Routing a packet by a device

• US 8,689,316 B2
• Filed: 09/14/2012
• Issued: 04/01/2014
• Est. Priority Date: 09/28/2001
• Status: Expired due to Term

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Mao, Yu Ming, Lian, Roger Jia-Jyi, Huang, Guangsong, Cheung, Lee Chik
• Primary Examiner(s): Dada, Beemnet
• Assistant Examiner(s): BELL, KALISH K
• Application Number:
  US13/615,780
• Publication Number:
  US 20130007839A1
• Time in Patent Office: 564 Days
• Field of Search: 370/351, 709/232, 709/238, 726/1, 726/13
• US Class Current: 726/13
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

Methods and apparatus for transferring packets in a packet switched communication system. A system is provided that includes an L2 device including a controller determining for each packet received whether the received packet is to be inspected, an inspection device operable to inspect and filter packets identified by the controller including using a zone specific policy and an L2 controller for transferring inspected packets in accordance with L2 header information using L2 protocols.

Claims

1. A method comprising:

determining, by a network device, whether an entry, corresponding to a destination address included in a first packet, is stored in a memory associated with the network device;

transmitting, by the network device, a second packet, that includes the destination address, to one or more ports of a plurality of ports of the network device, when the entry is not stored in the memory,

the second packet being different than the first packet;

preventing, by the network device, the first packet from being transmitted until a response, to the transmitted second packet, is received via a particular port of the one or more ports that is associated with the destination address; and

transmitting, by the network device, the first packet after the response is received.

2. The method of claim 1, further comprising:

receiving the response via the particular port;

updating the memory to include the entry corresponding to the destination address based on receiving the response; and

including, in the entry, the destination address and information identifying the particular port.

3. The method of claim 1, further comprising:

obtaining the destination address from the first packet,

where the response indicates that a device, connected via the particular port, is to process packets associated with the destination address.

4. The method of claim 1, further comprising:

determining that the entry, corresponding to the destination address, is not stored in the memory associated with the network device; and

creating the second packet based on determining that the entry is not stored in the memory.

5. The method of claim 1, further comprising:

determining that the entry is stored in the memory associated with the network device,

the entry identifying a port of the plurality of ports of the network device; and

transmitting the first packet to the port identified by the entry after determining that the entry is stored in the memory.

6. The method of claim 1, where preventing the first packet from being transmitted includes preventing the first packet from being transmitted for a particular period of time,

the method further comprising:

dropping, after the particular period of time, the first packet if the response is not received.

7. The method of claim 1, further comprising:

determining whether the first packet is to be inspected; and

determining whether the entry is stored in the memory based on determining whether the first packet is to be inspected.

8. A system comprising:

a device configured to;

receive a first packet that includes a destination address;

determine whether an entry, corresponding to the destination address, is stored in a memory associated with the device;

transmit a second packet, that includes the destination address, to one or more ports of a plurality of ports of the device when the entry is not stored in the memory,

the second packet being different than the first packet;

prevent the first packet from being transmitted until a response, to the transmitted second packet, is received;

receive the response, to the transmitted second packet, from a particular port of the one or more ports,

the particular port being associated with the destination address; and

update the memory to include the entry based on receiving the response from the particular port.

9. The system of claim 8, where the device is further to:

transmit the first packet via the particular port after receiving the response.

10. The system of claim 8, where, when updating the memory to include the entry, the device is to include the destination address and information identifying the particular port in the entry.

11. The system of claim 8, where the device is further to:

determine whether the first packet is to be inspected; and

determine whether the entry is stored in the memory based on determining whether the first packet is to be inspected.

12. The system of claim 8, where the device is further to:

receive the first packet via a port of the plurality of ports;

determine that the first packet is to be inspected;

retrieve a security policy based on the port of the plurality of ports;

process the first packet based on the security policy; and

determine whether the entry is stored in the memory based on processing the first packet based on the security policy.

13. The system of claim 8, where the response indicates that a particular device, connected via the particular port, is to process packets associated with the destination address.

14. The system of claim 8, where the device is further to:

determine that the entry is not stored in the memory associated with the device; and

create the second packet based on determining that the entry is not stored in the memory.

15. The system of claim 8, where, when preventing the first packet from being transmitted, the device is to:

prevent the first packet from being transmitted for a particular amount of time.

16. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions which, when executed by a device, cause the device to determine whether an entry, corresponding to a destination address included in a first packet, is stored in a memory associated with the device;

one or more instructions which, when executed by the device, cause the device to transmit a second packet, that includes the destination address, to one or more ports of a plurality of ports of the device, when the entry is not stored in the memory,

the second packet being different than the first packet;

one or more instructions which, when executed by the device, cause the device to determine whether a response, to the transmitted second packet, is received from a particular port of the one or more ports,

the particular port being associated with the destination address;

one or more instructions which, when executed by the device, cause the device to prevent the first packet from being transmitted until the response is received from the particular port; and

one or more instructions which, when executed by the device, cause the device to transmit the first packet only after the response is received from the particular port.

17. The non-transitory computer-readable medium of claim 16, the instructions further comprising:

one or more instructions which, when executed by the device, cause the device to receive the response via the particular port,

where the response indicates that a particular device, connected via the particular port, is to process packets associated with the destination address; and

one or more instructions which, when executed by the device, cause the device to update the memory to include the entry based on receiving the response from the particular port.

18. The non-transitory computer-readable medium of claim 16, the instructions further comprising:

one or more instructions which, when executed by the device, cause the device to determine that the response is not received within a particular amount of time; and

one or more instructions which, when executed by the device, cause the device to drop the first packet based on determining that the response is not received within the particular amount of time.

19. The non-transitory computer-readable medium of claim 16, the instructions further comprising:

one or more instructions which, when executed by the device, cause the device to receive the first packet at a first port, of the plurality of ports, corresponding to a first security zone; and

one or more instructions which, when executed by the device, cause the device to prevent transfer of the first packet to a second port, of the plurality of ports, corresponding to a second security zone that differs from the first security zone.

20. The non-transitory computer-readable medium of claim 16, where the one or more instructions to transmit the first packet include:

one or more instructions which, when executed by the device, cause the device to transmit the first packet via the particular port.