NETWORK NODE WITH CONTROL PLANE PROCESSOR OVERLOAD PROTECTION

• US 20070127491A1
• Filed: 11/19/2006
• Published: 06/07/2007
• Est. Priority Date: 11/21/2005
• Status: Abandoned Application

• Current Assignee: Alcatel SA (Nokia Corporation)
• Original Assignee: Alcatel SA (Nokia Corporation)
• Inventors: VERZIJP, Nico, HUYSEGEMS, Rafael, DEQUEKER, Hans Maurice, SIX, Erwin, GILON, Edith Beatrice
• Application Number:
  US11/561,400
• Publication Number:
  US 20070127491A1
• Time in Patent Office: Days
• US Class Current: 370/395.200
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/12 Avoiding congestion; Recovering from congestion
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A network node comprises at least one data plane processor (101) for handling data packets of a first type (144) and for redirecting and rate-limiting data packets of a second type (142). A control plane processor (102) in the network node handles the data packets of a second type (142) redirected by the data plane processor (101). In order to protect the control plane processor (102) against overload, e.g. caused by Denial of Service (DoS) attacks, individual flows of data packets of the second type are identified for enhanced rate-limiting by the data plane processor (101).

Claims

1. Network node comprising at least one data plane processor (101) for handling data packets of a first type (144) and for redirecting and rate-limiting data packets of a second type (142), and a control plane processor (102) for handling said data packets of a second type (142) redirected by said at least one data plane processor (101),

CHARACTERIZED IN THAT said control plane processor (102) comprises overload protection means (124) adapted to identify individual flows of data packets of said second type for enhanced rate-limiting by said at least one data plane processor (101).

2. Network node according to claim 1,

CHARACTERIZED IN THAT said overload protection means (124) comprise:

a. load monitoring means (131) for monitoring the processing load of said control plane processor (102) by individual packet handling services (122, 123) and for identifying at least one service (123) that overloads said control plane processor (102);

b. flow identification means (132) for identifying individual flows of data packets that cause said at least one service (123) to overload said control plane processor (102); and

c. instruction means (133) for instructing a rate limiter (112) inside said at least one data plane processor (101) to apply enhanced rate-limiting on said individual flows.

3. Network node according to claim 2,

CHARACTERIZED IN THAT said load monitoring means (131) comprise means for monitoring lengths of message queues associated with said packet handling services (122, 123), and means for comparing said lengths of said message queues to a threshold in order to identify said at least one service (123) that overloads said control plane processor (102).

4. Network node according to claim 2,

CHARACTERIZED IN THAT said load monitoring means (131) comprise means for requesting via an operating system amounts of processing time consumed by said packet handling services (122, 123), and means for comparing said amounts of processing time to a threshold in order to identify said at least one service (123) that overloads said control plane processor (102).

5. Network node according to claim 2,

CHARACTERIZED IN THAT said flow identification means (132) comprise means for querying a flow dispatcher (121) inside said control plane processor (102) to map individual flows of data packets onto said at least one service (123) that overloads said control plane processor (102).

6. Network node according to claim 2,

CHARACTERIZED IN THAT said overload protection means (124) further comprise:

means for identifying individual flows of data packets of said second type for relaxed rate-limiting by said at least one data plane processor (101).

7. Network node according to claim 1,

CHARACTERIZED IN THAT said network node is a Digital Subscriber Line Access Multiplexer (DSLAM).

8. Network node according to claim 1,

CHARACTERIZED IN THAT said network node is a Broadband Remote Access Server (BRAS).

9. Network node according to claim 1,

CHARACTERIZED IN THAT said network node is an Internet Protocol (IP) edge router.

10. Method for overload protection of a control plane processor (102) inside a network node wherein at least one data plane processor (101) handles data packets of a first type (144) and redirects and rate-limits data packets of a second type (142), and wherein said control plane processor (102) handles said data packets of a second type (142) redirected by said at least one data plane processor (101),

CHARACTERIZED IN THAT said method comprises identifying in said control plane processor (102) individual flows of data packets of said second type for enhanced rate-limiting by said at least one data plane processor (101).