Flooding packets on a per-virtual-network basis

• US 9,806,906 B2
• Filed: 03/09/2011
• Issued: 10/31/2017
• Est. Priority Date: 06/08/2010
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Brocade Communications Systems, Inc. (Broadcom, Inc.)
• Inventors: Yu, Shunjia, Ghanwani, Anoop, Koganti, Phanidhar, Chatwani, Dilip
• Primary Examiner(s): Weidner, Timothy J
• Application Number:
  US13/044,301
• Publication Number:
  US 20110299531A1
• Time in Patent Office: 2,428 Days
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/32 Flooding denial of service attacks H04L63/1458
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 45/66 Layer 2 routing, e.g. in Ethernet based MAN's
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 49/208 Port mirroring
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Methods and techniques for flooding packets on a per-virtual-network basis are described. Some embodiments provide a method (e.g., a switch) which determines an internal virtual network identifier based on one or more fields in a packet'"'"'s header. Next, the method performs a forwarding lookup operation based on the internal virtual network identifier. If the forwarding lookup operation succeeds, the method can process and forward the packet accordingly. However, if the forwarding lookup operation fails, the method can determine a set of egress ports based on the internal virtual network identifier. Next, for each egress port in the set of egress ports, the method can flood the packet if a virtual network identifier in the packet'"'"'s header is associated with the egress port. Flooding packets on a per-virtual-network basis can substantially reduce the amount of resources required to flood the packet when a forwarding lookup operation fails.

Claims

1. A switch, comprising:

one or more ports;

lookup circuitry configured to determine an internal virtual network identifier for a packet based on an entry in a data structure in a local storage device, wherein the entry maps a virtual local area network (VLAN) identifier and a Virtual Private Network (VPN) identifier associated with the packet to the internal virtual network identifier;

determining circuitry configured to, in response to determining that the packet needs flooding, determine a set of egress ports from the one or more ports for flooding the packet based on the internal virtual network identifier; and

flooding circuitry configured to;

determine whether to filter the packet for flooding at a first port in the set of egress ports based on whether the first port is associated with the VPN identifier;

in response to determining not to filter the packet, associate the packet with the first port as an output port.

2. The switch of claim 1, wherein the determining circuitry is further configured to determine the internal virtual network identifier based on one or more of:

one or more fields in a header of the packet; and

a port on which the packet has been received.

3. The switch of claim 1, wherein the VLAN identifier in the entry is a customer VLAN identifier.

4. The switch of claim 1, wherein the VLAN identifier in the entry is a service provider VLAN identifier.

5. The switch of claim 1, wherein the flooding circuitry is further configured to filter the packet for flooding at a second port in the set of egress ports in response to the second port not being associated with the VPN identifier.

6. The switch of claim 5, wherein the flooding circuitry, in response to filtering the packet for flooding at the second port, is further configured to preclude the second port from being an output port for the packet.

7. The switch of claim 1, wherein the entry further maps a media access control (MAC) address of the packet to the internal virtual network identifier.

8. The switch of claim 1, wherein the packet is a packet in a routed network, and wherein the VPN identifier is in a header of the packet associated with the routed network.

9. The switch of claim 1, wherein packets from a plurality of virtual networks are mapped to the internal virtual network identifier;

and

wherein the determining circuitry is further configured to determine a set of egress ports for the packets from the plurality of virtual networks based on the internal virtual network identifier.

10. A system, comprising:

a processor; and

a memory storing instructions that when executed by the processor cause the system to perform a method, the method comprising;

determining an internal virtual network identifier for a packet based on an entry in a data structure in a local storage device, wherein the entry maps a virtual local area network (VLAN) identifier and a Virtual Private Network (VPN) identifier associated with the packet to the internal virtual network identifier;

in response to determining that the packet needs flooding, determining a set of egress ports for flooding the packet based on the internal virtual network;

determining whether to filter the packet for flooding at a first port in the set of egress ports based on whether the first port is associated with the VPN identifier; and

in response to determining not to filter the packet, associating the packet with the first port as an output port.

11. The system of claim 10, wherein the method further comprises determining the internal virtual network identifier based on one or more of:

one or more fields in a header of the packet; and

a port on which the packet has been received.

12. The system of claim 10, wherein the VLAN identifier in the entry is a customer VLAN identifier.

13. The system of claim 10, wherein the VLAN identifier in the entry is a service provider VLAN identifier.

14. The system of claim 10, wherein the method further comprises filtering the packet for flooding at a second port in the set of egress ports in response to the second port not being associated with the VPN identifier.

15. The system of claim 14, wherein the method further comprises, in response to filtering the packet for flooding at the second port, precluding the second port from being an output port for the packet.

16. The system of claim 10, wherein the entry further maps a media access control (MAC) address of the packet to the internal virtual network identifier.

17. The system of claim 10, wherein the packet is forwardable in a routed network, and wherein the VPN identifier is in a header of the packet associated with the routed network.

18. The system of claim 10, wherein packets from a plurality of virtual networks are mapped to the internal virtual network identifier;

and

wherein the method further comprises determining a set of egress ports for the packets from the plurality of virtual networks based on the internal virtual network identifier.

19. A method, comprising:

determining, by a computing system, an internal virtual network identifier for a packet based on an entry in a data structure in a local storage device, wherein the entry maps a virtual local area network (VLAN) identifier and a Virtual Private Network (VPN) identifier associated with the packet to the internal virtual network identifier;

in response to determining that the packet needs flooding, determining a set of egress ports for flooding the packet based on the internal virtual network identifier;

determining whether to filter the packet for flooding at a first port in the set of egress ports based on whether the first port is associated with the VPN identifier; and

in response to determining not to filter the packet, associating the packet with the first port as an output port.

20. The method of claim 19, further comprising determining the internal virtual network identifier based on one or more of:

one or more fields in a header of the packet; and

a port on which the packet has been received.

21. The method of claim 20, wherein the VLAN identifier in the entry is one or more of:

a customer VLAN identifier; and

a service provider VLAN identifier.

22. The method of claim 19, wherein the packet is forwardable in a routed network, and wherein the VPN identifier is in a header of the packet associated with the routed network.

23. The method of claim 19, wherein packets from a plurality of virtual networks are mapped to the internal virtual network identifier.

24. The method of claim 19, further comprising:

filtering the packet for flooding at a second port in the set of egress ports in response to the second port not being associated with the VPN identifier; and

in response to filtering the packet for flooding at the second port, precluding the second port from being an output port for the packet.