Filtering and route lookup in a switching device

• US 7,688,727 B1
• Filed: 12/21/2006
• Issued: 03/30/2010
• Est. Priority Date: 04/17/2000
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Ferguson, Dennis C., Sindhu, Pradeep, Cheung, Gerald, Patel, Rajiv
• Primary Examiner(s): LY, ANH VU H
• Application Number:
  US11/614,583
• Time in Patent Office: 1,195 Days
• Field of Search: None
• US Class Current: 370/230.1
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 45/7452 Multiple parallel or consecutive lookup operations lookup operation involving Bloom filters H04L45/7459
• CPC Class Codes: H04L 45/74591 using content-addressable memories [CAM]
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 49/205 Quality of Service based
• CPC Class Codes: H04L 49/25 Routing or path finding in a switch fabric
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/3036 Shared queuing
• CPC Class Codes: H04L 49/3072 Packet splitting
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers

Abstract

Methods and devices for processing packets are provided. The processing device may Include an input interface for receiving data units containing header information of respective packets; a first module configurable to perform packet filtering based on the received data units; a second module configurable to perform traffic analysis based on the received data units; a third module configurable to perform load balancing based on the received data units; and a fourth module configurable to perform route lookups based on the received data units.

Claims

1. A method performed by one or more devices, the method comprising:

filtering, by the one or more devices, received packets based on a filter rule associated with the received packets;

marking, for sampling, by the one or more devices, a first one of the received packets by setting a bit in a packet notification when the first received packet matches the filter rule; and

sampling, by the one or more devices, the marked packet based on a randomly generated number associated with the marked packet.

2. The method of claim 1, where the sampling is performed based on a comparison of the randomly generated number to a predetermined threshold.

3. The method of claim 1, where the received packets include header information comprising at least one of:

a source Internet protocol (IP) address, a destination IP address, an IP type, a source port, a destination port, a differentiated service (DiffServ) byte, an IP fragmentation offset field, an IP fragmentation control field, or a transmission control protocol (TCP) control bit, and where the filtering is based on the header information.

4. The method of claim 1, further comprising at least one of:

accepting the marked packet;

discarding the marked packet;

or

rejecting the marked packet and transmitting an Internet control message protocol (ICMP) message.

5. The method of claim 1, where the filtering comprises accepting an unmarked packet when the unmarked packet is not rejected based on the filter rule.

6. The method of claim 1, further comprising:

writing header information associated with the sampled packet to a routing engine of the one or more devices.

7. The method of claim 1, further comprising at least one of:

monitoring all logical interfaces associated with the one or more devices;

monitoring designated logical interfaces associated with the one or more devices;

monitoring designated protocols associated with the received packets;

monitoring a range of addresses associated with the received packets;

or

monitoring individual addresses associated with the received packets.

8. The method of claim 1, where the filtering identifies at least one of respective destinations of the received packets, a volume of the received packets, or respective contents of the received packets.

9. The method of claim 1, further comprising:

logging the marked packet, a log entry associated with the logged packet being accessible for display via an interface associated with the one or more devices, the log entry including at least one of a log time, an input circuit, a protocol type, a source address, or a destination address.

10. The method of claim 1, where the filtering comprises performing source address verification to prevent source address spoofing of a network operation center system.

11. The method of claim 1, further comprising:

load balancing the received packets.

12. The method of claim 11, where the load balancing comprises forwarding received packets associated with a designated source port or a designated source address to a designated destination port or a designated destination address.

13. The method of claim 12, where the forwarding the received packets comprises maintaining an order and a travel path for a TCP session associated with the forwarded packets.

14. A method performed by one or more devices, comprising:

randomly sampling, by the one or more devices, received packets based on a predetermined sampling rate of 1/n, where n is a specified integer;

comparing, by the one or more devices, the predetermined sampling rate to a randomly generated number to form a resulting value; and

performing, by the one or more devices, the random sampling based on the resulting value.

15. A system comprising one or more devices to:

accept a packet, when the packet is not rejected by a filter, when a filtering criterion is satisfied, by setting a bit in a packet notification; and

mark the accepted packet for sampling when a randomly generated number is less than a predetermined value.

16. The system of claim 15, where the one or more devices are further to:

discard the packet when the packet contains a spoofed network operation center source address.