Packet processing in a multiple processor system

• US 8,331,374 B2
• Filed: 12/12/2011
• Issued: 12/11/2012
• Est. Priority Date: 08/02/2005
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Zuk, Nir, Mao, Yu Ming
• Primary Examiner(s): CHO, HONG SOL
• Application Number:
  US13/323,299
• Publication Number:
  US 20120084426A1
• Time in Patent Office: 365 Days
• Field of Search: 370/389, 370/392, 370/394, 370/400, 370/401, 370/474
• US Class Current: 370/392
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

Packet processing is provided in a multiple processor system including a first processor to processing a packet and to create a tag associated with the packet. The tag includes information about the processing of the packet. A second processor receives the packet subsequent to the first processor and processes the packet using the tag information.

Claims

1. A system comprising:

a first engine to;

process a packet, and

generate particular information that is based on the first engine processing the packet,

the particular information including session information that identifies a session to which the packet belongs; and

a second engine to;

receive the packet and the particular information,

process the packet using the particular information,

determine that the packet is to be forwarded to a third engine to further process the packet,

generate information that is based on the second engine processing the packet,

the information, that is based on the second engine processing the packet, being different than the particular information, and

the information, that is based on the second engine processing the packet, including the session information,

forward the packet and the information, that is based on the second engine processing the packet, to the third engine,

the second engine being different than the first engine.

2. The system of claim 1, where the first engine comprises one of a firewall processing engine, an intrusion detection system, or a network address translation (NAT) engine, and

where the second engine comprises a different one of the firewall processing engine, the intrusion detection system, or the NAT engine.

3. The system of claim 1, where the first engine is further to:

determine that the packet is to be further processed, after processing the packet, and

generate the particular information to indicate that the packet is to be further processed.

4. The system of claim 1, where the second engine is further to:

forward the particular information and the information, that is based on the second engine processing the packet, to the third engine.

5. The system of claim 1, where the particular information further includes an indication to drop other packets that belong to the session, and

where the second engine is to:

receive one or more packets that belong to the session, and

drop the one or more packets.

6. A method comprising:

processing, by a first processor of a device, a packet;

determining, by the first processor, whether the packet is to be further processed;

generating, by the first processor, particular information that is based on the first processor determining that the packet is to be further processed,

the particular information including session information that identifies a session to which the packet belongs;

receiving, by a second processor, the packet and the particular information when the packet is to be further processed,

the second processor being different than the first processor;

processing, by the second processor, the packet using the particular information;

determining, by the second processor, that the packet is to be forwarded to a third processor for further processing;

generating, by the second processor, information that is based on the second processor processing the packet,

the information, that is based on the second processor processing the packet, being different than the particular information, and

the information, that is based on the second processor processing the packet, including the session information; and

forwarding, by the second processor, the packet and the information, that is based on the second processor processing the packet, to the third processor for further processing.

7. The method of claim 6, where the first processor is associated with a firewall processing engine, and

where the second processor is associated with an intrusion detection system.

8. The method of claim 6, further comprising, prior to forwarding the packet and the information that is based on the second processor processing the packet, at least one of:

modifying, by the second processor, the particular information using the information that is based on the second processor processing the packet;

or

replacing, by the second processor, the particular information with the information that is based on the second processor processing the packet.

9. The method of claim 8, where forwarding the packet and the information, that is based on the second processor processing the packet, to the third processor includes:

forwarding;

the packet,

the particular information, and

the information that is based on the second processor processing the packet.

10. The method of claim 8, where the particular information further includes an indication to drop the packet and other packets that belong to the session,

the method further comprising:

dropping, by the second processor and based on the particular information, the packet and one or more of the other packets that belong to the session.

11. A device comprising:

a first processor to;

process a packet,

determine whether the packet is to be further processed,

generate particular information that is based on the first processor processing the packet when the packet is to be further processed,

the particular information including session information that identifies a session to which the packet belongs,

attach the particular information to the packet, and

output the packet and the particular information; and

a second processor to;

receive the packet and the particular information when the packet is to be further processed,

process the packet using the particular information,

determine to forward the packet to a third processor for further processing,

generate information that is based on the second processor processing the packet,

the information, that is based on the second processor processing the packet, being different than the particular information, and

the information, that is based on the second processor processing the packet, including the session information, and

forward the packet and the information, that is based on the second processor processing the packet, to the third processor for further processing,

the second processor being different than the first processor.

12. The device of claim 11, where, when forwarding the packet and the information that is based on the second processor processing the packet, the second processor is to:

forward the packet, the information that is based on the second processor processing the packet, and the particular information to the third processor.

13. The device of claim 11, where the particular information further includes an indication to drop other packets that belong to the session, and

where the second processor is further to drop, based on the particular information, the other packets.

14. The device of claim 11, where the second processor is further to transmit the packet to a destination Internet Protocol (IP) address that is included in the packet.

15. The device of claim 11, where the first processor is associated with one of a firewall processing engine, an intrusion detection system, or a network address translation (NAT) engine, and

where the second processor is associated with a different one of the firewall processing engine, the intrusion detection system, or the NAT engine.

16. A non-transitory computer-readable medium comprising:

one or more instructions which, when executed by a first processor of a device, cause the first processor to process a packet;

one or more instructions which, when executed by the first processor, cause the first processor to determine whether the packet is to be further processed;

one or more instructions which, when executed by the first processor, cause the first processor to generate particular information that is based on the first processor processing the packet when the packet is to be further processed;

the particular information including session information that identifies a session to which the packet belongs;

one or more instructions which, when executed by the first processor, cause the first processor to attach the particular information to the packet;

one or more instructions which, when executed by the first processor, cause the first processor to output the packet and the particular information;

one or more instructions which, when executed by a second processor of the device, cause the second processor to receive the packet and the particular information when the packet is to be further processed;

one or more instructions which, when executed by the second processor, cause the second processor to process the packet using the particular information,

the second processor being different than the first processor;

one or more instructions which, when executed by the second processor, cause the second processor to determine to forward the racket to a third processor for further processing;

one or more instructions which, when executed by the second processor, cause the second processor to generate information that is based on the second processor processing the packet,

the information, that is based on the second processor processing the packet, being different than the particular information, and

the information, that is based on the second processor processing the packet, including the session information; and

one or more instructions which, when executed by the second processor, cause the second processor to forward the packet and the information, that is based on the second processor processing the packet, to the third processor.

17. The non-transitory computer-readable medium of claim 16, where the one or more instructions to forward the packet and the other information include:

one or more instructions which, when executed by the second processor, cause the second processor to forward the packet, the information that is based on the second processor processing the packet, and the particular information to the third processor.

18. The non-transitory computer-readable medium of claim 16, where the particular information further includes an indication to drop one or more other packets that belong to the session,

the non-transitory computer-readable medium further comprising:

one or more instructions which, when executed by the second processor, cause the second processor to drop, based on the particular information, the one or more other packets.

19. The non-transitory computer-readable medium of claim 16, further comprising:

one or more instructions which, when executed by the second processor, cause the second processor to transmit the packet to a destination Internet Protocol (IP) address that is included in the packet.

20. The non-transitory computer-readable medium of claim 16, where the first processor is associated with one of a firewall processing engine, an intrusion detection system, or a network address translation (NAT) engine, and

where the second processor is associated with a different one of the firewall processing engine, the intrusion detection system, or the NAT engine.