Method and apparatus for packet classification and rewriting

• US 20040252693A1
• Filed: 06/10/2003
• Published: 12/16/2004
• Est. Priority Date: 06/10/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Cheriton, David R., Ertemalp, Fusun
• Granted Patent: US 7,953,088 B2
• Time in Patent Office: Days
• US Class Current: 370/395.1
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/20 Hop count for routing purposes, e.g. TTL
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

In one embodiment, a method for processing a packet is disclosed. The method includes classifying the packet and determining an action to be taken with regard to the packet. Classifying the packet includes using information in the packet to perform the classification. The determination made as to the action to be taken with regard to the packet is based on the classifying that is performed, and is performed using a plurality of rules. At least one of the rules is configurable. The information in the packet is related to time-to-live (TTL) data corresponding to the packet.

Claims

1. A network device comprising:

a classification unit, wherein

said classification unit is configured to determine, using a plurality of rules, an action to be taken with regard to a packet by virtue of being configured to classify said packet using information in said packet, wherein

at least one of said rules is configurable, and

said information in said packet is related to time-to-live (TTL) data corresponding to said packet.

2. The network device of claim 1, wherein said information in said packet comprises said time-to-live (TTL) data corresponding to said packet.

3. The network device of claim 2, wherein

said TTL data corresponds to time-to-live information for said packet,

said classification unit is further configured to classify said packet by virtue of being configured to determine a classification of said packet, and

said classification corresponds to a one of a plurality of ranges of time-to-live values for said time-to-live information for said packet.

4. The network device of claim 3, wherein

said time-to-live information for said packet corresponds to a time-to-live of said packet,

each of said ranges of time-to-live values corresponds to a one of a plurality of actions, and

said actions comprise at least one of:

dropping said packet,

decrementing said time-to-live of said packet,

decrementing said time-to-live of said packet to generate a decremented time-to-live of said packet and dropping said packet, if said decremented time-to-live of said packet is less than a first value, and

setting said time-to-live of said packet to a second value.

5. The network device of claim 4, further comprising:

an exception handling unit, wherein

said actions further comprise

redirecting said packet to said exception handling unit.

6. The network device of claim 2, wherein

said classification unit is further configured to classify said packet by virtue of being configured to generate a classification,

said classification corresponds to a one of a plurality of ranges of time-to-live values.

7. The network device of claim 6, wherein

said TTL data corresponds to time-to-live information for said packet,

said time-to-live information for said packet corresponds to a time-to-live of said packet,

each of said ranges of time-to-live values corresponds to a one of a plurality of actions, and

said actions comprise at least one of:

dropping said packet,

decrementing said time-to-live of said packet,

decrementing said time-to-live of said packet to generate a decremented time-to-live of said packet and dropping said packet, if said decremented time-to-live of said packet is less than a first value, and

setting said time-to-live of said packet to a second value.

8. The network device of claim 7, further comprising:

an exception handling unit, wherein

said actions further comprise redirecting said packet to said exception handling unit.

9. The network device of claim 2, wherein

said TTL data corresponds to time-to-live information for said packet.

10. The network device of claim 9, wherein

said time-to-live information for said packet is a time-to-live of said packet, and

said action is to rewrite said time-to-live of said packet.

11. The network device of claim 10, wherein a rule corresponding to said action indicates that said rewriting is to be performed when a value of said time-to-live of said packet is below a minimum time-to-live value.

12. The network device of claim 10, wherein a rule corresponding to said action indicates that said rewriting is to be performed when a value of said time-to-live of said packet is above a maximum time-to-live value.

13. The network device of claim 9, wherein

said time-to-live information is a time-to-live of said packet.

14. The network device of claim 9, wherein

said time-to-live information is a hop count of said packet.

15. The network device of claim 2, wherein

each of said rules relates a value of said TTL data to a one of a plurality of actions, and

said actions comprise said action.

16. The network device of claim 15, wherein said classification unit comprises:

a content addressable memory, wherein

said rules are implemented using an access control list stored in said content addressable memory.

17. The network device of claim 15, wherein said TTL data corresponds to time-to-live information for said packet, and further comprising:

a tag generator, wherein

said tag generator is coupled to said classification unit, and

said tag generator is configured to generate said TTL data based on said time-to-live information for said packet.

18. The network device of claim 17, wherein

said time-to-live information for said packet corresponds to a time-to-live of said packet.

19. The network device of claim 18, wherein

said time-to-live of said packet is a hop count.

20. The network device of claim 18, wherein

said action is to rewrite said time-to-live of said packet.

21. The network device of claim 17, further comprising:

a forwarding engine, wherein

said forwarding engine comprises said classification unit.

22. The network device of claim 21, wherein said classification unit comprises:

a content addressable memory, wherein

said rules are implemented using an access control list stored in said content addressable memory.

23. The network device of claim 21, further comprising:

a packet processor, wherein

said packet processor comprises said tag generator.

24. The network device of claim 23, wherein said tag generator comprises:

a plurality of comparators, wherein

said comparators are configured to produce a value of said TTL data for a range of values of said time-to-live information for said packet.

25. The network device of claim 23, wherein said classification unit comprises:

a content addressable memory, wherein

said rules are implemented using an access control list stored in said content addressable memory.

26. The network device of claim 23, wherein

said forwarding engine is configured to provide said action to said packet processor, and

said packet processor is configured to process said packet based on said action.

27. The network device of claim 15, wherein

said TTL data corresponds to time-to-live information for said packet.

28. The network device of claim 27, wherein

said time-to-live information for said packet is a time-to-live of said packet, and

said action is to rewrite said time-to-live of said packet.

29. The network device of claim 27, wherein

a first number of bits is used to represent a first value of said time-to-live information for said packet,

a second number of bits is used to represent a second value of said time-to-live of said packet,

said tag generator is configured to generate said first value in response to said second value, and

said first number is smaller than said second number.

30. The network device of claim 2, wherein

said TTL data is equal to one of a plurality of time-to-live values,

each of said rules relates a one of said time-to-live values to a one of a plurality of actions.

31. The network device of claim 30, wherein

a rule of said rules comprises selecting, from said actions, an action to be performed, if a value of said TTL data is less than a minimum limit, and

said action comprises dropping said packet, wherein

said minimum limit indicates said packet originated outside a radius represented by said minimum limit.

32. The network device of claim 30, wherein

a rule of said rules comprises selecting, from said actions, an action to be performed, if said packet is from outside a local network, and

said action comprises setting a value of a time-to-live of said packet to a pre-determined value.

33. The network device of claim 30, wherein

said TTL data corresponds to time-to-live information for said packet, and

said time-to-live information for said packet corresponds to a time-to-live of said packet.

34. The network device of claim 33, wherein

a rule of said rules comprises selecting, from said actions, an action to be performed, if a value of said TTL data is within a range of values, and

said action comprises decrementing said value of said time-to-live of said packet, wherein

said range of values indicates said packet originated within a radius represented by said range of values.

35. The network device of claim 33, wherein

a rule of said rules comprises selecting, from said actions, an action to be performed, if a value of said TTL data is within a range of values, and

said action comprises setting said time-to-live of said packet to a pre-determined value.

36. A method of processing a packet comprising:

classifying said packet using information in said packet; and

determining an action to be taken with regard to said packet, based on said classifying, wherein

said determining is performed using a plurality of rules,

at least one of said rules is configurable, and

said information in said packet is related to time-to-live (TTL) data corresponding to said packet.

37. The method of claim 36, wherein

said information in said packet comprises said time-to-live (TTL) data corresponding to said packet.

38. The method of claim 37, wherein

said classification unit is further configured to classify said packet by virtue of being configured to determine a classification of said packet based on said TTL data, and

said classification corresponds to a one of a plurality of ranges of time-to-live values of said TTL data.

39. The method of claim 38, wherein

said TTL data is time-to-live information for said packet,

said time-to-live information for said packet is a time-to-live of said packet,

each of said ranges of time-to-live values corresponds to a one of a plurality of actions, and

said actions comprise at least one of:

dropping said packet,

decrementing said time-to-live of said packet,

decrementing said time-to-live of said packet to generate a decremented time-to-live of said packet and dropping said packet, if said decremented time-to-live of said packet is less than a first value, and

setting said time-to-live of said packet to a second value.

40. The method of claim 39, wherein said actions further comprise:

redirecting said packet to said exception handling unit.

41. The method of claim 37, wherein

said TTL data is time-to-live information for said packet.

42. The method of claim 41, wherein

said time-to-live information for said packet is a time-to-live of said packet.

43. The method of claim 42, wherein said action comprises:

rewriting said time-to-live of said packet.

44. The method of claim 43, wherein

said rewriting is performed when a value of said time-to-live of said packet is below a minimum time-to-live value.

45. The method of claim 43, wherein

said rewriting is performed when a value of said time-to-live of said packet is above a maximum time-to-live value.

46. The method of claim 41, wherein

said time-to-live information for said packet is a hop count of said packet.

47. The method of claim 41, wherein

said time-to-live information for said packet is equal to one of a plurality of time-to-live values,

each of said rules relates a one of said time-to-live values to a one of a plurality of actions, and

said actions comprise said action.

48. The method of claim 47, wherein said time-to-live information for said packet is a time-to-live of said packet, and further comprising:

rewriting said time-to-live of said packet.

49. The method of claim 47, wherein

said rules are implemented using an access control list.

50. The method of claim 47, further comprising:

converting a time-to-live of said packet to said time-to-live information for said packet.

51. The method of claim 50, wherein

said time-to-live of said packet is a hop count.

52. The method of claim 50, wherein

said action is to rewrite said time-to-live of said packet.

53. The method of claim 50, wherein

a first number of bits is used to represent a first value of said time-to-live information,

a second number of bits is used to represent a second value of said time-to-live of said packet,

said converting converts said second value of said time-to-live of said packet to said time-to-live information for said packet, and

said first number is smaller than said second number.

54. The method of claim 47, further comprising:

processing said packet by performing said action.

55. The method of claim 54, wherein said processing comprises:

altering said time-to-live of said packet according to a one of said rules.

56. The method of claim 54, wherein said processing comprises:

rewriting a time-to-live of said packet.

57. The method of claim 47, wherein said time-to-live information for said packet is a time-to-live of said packet, and said action comprises:

altering a time-to-live of said packet according to a one of said rules.

58. The method of claim 47, wherein

said time-to-live information for said packet is a time-to-live of said packet.

59. The method of claim 58, wherein

said rule comprises selecting said action to be performed, if a value of a time-to-live of said packet is within a range of values, and

said action comprises setting said time-to-live of said packet to a pre-determined value.

60. The method of claim 58, wherein

said rule comprises selecting said action to be performed, if said packet is from outside a local network, and

said action comprises setting a value of a time-to-live of said packet to a pre-determined value.

61. The method of claim 60, wherein

said rule comprises selecting said action to be performed, if said value of said time-to-live of said packet is less than a minimum limit, and

said action comprises dropping said packet, wherein

said minimum limit indicates said packet originated outside said local network.

62. The method of claim 60, wherein

said rule comprises selecting said action to be performed, if said value of said time-to-live of said packet is within a range of values, and

said action comprises decrementing said value of said time-to-live of said packet, wherein

said range of values indicates said packet originated within a radius represented by said range of values.

63. The method of claim 58, wherein

said rule comprises selecting said action to be performed, if a value of a time-to-live of said packet is less than a minimum limit, and

said action comprises dropping said packet, wherein

said minimum limit indicates said packet originated outside a radius represented by said minimum limit.

64. The method of claim 63, wherein

said packet is a control packet.

65. The method of claim 58, wherein

said rule comprises selecting said action to be performed, if a value of said time-to-live of said packet is within a range of values, and

said action comprises decrementing said value of said time-to-live of said packet, wherein

said range of values indicates said packet originated within a radius represented by said range of values.

66. A computer system comprising:

a processor;

computer readable medium coupled to said processor; and

computer code, encoded in said computer readable medium, for processing a packet and configured to cause said processor to;

generate a classification by virtue of being configured to classify said packet using information in said packet; and

determine an action to be taken with regard to said packet, based on said classifying, wherein

said computer code is further configured to cause said processor to determine said action using a plurality of rules, and

at least one of said rules is configurable, and

said information in said packet is related to time-to-live (TTL) data corresponding to said packet.

67. The computer system of claim 66, wherein

said information in said packet comprises said time-to-live (TTL) data corresponding to said packet.

68. The computer system of claim 67, further comprising:

a classification unit, wherein

said classification unit is configured to classify said packet by virtue of being configured to determine said classification,

said classification is a classification of said packet based on said TTL data, and

said classification corresponds to a one of a plurality of ranges of time-to-live values of said TTL data.

69. The computer system of claim 67, wherein

said TTL data is time-to-live information for said packet, and

said time-to-live information for said packet is a time-to-live of said packet.

70. The computer system of claim 69, wherein said computer code is further configured to cause said processor to:

perform said action by rewriting said time-to-live of said packet.

71. The computer system of claim 67, wherein

said TTL data is time-to-live information for said packet,

said time-to-live information for said packet is equal to one of a plurality of time-to-live values,

each of said rules relates a one of said time-to-live values to a one of a plurality of actions, and

said actions comprise said action.

72. The computer system of claim 71, wherein said time-to-live information for said packet is a time-to-live of said packet, and said computer code is further configured to cause said processor to:

rewrite said time-to-live of said packet.

73. The computer system of claim 71, wherein

said rules are implemented using an access control list.

74. The computer system of claim 71, wherein said computer code is further configured to cause said processor to:

process said packet by performing said action, wherein said processing of said packet comprises altering said time-to-live of said packet according to a one of said rules.

75. The computer system of claim 71, wherein said time-to-live information for said packet is a time-to-live of said packet, and said computer code is further configured to cause said processor to:

alter a time-to-live of said packet according to a one of said rules.

76. A computer program product for processing a packet comprising:

a first set of instructions, executable on a computer system, configured to generate a classification by virtue of being configured to classify said packet using information in said packet;

a second set of instructions, executable on said computer system, configured to determine an action to be taken with regard to said packet, based on said classifying, wherein

said computer code is further configured to cause said processor to determine said action using a plurality of rules, and

at least one of said rules is configurable, and

said information in said packet is related to time-to-live (TTL) data corresponding to said packet; and

computer readable media, wherein said computer program product is encoded in said computer readable media.

77. The computer program product of claim 76, wherein

said TTL data is time-to-live information for said packet, and

said time-to-live information for said packet is a time-to-live of said packet.

78. The computer program product of claim 77, wherein

said information in said packet comprises said time-to-live (TTL) data corresponding to said packet.

79. The computer program product of claim 78, further comprising:

a third set of instructions, executable on said computer system, configured to perform said action by rewriting said time-to-live of said packet.

80. The computer program product of claim 77, wherein

said TTL data is time-to-live information for said packet,

said time-to-live information for said packet is equal to one of a plurality of time-to-live values,

each of said rules relates a one of said time-to-live values to a one of a plurality of actions, and

said actions comprise said action.

81. The computer program product of claim 80, wherein said time-to-live information for said packet is a time-to-live of said packet, and further comprising:

a third set of instructions, executable on said computer system, configured to rewrite said time-to-live of said packet.

82. The computer program product of claim 80, wherein

said rules are implemented using an access control list.

83. The computer program product of claim 80, further comprising:

a third set of instructions, executable on said computer system, configured to process said packet by virtue of being configured to perform said action, wherein said processing of said packet comprises altering said time-to-live of said packet according to a one of said rules.

84. The computer program product of claim 80, wherein said time-to-live information for said packet is a time-to-live of said packet, and further comprising:

a third set of instructions, executable on said computer system, configured to alter a time-to-live of said packet according to a one of said rules.

85. An apparatus for processing a packet comprising:

means for classifying said packet using information in said packet, wherein said means for classifying is configured to generate a classification of said packet; and

means for determining an action to be taken with regard to said packet, based on said classification, wherein

said means for determining is configured to use a plurality of rules,

at least one of said rules is configurable, and

said information in said packet is related to time-to-live (TTL) data corresponding to said packet.

86. The apparatus of claim 85, wherein

said information in said packet comprises said time-to-live (TTL) data corresponding to said packet.

87. The apparatus of claim 86, further comprising:

means for classification, wherein

said means for classification is configured to classify said packet by virtue of being configured to determine said classification of said packet based on said TTL data, and

said classification corresponds to a one of a plurality of ranges of time-to-live values of said TTL data.

88. The apparatus of claim 86, wherein

said TTL data is time-to-live information for said packet, and

said time-to-live information for said packet is a time-to-live of said packet.

89. The apparatus of claim 88, further comprising:

means for rewriting said time-to-live of said packet, wherein said means for rewriting performs said action.

90. The apparatus of claim 86, wherein

said TTL data is time-to-live information for said packet,

said time-to-live information for said packet is equal to one of a plurality of time-to-live values,

each of said rules relates a one of said time-to-live values to a one of a plurality of actions, and

said actions comprise said action.

91. The apparatus of claim 90, wherein said time-to-live information for said packet is a time-to-live of said packet, and further comprising:

means for rewriting said time-to-live of said packet.

92. The apparatus of claim 90, wherein

said rules are implemented using an access control list.

93. The apparatus of claim 90, further comprising:

means for processing said packet by performing said action, wherein said means for processing comprises means for altering said time-to-live of said packet according to a one of said rules.

94. The apparatus of claim 90, wherein said time-to-live information for said packet is a time-to-live of said packet, and said action comprises:

means for altering a time-to-live of said packet according to a one of said rules.