first keel of metering on packets of the second packet flow using a third MCB prior to performing the second level of metering on packets of the second packet flow, the third MCB being associated with the first level of metering in the hierarchy;

placing a cache-lock on the third MCB prior to performing the first level of metering on the packets of the second packet flow using the third MCB;

retrieving the first MCB from memory prior to placing the cache-lock on the first MCB;

retrieving the second MCB from memory prior to placing the cache-lock on the second MCB;

retrieving the third MCB from memory prior to placing the cache-lock on the third MCB; and

releasing the cache-lock on the third MCB after performing the first level of metering on packets of the second packet flow using the third MCB.

14. The method of claim 13, further comprising:

identifying packets of the first packet flow, the first packet flow having the first MCB associated therewith stored in a cache memory; and

placing a cache lock on the first MCB prior to performing the first level of metering.

15. The method of claim 14, wherein the first and send MCBs are data structures stored in a shared memory of the virtual routing engine, and where the method further comprises placing a cache-lock on the second MCB prior to performing the second level of metering of packets of either the first or second packet flow using the second MCB.

17. The method of claim 14, wherein placing the cache-lock on the first MCB comprises setting a clock-bit of a first cache line index in a cache tag store, the first cache line index identifying the first MCB in the cache memory.

18. The method of claim 13, wherein the virtual routing engine is a multiprocessor system utilizing a shared memory, and wherein a first processor performs the first level of metering for the first packet flow and a second processor performs a first level of metering for the second packet flow, the first and second MCBs being stored in a memory shared by the first and second processors.

19. The method of claim 18, wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of a central processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual router context, the first and second routing contexts being of a plurality of virtual router contexts resident in the virtual routing engine.

20. The method of claim 19, wherein the first level of metering for the first packet flow is performed concurrently with the first level of metering for the second packet flow as part of a parallel processing operation.

21. The method of claim 13, wherein performing the first level of metering comprises:

measuring a packet rate of the first packet flow against a first set of rate parameters established for the first packet flow and stored in the first MCB; and

marking packets of the first packet flow in accordance with a result of the measuring,

and wherein performing the second level of metering comprises;

measuring packet rates of both the first and second packet flows against a second set of rate parameters established for the second level of metering and stored in the second MCB;

dropping packets of both the first and second packet flows when packets of the first or second packet flows together exceed at least one of the parameters of the second set; and

refraining from dropping packets of the first packet flow when packets of the first packet flow exceed rate parameters of the first set and when packets of the first or second packet flows together do not exceed the at least one of the parameters of the second set.

22. The method of claims 21, wherein the rate parameters of the first and second set include at least one of either a peak information rate (PIR) or a committed information rate (CIR) established for the associated packet flow, and wherein measuring comprises removing tokens from a token bucket established based on the measured packet rate, the token bucket having a size based on one of either the PIR or CIR for the associated packet flow.

23. The method of claim 13, further comprising:

identifying packets of the first and second packet flows that support a service;

performing a third level of metering on packets identified as supporting the service, wherein the service comprises one or more of IP security (IPSec) packets, ACL packets, and video packets.

24. The method of claim 13, further comprising identifying packets of the first packet flow by performing a hash on a received packet to determine an index corresponding with a flow classification block for the first packet flow.

16. The method of claim further comprising:

releasing the cache-lock on the first MCB after performing the first level of metering on the first packet flow using the first MCB; and

releasing the cache-lock on the second MCB after performing the second level of metering on either the first or second packet flows using the second MCB.

25. A method of metering packet flows in a virtual routing engine comprising:

performing a first level of metering on packets of a first packet flow using a first metering control block (MCB), the first level of metering being one level of metering in a hierarchy of metering levels;

performing a second level of metering on the packets of the first packet flow and packets of a second packet flow using a second MCB, the second level of metering being another level of metering in the hierarchy;

measuring a packet rate of the first packet flow against a first set of rate parameters established for the first packet flow and stored in the first MCB; and

marking packets of the first packet flow in accordance with a result of the measuring,

and wherein performing the second level of meeting comprises;

measuring packet rates of both the first and second packet flows against a second set of rate parameters established for the second level of metering and stored in the second MCB;

dropping packets of both the first and second packet flows when packets of the first or second packet flows together exceed at least one of the parameters of the second set; and

refraining from dropping packets of the first packet flow when packets of the first packet flow exceed rate parameters of the fast set and when packets of the first or second packet flows together do not exceed the at least one of the parameters of the seemed set.

26. The method of claim 25, further comprising:

identifying packets of the first packet flow, the first packet flow having the first MCB associated therewith stored in a cache memory; and

placing a cache-lock on the first MCB prior to performing the first level of metering.

27. The method of claim 26, wherein the first and second MCBs are data structures stored in a shared memory of the virtual routing engine, and where the method further comprises placing a cache-lock on the second MCB prior to performing the second level of metering of packets of either the first or second packet flow using the second MCB.

28. The method of claim 27, further comprising;

releasing the cache-leek on the first MCB after performing the first level of metering on the first packet flow using the first MCB; and

releasing the cache-lock on the second MCB after performing the second level of metering on either the first or second packet flows using the second MCB.

29. The method of claim 25, further comprising performing a first level of metering on packets of the second packet flow using a third MCB prior to performing the second level of metering on packets of the second packet flow, the third MCB being associated with the first level of metering in the hierarchy.

30. The method of claim 29, further comprising placing a cache-lock on the third MCB prior to performing the first level of metering on the packets of the second packet flow using the third MCB.

31. The method of claim 30, further comprising:

retrieving the first MCB from memory prior to placing the cache-lock on the first MCB;

retrieving the second MCB from memory prior to placing the cache-lock on the second MCB;

retrieving the third MCB from memory prior to placing the cache-lock on the third MCB; and

releasing the cache-lack on the third MCB after performing the first level of metering on packets of the second packet flow using the third MCB.

32. The method of claim 26, wherein placing the cache-lock on the first MCB comprises setting a clock-bit of a first cache line index in a cache tag store, the first cache line index identifying the first MCB in the cache memory.

33. The method of claim 25, wherein the virtual routing engine is a multiprocessor system utilizing a shared memory, and wherein a first processor performs the first level of metering for the first packet flow and a second processor performs a first level of metering for the second packet flow, the first and second MCBs being stored in a memory shared by the first and second processors.

34. The method of claim 33, wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of a central processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual router context the first and second routing contexts being of a plurality of virtual router contexts resident in the virtual routing engine.

35. The method of claim 34, wherein the first level of metering for the first packet flow is performed concurrently with the first level of metering for the second packet flow as part of a parallel processing operation.

36. The method of claim 25, further comprising:

identifying packets of the first and second packet flows that support a service;

performing a third level of metering on packets identified as supporting the service, wherein the service comprises one or more of IP security (IPSec) packets, ACL packets, and video packets.

37. The method of claim 25, further comprising identifying packets of the first packet flow by performing a hash on a received packet to determine an index corresponding with a flow classification block for the first packet flow.

38. A virtual routing engine comprising:

a plurality of multiprocessor systems;

a line interface to receive packets of a plurality of packet flows; and

a switching fabric coupling the plurality of multiprocessor systems and the line interface, wherein

the line interface selects one of the multiprocessor systems for a first packet flow and directs packets through the switching fabric to the selected multiprocessor system,

the selected multiprocessor system performs a first level of metering on packets of the first packet flow using a first metering control block (MCB), the first level of metering being one level of metering in a hierarchy of metering levels, and performs a second level of metering on the packets of the first packet flow and packets of a second packet flow using a second MCB, the second level of metering being another level of metering in the hierarchy,

the selected multiprocessor system performs a first level of metering on packets of the second packet flow using a third MCB prior to performing the second level of metering on packets of the second packet flow, the third MCB being associated with the first level of metering in the hierarchy,

the first and second MCBs are data structures stored in a shared memory of the selected multiprocessor system, and

the selected multiprocessor system places a cache-lock on the first MCB prior to performing the first level of metering, places a cache-lock on the second MCB prior to performing the second level of metering of packets of either the first or second flow using the second MCB, releases the cache-lock on the first MCB after performing the first level of metering on the first packet flow using the first MCB, and releases the cache-lock on the second MCB after performing the second level of metering on either the first or second packet flows using the second MCB.

39. The virtual routing engine of claim 38, wherein a first processor performs the first level of metering of the first packet flow and a second processor performs a first level of metering on the second packet flow, wherein the first level of metering for the first packet flow is performed concurrently with the first level of metering for the second packet flow as part of a parallel processing operation, and

wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of a wand processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual router context, the first and second routing contexts being of a plurality of virtual router contexts resident in the virtual routing engine.

40. The virtual routing engine of claim 38, wherein the first level of metering comprises measuring a packet rate of the first packet against a first set of rate parameters established for the first packet flow and stored in the first MCB, and marking packets of the first packet flow in accordance with a result of the measuring,

and wherein performing the second level of metering comprises measuring packet rates of both the first and second packet flows against a second set of rate parameters established for the second level of metering and stored in the second MCB, dropping packets of both the first and second packet flows where packets of the first or second packet flows together exceed at least one of the parameters of the second set, and refraining from dropping packets of the first packet flow when packets of the first packet flow exceed rate parameters of the first set and when packets of the first or second packet flows together do not exceed the at least one of the parameters of the second set.

41. A virtual routing engine comprising:

a plurality of multiprocessor systems;

a line interface to receive packets of a plurality of packet flows; and

a switching fabric coupling the plurality of multiprocessor systems and the line interface, wherein

the line interface selects one of the multiprocessor systems for a first packet flow and directs packets through the switching fabric to the selected multiprocessor system,

the selected multiprocessor system performs a first level of metering on packets of the first packet flow using a first metering control block (MCB), the first level of metering being one level of metering in a hierarchy of metering levels, and performs a second level of metering on the packets of the fist packet flow and packets of a second packet flow using a second MCB, the second level of metering being another level of metering in the hierarchy,

the selected multiprocessor system performs a first level of metering on packets of the second packet flow using a third MCB prior to performing the second level of metering on packets of the second packet flow, the third MCB being associated with the first level of metering in the hierarchy,

a first processor performs the first level of metering of the first packet flow and a second processor performs a first level of metering on the second packet flow, wherein the first level of metering for the first packet now is performed concurrently with the first level of metering for second packet flow as part of a parallel processing operation, and

the virtual routing engine is shared by a plurality of virtual router contents running in a memory system of a central processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual router context, the first and second routing contexts being of a plurality of virtual router contexts resident in the virtual routing engine.

42. The virtual routing engine of claim 41, wherein the first and second MCBs are data structures stored in a shared memory of the selected multiprocessor system, and wherein the selected multiprocessor system places a cache-lock on the fret MCB prior to performing the first level of metering, places a cache-lock on the second MCB prior to performing the second level of metering of packets of either the first or second packet flow using the second MCB, releases the cache-lock on the first MCB after performing the first level of metering on the first packet flow using the first MCB, and releases the cache-lock on the second MCB after performing the second level of metering on either the first or second packet flows using the second MCB.

43. The virtual routing engine of claim 41, wherein the first level of metering comprises measuring a packet rate of the first packet flow against a first set of rate parameters established for the first packet flow and stored in the first MCB, and marking packets of the first packet flow in accordance with a result of the measuring,

and wherein performing the second level of metering comprises measuring packet rates of both the first and second packet flows against a second set of rate parameters established for the second level of metering and stored in the second MCB, dropping packets of both the first and second packet flows where packets of the first or second packet flows together exceed at least one of the parameters of the second set, and refraining from dropping packets of the first packet flow when packets of the first packet flow exceed rate parameters of the first set and when packets of the first or second packet flows together do not exceed the at least one of the parameters of the second set.

44. A method of metering packets in a virtual routing engine comprising:

performing a first level of metering for packets of a first packet flow;

performing a different first level of metering for packets of a second packet flow;

performing a second level of metering for packets of the first and second packet flows, the second level of metering applying to both the first and second packet flows;

identifying the first and second packet flows for received packets;

performing ingress metering on the packets based on a virtual interface from where the packets are received;

transforming a header of the packets;

performing egress metering on the packets subsequent to transforming the header, wherein the egress metering comprises performing the first and second levels of metering; and

wherein the virtual routing engine comprises a multiprocessor system utilizing a shared memory, and wherein a first processor performs the first level of metering for the first packet flow and a second processor performs a that level of metering for the second packet flow, the first and second MCBs being stored in a memory shared by the first and second processors, and

wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of a central processing unit (CPU) of the virtual touting engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual context, the first and second routing contexts being of a plurality of virtual muter contexts resident in the virtual routing engine.

45. The method of claim 44, wherein the first level of metering includes applying a first set of individual level traffic parameters for the first packet flow to determine when the first packet flow exceeds a first profile, and

wherein the different first level of metering includes applying a second set of individual level traffic parameters for the second packet flow to determine when the second packet flow exceeds a second profile,

and wherein the second level of metering includes applying a set of group level traffic parameters for at least both the first and second packet flows to determine when the first and second packet flows together exceed a group profile.

46. The method of claim 45, wherein the individual level of traffic parameters of the first and second sets and the group level traffic parameters are comprised of a peak information rate (PIR) and a committed information rate (CIR).

47. The method of claim 46, further comprising:

dropping packets of the first packet flow when one or more of the individual level traffic parameters of the first set is exceeded and when one or more of the group level traffic parameters is exceeded;

dropping packets of the second packet flow when one or more of the individual level traffic parameters of the second set is exceeded and when one or more of the group level traffic parameters is exceeded; and

refraining from dropping packets of the first and second packet flows when none of the group level traffic parameters are exceeded.

48. The method of claim 45, further comprising refraining from dropping packets of the first and second packet flows when bandwidth of an external network is available.

49. The method of claim 48 wherein:

applying the first set of individual level traffic parameters includes marking a field in a packet header of packets of the first packet flow to indicate whether either a peak information rate (PIR) or a committed information rate (CIR) associated with the first profile is exceeded,

applying the second set of individual level traffic parameters includes marking a field in a packet header of packets of the second packet flow to indicate whether either the PRI or CIR for the second profile is exceeded, and

applying the group level traffic parameters includes marking a field in a packet header of packets of the first and second packet flows to indicate whether either the PIR or CIR for the group profile is exceeded.

50. The method of claim 49, wherein a packet of the first packet flow has a first number of bytes, and wherein applying the first set of individual level traffic parameters includes subtracting the first number of bytes from a token bucket maintained for the first packet flow,

wherein a packet of the second packet flow has a second number of bytes, and wherein applying the second set of individual level traffic parameters includes subtracting the second number of bytes from a token bucket maintained for the second packet flow,

and wherein applying the group level traffic parameters includes subtracting a sum of the first and second number of bytes from a token bucket maintained for the group profile.

51. The method of claim 44, wherein identifying the first and second packet flows comprises performing a hash on a received packet to generate an index corresponding with a flow classification block (FCB), the FCB defining either the first or second packet flow for associated packets.

52. A method of metering packets in a virtual routing engine comprising:

performing a first level of metering for packets of a first packet flow;

performing a different first level of metering for packets of a second packet flow;

performing a second level of metering for packets of the first and second packet flows, the second level of metering applying to both the first and second packet flows;

dropping packets of the first packet flow when one or more of the individual level traffic parameters of the first set is exceeded and when one or more of the group level traffic parameters is exceeded;

dropping packets of the second packet flow when one or more of the individual level traffic parameters of the second set is exceeded and when one or more of the group level traffic parameters is exceeded; and

refraining from dropping packets of the first and second packet flows when none of the group level traffic parameters are exceeded; and

wherein

the first level of metering includes applying a first set of individual level traffic parameters for the first packet now to determine when the first packet flow exceeds a first profile,

the different first level of metering includes applying a second set of individual level traffic parameters for the second packet flow to determine when the second packet flow exceeds a second profile,

the second level of metering includes applying a set of group level traffic parameters for at least both the first and second packet flows to determine when the first and second packet flaws together exceed a group profile, and

the individual level traffic parameters of the first and second sets and the group level traffic parameters are comprised of a peak information rate (PIR) and a committed information rate (CIR).

53. The method of claim 52, further comprising refraining from dropping packets of the first and second packet flows when bandwidth of an external network is available.

54. The method of claim 52, wherein:

applying the first set of individual level traffic parameters includes marking a field in a packet header of packets of the first packet flow to indicate whether either a peak information rate (PIR) or a committed information rate (CIR) associated with the first profile is exceeded,

applying the second set of individual level traffic parameters includes marking a field in a packet header of packets of the second packet flow to indicate whether either the PRI or CIR for the second profile is exceeded, and

applying the group level traffic parameters includes marking a field in a packet header of packets of the first and second packet flows to indicate whether either the PIR or CIR for the group profile is exceeded.

55. The method of claim 54, wherein a packet of the first packet flow has a first number of bytes, and wherein applying the first set of individual level traffic parameters includes subtracting the first number of bytes from a token bucket maintained for the first packet flow,

wherein a packet of the second packet flow has a second number of bytes, and wherein applying the second set of individual level traffic parameters includes subtracting the second number of bytes from a token bucket maintained for the second packet flow,

and wherein applying the group level traffic parameters includes subtracting a sum of the first and second number of bytes from a token bucket maintained for the group profile.

56. The method of claim 52, further comprising:

identifying the first and second packet flows for received packets;

performing ingress metering on the packets based on a virtual interface from where the packets are received;

transforming a header of the packets; and

performing egress metering on the packets subsequent to transforming the header, wherein the egress metering comprises performing the first and second levels of metering.

57. The method of claim 56, wherein identifying the first and second packet flows comprises performing a hash on a received packet to generate an index corresponding with a flow classification block (FCB), the FCB defining either the first or second packet flow or associated packets.

58. The method of clams 56, wherein the virtual routing engine is a multiprocessor system utilizing a shared memory, and wherein a first processor performs the first level of metering for the first packet flow and a second processor performs a first level of metering for the second packet flow, the first and second MCBs being stored in a memory shared by the first and second processors,

and wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of a central processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual context, the first and second routing contexts being of a plurality of virtual router contexts resident in the virtual routing engine.

59. A method of metering packets in a virtual routing engine comprising:

performing a first level of metering for packets of a first packet flow, the first level of metering including applying a first set of individual level traffic parameters for the first packet flew to determine when the first packet flow exceeds a first profile;

performing a different first level of metering for packets of a second packet flow, the different first level of metering including applying a second set of individual level traffic parameters for the second packet flow to determine when the second packet flow exceeds a second profile;

performing a second level of metering for packets of the first and second packet flows, the wend level of metering applying to both the first and second packet flow, the second level of metering including applying a set of group level traffic parameters for at least both the first and second packet flows to determine when the first and second packet flows together exceed a group profile; and

wherein

a packet of the first packet flow has a first number of bytes, and wherein applying the first Set of individual level traffic parameters includes subtracting the first number of bytes from a token bucket maintained for the first packet flow,

a packet of the second packet flow has a second number of bytes,

applying the first set of individual level traffic parameters includes marking a field in a packet header of packets of the first packet flow to indicate whether either a peak information rate (PIR) or a committed information rate (CIR) associated with the first profile is exceeded,

applying the first set of individual level traffic parameters includes marking a field in a packet header of packets of the second packet flow to indicate whether either the PRI or CIR for the second profile is exceeded and subtracting the second number of bytes from a token bucket maintained for the second packet flow, and

applying the group level traffic parameter includes marking a field in a packet header of packets of the first and second packet flows to indicate whether either the PIR or CIR for the group profile is exceeded and subtracting a sum of the first and second number of bytes from a token bucket maintained for the group profile.

60. The method of claim 59, further comprising:

identifying the first and second packet flows for received packets;

performing ingress metering on the packets based on a virtual interface from where the packets are received;

transforming a header of the packets; and

performing egress metering on the packets subsequent to transforming the header, wherein the egress metering comprises performing the first and second levels of metering.

61. The method of claim 59, wherein the first level of metering includes applying a first set of individual level traffic parameters for the first packet flow to determine when the first packet flow exceeds a first profile;

and

wherein the different first level of metering includes applying a second set of individual level traffic parameters for the second packet flow to determine when the second packet flow exceeds a second profile,

and wherein the second level of metering includes applying a set of group level traffic parameters for at least both the first and second packet flows to determine when the first and second packet flows together exceed a group profile.

62. The method of claim 61, wherein the individual level traffic parameters of the first and second sets and the group level traffic parameters are comprised of a peak information rate (PIR) and a committed information rate (CIR).

63. The method of claim 62, further comprising:

dropping packets of the first packet flow when one or more of the individual level traffic parameters of the fun set is exceeded and when one or more of the group level traffic parameters is exceeded;

dropping packets of the second packet flow when one or more of the individual level traffic parameters of the second set is exceeded and when one or more of the group level traffic parameters is exceeded; and

refraining from dropping packets of the first and second packet flows when none of the group level traffic parameters are exceeded.

64. The method of claim 63, further comprising refraining from dropping packets of the first and second packet flown when bandwidth of an external network is available.

65. The method of claim 60, wherein identifying the first and packet flown comprises performing a hash on a received packet to generate an index corresponding with a flow classification block (FCB), the FCB defining either the first or second packet flow for associated packets.

66. The method of claim 60, wherein the virtual routing engine is a multiprocessor system utilizing a shared memory, and wherein a first processor performs the first lever of metering for the first packet flow and a second processor performs a find level of metering for the second packet flow, the first and second MCBs being stored in a memory shared by the first and second processors,

and wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of a central processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual context, the first and second routing contexts being of a plurality of virtual muter contexts resident in the virtual routing engine.

67. A routing system comprising:

a line interface to receive packets of first and second packet flows;

a virtual routing engine (VRE) to perform metering on packets of the first and second packet flows, and to transform headers of the packets, the VRE performing a first level of metering for packets of the first packet flow, a different first level of, metering for packets of a second packet flow, and a second level of metering far packets of the first and second flows, the second level of metering applying to both the first and second packet flows; and

wherein

the VRE being one of a plurality of VREs, and

the routing system including a switching fabric coupling the line interface and the plurality of VREs, the line interface identifying one of the VREs to process packets of the first packet flow based on a physical interface and virtual channel from which the packets of the first packet flow were received, the identified VRE to perform metering, and header transformation for packets of the first and second packet flows.

68. The system of claim 67, wherein the virtual routing engine comprises a multiprocessor system utilizing a shared memory, and wherein a first processor performs the first level of metering for the first packet flow and a second processor performs a first level of metering for the second packet flow, the first and second MCBs being stored in a memory shared by the first and second processors,

and wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of a central processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual router context, the first and second routing contexts being of a plurality of virtual router contexts resident in the virtual routing engine.

69. The system of claim 68, wherein the VRE identifies the first and second packet flows for received packets, performs ingress metering on the packets heed on a virtual interface from where the packets are received, transforms a header of the packets, and performs egress metering on the packets subsequent to transforming the header.

70. The system of claim 67, further comprising a hierarchy of metering control blocks to be utilized by the VRE in performing different levels of metering.

71. The system of claim 67, wherein:

for the first level of metering, the VRE applies a first set of individual level traffic parameters for the first packet flow to determine when the first packet flow exceeds a first profile, end

for the different first level of metering, the VRE applies a second set of individual level traffic parameters for the second packet flow to determine when the second packet flow exceeds a second profile, and

for the second level of metering, the VRE applies a set of group level traffic parameters for at least both the first and second packet flows to determine when the first and second packet flows together exceed a group profile.

72. The system of claim 71, wherein the individual level traffic parameters on the first and second sets and the group level traffic parameters are comprised of a peak information rate (PIR) and a committed information rate (CIR).

73. The system of claim 71, wherein the VRE drops packets of the first packet flow when one or more of the individual level traffic parameters of the first set is exceeded and when one of the group level traffic parameters is exceeded, drops packets of the second packet flow when one or more of the individual level traffic parameters of the second exceeded and when or more of the group level traffic parameters is exceeded, and refrains from dropping packets of the first and second packet flows when none of the group level traffic parameters are exceeded.

74. The system of claim 73, wherein the VRE refrains from dropping packets of the first and second packet flows when bandwidth of an external network is mailable to support a rate of the first and second packet flows.

75. The system of claim 71 wherein:

the VRE marks a field, in a packet header of packets of the first packet flow to indicate whether either a peak information rate (PIR) or a committed information rate (CIR) associated with first profile Is exceeded,

the VRE marks a filed in a packet header of packets of the second packet flow to indicate whether either the PIR or CIR associated with the second profile is exceeded, and

the VRE marks a field in a packet header of packers of the first and second packet flows to indicate whether either the PIR or CIR associated with the map profile is exceeded.

76. The system of claim 75, wherein a packet of the first packet flow has a first number of bytes, and wherein the VRE subtracts the first number of bytes from a token bucket maintained for the first packet flow,

wherein a packet of the second packet flow has a second number of bytes, and wherein the VRE subtracts the second number of bytes from a token bucket maintained for the second packet flow,

and wherein the VRE subtracts a sum of the first and woad number of bytes from a token bucket maintained for the group profile.

77. The system of claim 76, wherein the VRE identifies the first and second packet flows by performing a bash on a received packet to generate an index corresponding with a flow classification block (FCB), the FCB defining either the first or second packet flow for associated packets.

78. A routing system comprising:

a line interface to receive packets of first and second packet flows;

a virtual routing engine (VRE) to perform metering on packets of the first and second packet flows, and to transform headers of the packets,

the VRE performing a first level of metering for packets of the first packet flow, a different that level of metering for packets of a second packet flow, and a second level of metering for packets of the first and second packet flows, the second level of metering applying to both the first and second packet flows; and

wherein

for the first level of metering, the VRE applies a first set of individual level traffic parameters for the first packet flow to determine when the first packet flow exceeds a first profile,

for the different first level of metering, the VRE applies a second set of individual level traffic parameters for the second packet flow to determine when the second packet flow exceeds a second profile,

for the set and level of metering, the VRE applies a set of group level traffic parameters for at least both the first and second packet flows to determine when the first and second packet flows together exceed a group profile, and

the VRE drops packets of the first packet flow when one or more of the individual level traffic parameters of the first set is exceeded and when one of the group level traffic parameters is exceeded, drops packets of the second packet flow when one or more of the individual level traffic parameters of tie second set is exceeded and when or more of the group level traffic parameters is exceeded, and refrains from dropping packets of the first and second packet flows when none of the group level traffic parameters are exceeded.

79. The system of claim 78, wherein the VRE one of a plurality of VREs, and the routing system further comprises a switching fabric coupling the line interface and the plurality of VREs, the line interface identifying one of the VREs to process packets of the first packet flow based on a physical interface and virtual channel from which the packets of the first packet flow were received, the identified VRE to perform metering, and header transformation for packets of the first and second packet flows.

80. The system of claim 78, further comprising a hierarchy of metering control blocks to be utilized by the VRE in performing different levels of metering.

81. The system of claim 79, wherein the virtual routing engine comprises a multiprocessor system utilizing a shared memory, and wherein a first processor performs the first level of metering for the first packet flow and a second processor performs the first level of mewing for the second packet flow, the first and second MCBs being stored in a memory shared by the first and second processors,

and wherein the virtual routing engine is shared by a plurality of virtual tauter contexts naming in a memory system of a central processing unit (CPU) oleic virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual router context, the first and second routing contexts being of a plurality of virtual router contexts resident in the virtual routing engine.

82. The system of claim 81, wherein the VRE identifies the first and second packet flows for received packets, performs ingress metering on packets based on a virtual interface from where the packets are received, transforms a header of the packets, and performs egress metering on the packets subsequent to transforming the header.

83. The system of claim 78, wherein the individual level traffic parameters on the first and second sets and the group level traffic parameters are comprised of a peak information rate (PIR) and a committed information rate (CIR).

84. The system of claim 78, wherein the VRE refrains from dropping packets of the first and second packet flows when bandwidth of an external network is available to support a rate of the first and second packet flows.

85. The system of claim 78, wherein:

the VRE marks a field in a packet header of packets of the first packet flow to indicate whether either a peak information rate (PIR) or a committed information rate (CIR) associated with first profile is exceeded,

the VRE marks a filed in a packet bender of packets of the second packet flow to indicate whether either the PIR or CIR associated with the second profile is exceeded, and

the VRE marks a field in a packet header of packers of the first and second packet flows to indicate whether either the PIR or CIR associated with the group profile is exceeded.

86. The system of claim 85, wherein a packet of the first packet flow has a first number of bytes, and wherein the VRE subtracts the first number of bytes from a token bucket maintained for the first packet flow,

wherein a packet of the second packet flow has a second number of bytes, and wherein the VRE subtracts the second number of bytes from a token bucket maintained for the second packet flow,

and wherein the VRE subtracts a sure of the first and second number of bytes from a token bucket maintained for the group profile.

87. The system of claim 86, wherein the VRE identifies the first and second packet flows by performing a hash on a received packet to generate an index corresponding with a flow classification block (FCB), the FCB defining either the first or second packet flaw for associated packets.

88. A routing system comprising:

a line interface to receive packets of first and second packet flows;

a virtual routing engine (VRE) to perform metering on packets of the first and second packet flows, and to transform headers of the packets, the VRE performing a first level of metering for packets of the first packet flow, a different first level of metering for packets of a second packet flow, and a second level of metering for packets of the first and second packet flows, the second level of metering applying to both the firm and second packet flows; and

wherein

for the first level of metering, the VRE applies a first set of individual level traffic parameters for the first packet flow to determine when the first packet flow exceeds a first profile,

for the different first level of metering, the VRE applies a second set of individual level traffic parameters for the second packet flow to determine when the second packet flow exceeds a second profile,

for the second level of metering, the VRE applies a set of group level traffic parameters for at least both the first and second packet flows to determine when the first and second packet flows together exceed a group profile,

the VRE marks a field in a packet header of packets of the first packet flow to indicate whether either a peak information rate (PIR) or a committed information rate (CIR) associated with first profile is exceeded,

the VRE marks a filed in a packet header of packets of the second packet flow to indicate whether either the PIR or CIR associated with the second profile is exceeded,

the VRE marks a field in a packet header of packers of the first and second packet flows to indicate whether either the PIR or CIR associated with the group profile is exceeded,

a packet of the first packet flow has a first number of bytes, and wherein the VRE subtracts the first number of bytes from a token bucket maintained for the first packet flow,

a packet of the second packet flow has a second number of bytes, and wherein the VRE subtracts the second number of bytes from a token bucket maintained for the second packet flow, and

the VRE subtracts a sum of the first and second number of bytes from a token bucket maintained for the group profile.

89. The system of claim 88, wherein the VRE one of a plurality of VREs, and the routing system further comprises a switching fabric coupling the line interface and the plurality of VREs, the line interface identifying one of the VREs to process packet of the first packet flow based on a physical interface and virtual channel from which the packets of the first packet flow were received, the identified VRE to perform metering, and header transformation for packets of the first and second packet flows.

90. The system of claim 88,further comprising a hierarchy of metering control blocks to be utilized by the VRE in performing different levels of metering.

91. The system of claim 89, wherein the virtual routing engine comprises a multiprocessor system utilizing a shared memory, and wherein a first processor performs the first level of metering for the first packet flow and a second processor performs a first level of metering for the second packet flow, the first and second MCBs being stored in a memory shared by the first and second processors,

and wherein the virtual routing engine is shared by a plurality of virtual router contexts running in a memory system of central processing unit (CPU) of the virtual routing engine, and wherein the first packet flow is associated with one virtual router context and the second packet flow is associated with a second virtual router context, the first and second routing contexts being of a plurality of virtual router contexts resident in the virtual routing engine.

92. The system of claim 91, wherein the VREs identifies the first and second packet flows for received packets, performs ingress metering on the packets based on a virtual interface from where the packets are received, transform a header of the packets, and performs even metering on the packets subsequent to transforming the header.

93. The system of claim 88, wherein the individual level traffic parameters on the first and second sets and the group level traffic parameters are comprised of a peak information rate (PIR) and a committed information rate (PIR).

94. The system of claim 88, wherein the VRE drops packets of the first packet flow when one or more of the individual level traffic parameters of the first set is exceeded and when one of the group level traffic parameters is exceeded, drops packets of the second packet flow when one or more of the individual level traffic parameters of the second set is exceeded and when or more of the group level traffic parameters is exceeded, and refrains front dropping packets of the first and second packet flows when none of the group level traffic parameters are exceeded.

95. The system of claim 94, wherein the VRE refrains from dropping packets of the first and second packet flows when bandwidth of an external network is available to support a rate of the first and second packet flows.

96. The system of claim 88, wherein the VRE identifies the first and second packet flows by performing a hash on a received packet to generate an index corresponding with a flow classification block (FCB), the FCB defining either the first or second packet flow for associated packets.

97. A program on a computer readable medium having stored thereon instructions, which when executed by a computing platform result in;

performing a first level of metering for packets of a first packet flow;

performing a different first level of metering for packets of a second packet flow;

performing a second level of metering for packets of the first and second packet flows, the second level of metering applying to both the first and second packet flows; and

wherein

the first level of metering includes applying a first set of individual level traffic parameters for the first packet flow to determine when the first packet flow exceeds a first profile,

the different first level of metering includes applying a second set of individual level traffic parameters for the second packet flows to determine when the second packet flow exceeds a second profile,

the second level of metering includes applying a set of group level traffic parameters for at least both the first and second packet flows to determine when the first and second packet flows together exceed a group profile,

the individual level traffic parameters of the first and second sets and the group level traffic parameters are comprised of a peak information rate (PIR) and a committed information rate (CIR), and the instructions further result in;

dropping packets of the first packet flow when one or more of the individual level traffic parameters of the fast set is exceeded and when one or more of the group level traffic parameters is exceeded;

dropping packets of the second packet flow when one or more of the individual level traffic parameters of the second set is exceeded and when one or more of the group level traffic parameters is exceeded; and

refraining from dropping packets of the first and second packet flows when none of the group level traffic parameters are exceeded.