Programmable packet parsing processor

• US 7,586,851 B2
• Filed: 04/26/2004
• Issued: 09/08/2009
• Est. Priority Date: 04/26/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Jain, Sanjay, Ng, Daniel Yu-Kwong, Liu, Jackie, Patra, Abhijit, Panigrahy, Rina, Bagepalli, Nagaraj A.
• Primary Examiner(s): Pezzlo; John
• Application Number:
  US10/832,796
• Publication Number:
  US 20050238010A1
• Time in Patent Office: 1,961 Days
• Field of Search: 370/252, 370352-356, 370/400, 370/401, 370/395.7, 370/389, 370/238, 370/254, 711/154, 709/249, 714/49
• US Class Current: 370/252
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

The present invention provides a packet processing device and method. A parsing processor provides instruction-driven content inspection of network packets at 10-Gbps and above with a parsing engine that executes parsing instructions. A flow state unit maintains statefulness of packet flows to allow content inspection across several related network packets. A state-graph unit traces state-graph nodes to keyword indications and/or parsing instructions. The parsing instructions can be derived from a high-level application to emulate user-friendly parsing logic. The parsing processor sends parsed packets to a network processor unit for further processing.

Claims

1. A packet parsing processor, comprising:

a parsing engine having an input to receive a signal that represents a network packet, the parsing engine to perform instruction-driven packet parsing on the packet, responsive to parsing instructions; and

a state-graph unit having an input/output coupled to a second input/output of the parsing engine, the state-graph unit to store the parsing instructions, wherein a parsing instruction is associated with a node in a state-graph, the parsing engine executing the parsing instruction responsive to a node match;

wherein the parsing engine further comprises a hash unit to store a portion of a parsing state, and wherein the parsing engine generates a key to look-up the portion of the parsing state.

2. The packet processor of claim 1, wherein the hash table comprises a TCP (Transmission Control Protocol) flow table and the key comprises a destination IP (Internet Protocol) address and destination port.

3. The packet processor of claim 1, wherein the parsing engine further comprises a plurality of scratchpads to store data while executing parsing instructions.

4. The packet processor of claim 1, wherein a portion of the parsing instructions emulate nodes from a software application for application recognition.

5. The packet processor of claim 1, wherein a parsing instruction comprises an encoded bitmap that represents whether characters have a transition.

6. The packet processor of claim 1, wherein the state-graph unit comprises an FCRAM (Fast Cycle Random Access Memory).

7. The packet processor of claim 1, wherein the parsing engine further comprises a plurality of processing cores to execute parsing instructions.

8. The packet processor of claim 1, wherein the packet processor is contained within a network device, coupled to a network operating at 10-Gbps or above, network device performing one from the group containing:

data packet routing, data packet forwarding, data packet bridging.

9. The packet parsing processor of claim 1, wherein the packet parsing supports one from the group containing:

intrusion detection, quality of service, application recognition, virus detection, and an application-level firewall.

10. A packet parsing processor, comprising:

a parsing engine having an input to receive a signal that represents a network packet, the parsing engine to perform instruction-driven packet parsing on the packet, responsive to parsing instructions; and

a state-graph unit having an input/output coupled to a second input/output of the parsing engine, the state-graph unit to store the parsing instructions, wherein a parsing instruction is associated with a node in a state-graph, the parsing engine executing the parsing instruction responsive to a node match; and

a flow state unit having an input/output coupled to a first input/output of the parsing engine, the flow state unit to maintain a parse state across a packet flow.

11. The packet processor of claim 10, wherein the parsing engine stores the parser state in the flow state unit after parsing the network packet.

12. A packet parsing processor, comprising:

means for parsing a network packet responsive to parsing instructions; and

means for graphing, coupled to means for regular expression matching, the means for graphing identifying keyword matches between a state-graph and the network packet, wherein a parsing instruction is associated with a node in the state-graph, the means for regular expression matching executing the parsing instruction responsive to a node match;

wherein the means for parsing further comprises a means for hashing to store a parsing state, and the means for parsing generates a key to look-up a portion of the parsing state.

13. The packet processor of claim 12, wherein the means for hashing comprises a TCP (Transmission Control Protocol) hash table and the key comprises a destination IP (Internet Protocol) address and destination port.

14. The packet processor of claim 12, wherein the means for regular expression matching further comprises a plurality of means for storing data while executing parsing instructions.

15. The packet processor of claim 12, wherein a portion of the parsing instructions emulate nodes from a software application for application recognition.

16. The packet processor of claim 12, wherein a parsing instruction comprises an encoded bitmap that represents whether characters have a transition.

17. The packet processor of claim 12, wherein the means for regular expression matching further comprises a plurality of means for executing parsing instructions.

18. The packet processor of claim 12, wherein the means for regular expression matching stores the parser state in the means for maintaining after parsing the network packet.

19. A packet parsing processor, comprising:

means for parsing a network packet responsive to parsing instructions; and

means for graphing, coupled to means for regular expression matching, the means for graphing identifying keyword matches between a state-graph and the network packet, wherein a parsing instruction is associated with a node in the state-graph, the means for regular expression matching executing the parsing instruction responsive to a node match; and

means for maintaining, coupled to the means for regular expression matching, the means for maintaining storing parse states for a plurality of packet flows.

20. A method of parsing packets in a processor, comprising:

receiving a network packet,

performing instruction-driven packet parsing on the network packet responsive to parsing instructions that traverse nodes of a state machine; and

storing parsing instructions in memory addresses corresponding to the nodes,

wherein performing instruction-driven packet parsing comprises storing a portion of a parsing state in a hash unit, and generating a key to look-up the portion of the parsing state.

21. The packet processor of claim 20, wherein the hash unit comprises a TCP (Transmission Control Protocol) hash table and the key comprises a destination IP (Internet Protocol) address and destination port.

22. The method of claim 20, wherein the performing instruction-driven packet parsing further comprises executing parsing instructions in scratchpads.

23. The method of claim 20, wherein a parsing instruction is associated with a node in the state-graph, and identifying keyword matches further comprises identifying a parsing instruction at a node of the state graph, and executing the parsing instruction responsive to a node match.

24. The method of claim 20, wherein a portion of the parsing instructions emulate nodes from a software application for application recognition.

25. The method of claim 20, wherein a parsing instruction comprises an encoded bitmap that represents whether characters have a transition.

26. The method of claim 20, wherein the identifying keyword matches comprises identifying keyword matches on a state-graph stored in an FCRAM (Fast Cycle Random Access Memory).

27. The method of claim 20, further comprising executing a parsing instruction.

28. A method of parsing packets in a processor, comprising:

receiving a network packet,

performing instruction-driven packet parsing on the network packet responsive to parsing instructions that traverse nodes of a state machine; and

storing parsing instructions in memory addresses corresponding to the nodes, further comprising;

maintaining parse states for a plurality of packet flows.

29. A method of parsing packets in a processor, comprising:

receiving a network packet,

performing instruction-driven packet parsing on the network packet responsive to parsing instructions that traverse nodes of a state machine;

storing parsing instructions in memory addresses corresponding to the nodes; and

maintaining the flow states further comprises storing the parser state after parsing the network packet.

30. A computer program product, comprising a computer-readable medium having computer program instructions and data embodied thereon for a method for parsing packets in a processor, the method comprising:

receiving a network packet,

performing instruction-driven packet parsing on the network packet responsive to parsing instructions that traverse nodes of a state machine; and

storing parsing instructions in memory addresses corresponding to the nodes,

wherein the performing instruction-driven packet parsing further storing a portion of a parsing state in a hash unit, and generating a key to look-up the portion of the parsing state.

31. The computer program product of claim 30, wherein the hash unit comprises a TCP (Transmission Control Protocol) hash table and the key comprises a destination IP (Internet Protocol) address and destination port.

32. The computer program product of claim 30, wherein the performing instruction-driven packet parsing further comprises executing parsing instructions in scratchpads.

33. The computer program product of claim 30, wherein a parsing instruction is associated with a node in the state-graph, and identifying keyword matches further comprises identifying a parsing instruction at a node of the state graph, and executing the parsing instruction responsive to a node match.

34. The computer program product of claim 30, wherein a portion of the parsing instructions emulate nodes from a software application for application recognition.

35. The computer program product of claim 30, wherein a parsing instruction comprises an encoded bitmap that represents whether characters have a transition.

36. The computer program product of claim 30, wherein the identifying keyword matches comprises identifying keyword matches on a state-graph stored in an FCRAM (Fast Cycle Random Access Memory).

37. The computer program product of claim 30, further comprising executing a parsing instruction.

38. A computer program product, comprising a computer-readable medium having computer program instructions and data embodied thereon for a method for parsing packets in a processor, the method comprising:

receiving a network packet,

performing instruction-driven packet parsing on the network packet responsive to parsing instructions that traverse nodes of a state machine; and

storing parsing instructions in memory addresses corresponding to the nodes, further comprising;

maintaining parse states for a plurality of packet flows.

39. The computer program product of claim 38, wherein maintaining the flow states comprises storing the parser state after parsing the network packet.