High performance packet processing using a general purpose processor

• US 8,555,374 B2
• Filed: 06/24/2011
• Issued: 10/08/2013
• Est. Priority Date: 07/05/2000
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Wu, Handong, Sufleta, Zbigniew
• Primary Examiner(s): Meky, Moustafa M
• Application Number:
  US13/167,761
• Publication Number:
  US 20110258694A1
• Time in Patent Office: 837 Days
• Field of Search: 709200-202, 709/224, 709/236, 370/349, 370/389, 370/392, 370/471
• US Class Current: 726/13
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 49/90 Buffering arrangements

Abstract

A packet processing device includes a control logic processor for filtering packets according to a set of stored rules and an arithmetic logic processor for executing packet processing instructions based on the content of the packet. The control logic processor spawns a new thread for each incoming packet, relieving the arithmetic logic processor of the need to do so. The control logic processor and the arithmetic logic processor preferably are integrated via a thread queue. The control logic processor preferably assigns a policy to each incoming packet. A policy action table stores one or more policy instructions which may be easily changed to update policies to be implemented. The policy action table preferably maps a virtual packet flow identification code to the physical memory address of an action code and a state block associated to the identification code. The arithmetic logic processor processes a packet based on the stored policy assigned to that packet.

Claims

1. An apparatus, comprising:

a first processor configured for filtering activities that include;

discarding a first packet determined to be a nonstandard packet;

discarding a second packet determined to be a repeating packet in comparison to previously received packets; and

a second processor configured for processing a plurality of packets according to one of a plurality of instructions, wherein the apparatus is configured for;

creating a thread for each of the plurality of packets; and

evaluating header information and contents of the plurality of packets, wherein state data is derived from a particular packet header corresponding to a particular packet included in the plurality of packets.

2. The apparatus of claim 1, further comprising:

a policy condition table coupled to the first processor and having a plurality of rules stored therein.

3. The apparatus of claim 1, further comprising:

a policy action table coupled to a memory unit and configured for storing a data processing policy.

4. The apparatus of claim 3, wherein the data processing policy comprises:

a first address pointer element for identifying a first location in the memory unit for one of the instructions; and

a second address pointer element for identifying a second location in the memory unit of a state block.

5. The apparatus of claim 3, wherein each of the threads corresponds to at least one policy stored in the policy action table.

6. The apparatus of claim 1, wherein the first processor interacts with logic for matching a first incoming packet to a stored first rule and for generating a first thread if the first incoming packet matches the first rule.

7. The apparatus of claim 1, wherein the first processor is configured for determining whether to accept or discard each of the plurality of packets.

8. The apparatus of claim 1, further comprising:

an addressable memory unit in which the instructions for packet processing are stored; and

a data bus connecting the addressable memory unit and the first and second processors.

9. The apparatus of claim 8, wherein a data processing policy comprises a first address pointer to a starting address of a first set of instructions and a second address pointer to a starting address of a state block stored in the addressable memory unit, and wherein the state block can be used by a first set of instructions for processing a first incoming packet.

10. The apparatus of claim 1, wherein a policy action table is provisioned in order to map particular threads associated with the plurality of packets, being stored in a packet processing queue, to a physical memory address of the instructions and the state data associated with each of the plurality of packets.

11. The apparatus of claim 1, further comprising:

a second memory unit connected to the first processor and the second processor, the second memory unit being configured to temporarily store particular packets before processing by the second processor.

12. The apparatus of claim 1, wherein at least some of the plurality of packets are identified as being associated with a denial of service (DOS) such that they are discarded.

13. The apparatus of claim 1, wherein the state data for the plurality of packets is used to generate one or more state blocks to be stored in a memory unit.

14. A method, comprising:

processing a plurality of packets according to one of a plurality of instructions;

filtering the plurality of packets, wherein the filtering includes, at least;

discarding a first packet determined to be a nonstandard packet;

discarding a second packet determined to be a repeating packet in comparison to previously received packets;

creating a thread for each of the plurality of packets; and

evaluating header information and contents of the plurality of packets, wherein state data is derived from a particular packet header corresponding to a particular packet included in the plurality of packets.

15. The method of claim 14, further comprising:

identifying a first location in a memory unit for one of the instructions; and

identifying a second location in the memory unit of a state block.

16. The method of claim 14, further comprising:

matching a first incoming packet to a stored first rule and for generating a first thread if the first incoming packet matches the first rule.

17. The method of claim 14, further comprising:

determining whether to accept or discard each of the plurality of packets, wherein at least some of the plurality of packets are identified as being associated with a denial of service (DOS) such that they are discarded.

18. The method of claim 14, further comprising:

mapping particular threads associated with the plurality of packets, being stored in a packet processing queue, to a physical memory address of the instructions and the state data associated with each of the plurality of packets.

19. The method of claim 14, wherein the state data for the plurality of packets is used to generate one or more state blocks to be stored in a memory unit.

20. One or more non-transitory media that includes code for execution and when executed by a processor operable to perform operations comprising:

processing a plurality of packets according to one of a plurality of instructions;

filtering the plurality of packets, wherein the filtering includes, at least;

discarding a first packet determined to be a nonstandard packet;

discarding a second packet determined to be a repeating packet in comparison to previously received packets;

creating a thread for each of the plurality of packets;

evaluating header information and contents of the plurality of packets, wherein state data is derived from a particular packet header corresponding to a particular packet included in the plurality of packets;

matching a first incoming packet to a stored first rule and for generating a first thread if the first incoming packet matches the first rule; and

determining whether to accept or discard each of the plurality of packets, wherein at least some of the plurality of packets are identified as being associated with a denial of service (DOS) such that they are discarded.