Systems and methods for processing packets

• US 7,215,637 B1
• Filed: 12/14/2001
• Issued: 05/08/2007
• Est. Priority Date: 04/17/2000
• Status: Expired due to Term

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Ferguson, Dennis C., Sindhu, Pradeep, Cheung, Gerald, Patel, Rajiv
• Primary Examiner(s): Pham; Chi
• Assistant Examiner(s): LY, ANH VU H
• Application Number:
  US10/017,719
• Time in Patent Office: 1,971 Days
• Field of Search: None
• US Class Current: 370/230.1
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 45/7452 Multiple parallel or consecutive lookup operations lookup operation involving Bloom filters H04L45/7459
• CPC Class Codes: H04L 45/74591 using content-addressable memories [CAM]
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 49/205 Quality of Service based
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/3036 Shared queuing
• CPC Class Codes: H04L 49/3072 Packet splitting
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Methods and devices for processing packets are provided. The processing device may include an input interface for receiving data units containing header information of respective packets; a first module configurable to perform packet filtering based on the received data units; a second module configurable to perform traffic analysis based on the received data units; a third module configurable to perform load balancing based on the received data units; and a fourth module configurable to perform route lookups based on the received data units.

Claims

1. A processing device, comprising:

an input interface to receive data units containing header information of respective packets;

a first module including a user-configured filter rule to perform packet filtering based on the received data units, the first module to mark a packet for sampling by setting a bit in a packet notification when the packet matches the filter rule; and

a second module to perform traffic analysis based on the received data units, the second module to generate a random number and sample the marked packet when the random number is less than a predetermined threshold.

2. The processing device of claim 1, wherein the processing device is implemented as an Application-Specific Integrated Circuit (ASIC).

3. The processing device of claim 2, wherein the traffic analysis performed by the second module includes at least one of logging or counting.

4. The processing device of claim 3, at least one of the sampling, logging, or counting being performed at a speed of about OC-192c/STM-64.

5. The processing device of claim 1, the header information comprising at least one of a source Internet protocol (IP) address, a destination IP address, an IP type, a source port, a destination port, a differentiated service (DiffServ) byte, an IP fragmentation offset field, an IP fragmentation control field, or a transmission control protocol (TCP) control bit, and wherein the packet filtering is based on the header information.

6. The processing device of claim 1, further comprising:

a third module to perform load balancing based on the received data units.

7. The processing device of claim 6, the load balancing performed by the third module comprising forwarding packets received from a designated source port or a designated source address to a designated destination port or a designated destination address.

8. The processing device of claim 7, the forwarding of the packets from the designated source port or the designated source address to the designated destination port or the designated destination address maintains an order and a travel path for a TCP session associated with the forwarded packets.

9. The processing device of claim 1, the first module to:

accept the marked packet;

discard the marked packet;

or

reject the marked packet and transmit an Internet control message protocol (ICMP) message.

10. The processing device of claim 1, the packet filtering comprising accepting an unmarked packet when the unmarked packet is not rejected based on the filter rule.

11. The processing device of claim 1, the second module to write the header information associated with the sampled packet to a routing engine of the processing device.

12. The processing device of claim 1, the second module to monitor:

all logical interfaces associated with the processing device;

designated logical interfaces associated with the processing device;

designated protocols;

a range of addresses;

or

individual addresses.

13. The processing device of claim 1, wherein the packet filtering is used to determine respective destinations of the packets, a volume of the packets, and respective contents of the packets.

14. The processing device of claim 1, the second module to log the marked packet, a log entry associated with the logged packet being accessible for display by using a command-line interface associated with the processing device, the log entry including at least one of a log time, an input circuit, a protocol type, a source address, or a destination address.

15. The processing device of claim 1, wherein the packet filtering performed by the first module comprises performing source address verification to prevent source address spoofing of a network operation center (NOC) system.

16. The processing device of claim 1, the processing device further comprising a loopback interface, wherein the first module is associated with the loopback interface.

17. A network device comprising:

an input interface to receive a packet; and

a load balancer to;

accept the received packet when the received packet is determined to be in-profile, a first drop precedence being assigned to the in-profile accepted packet;

drop the received packet when the received packet is determined to be out-of-profile;

or

accept the received packet when the received packet is determined to be out-of-profile and mark the accepted packet as out-of-profile, a second drop precedence being assigned to the out-of-profile accepted packet.

18. The network device of claim 17, the load balancer to use a random early detection (RED) algorithm for queue management of the accepted packet based on the first drop precedence or the second drop precedence.

19. The network device of claim 17, the load balancer to assign a policing equivalence class (PEC) to the received packet.

20. The network device of claim 19, the load balancer to determine an average bandwidth and a maximum burst associated with the assigned PEC.

21. A method of forwarding data packets using an application-specific integrated circuit (ASIC)-based processor, comprising:

receiving a packet including a header;

filtering the received packet based on the header to accept or reject the received packet;

performing traffic analysis on the accepted packet, including randomized sampling based on a user-configurable sampling rate of one divided by a user-specified integer;

generating a random number;

comparing the user-configurable sampling rate to the generated random number to form a resulting value;

performing the sampling when the resulting value is less than the user-configurable sampling rate;

performing a route lookup for the accepted packet; and

forwarding the accepted packet based on the route lookup.

22. The method of claim 21, further comprising:

writing a filter rule into the ASIC-based processor prior to the filtering of the received packet.

23. The method of claim 22, the filtering comprising accepting the received packet when the filter rule does not explicitly reject the received packet.

24. An application-specific integrated circuit (ASIC)-based filter for use in router, comprising:

means for downloading a user-configured filter rule;

means for applying the filter rule to a packet received by the router;

means for accepting the packet when the packet is not explicitly rejected by the filter rule by setting a bit in a packet notification when the packet matches the filter rule;

means for generating a random number;

means for marking the accepted packet for sampling when the random number is less than a predetermined threshold; and

means for determining whether the packet is to be further processed by the router based on a result of the applying the filter rule, the ASIC-based filter being configured to perform independently of other processes being performed by the router.

25. The ASIC-based filter of claim 24, further comprising:

means for discarding the packet that arrives on an inbound circuit when the packet contains a spoofed network operation center (NOC) source address.