JP2008205868A - Ip fragment packet processor, and ip fragment packet processing method and program to be used in the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an IP fragment packet processor capable of reducing memory cost and lowering a deterioration in performance. <P>SOLUTION: An IP fragment packet processing part 2 buffers a non-head fragment packet until receiving a head fragment packet including layer 4 header information and transmits the buffered fragment packet with the head fragment packet as a head. A packet analyzing part 1 registers fragment identification information in an associative storage memory 4 in the case of a head fragment packet and stores the layer 4 header information in a cache memory 5 corresponding to registration information to the associative storage memory 4. The packet analyzing part 1 retrieves the associative storage memory 4 with the packet identification information, reads the layer 4 header information from the cache memory 5 corresponding to the retrieval result and overwrites the layer 4 header information in a high-speed small capacity memory 3 in the case of an intermediate or final fragment packet. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an IP fragment packet processing apparatus, an IP fragment packet processing method and program used therefor, and more particularly to an IP (Internet Protocol) fragment packet processing method.

  Conventionally, in the IP fragment packet processing method, a large-capacity buffer area is prepared, and after waiting for all the fragment packets to be assembled, reassembly is performed and subsequent processing is performed.

As a method of processing the IP fragment packet without performing the reassembly, the output port information is stored together with the layer 3 header information when the IP fragment packet having the layer 4 header information is received, and the layer 4 header information is stored. There has been proposed a method of transferring the IP fragment packet by using the stored output port information when receiving an IP fragment packet that is not present (see, for example, Patent Document 1).
JP 2003-143208 A

  However, the conventional IP fragment packet processing method described above has a problem that a large-capacity buffer area is required for reassembling, and the memory cost cannot be suppressed.

  In addition, the conventional IP fragment packet processing method has a problem in that performance cannot be improved because it is necessary to wait for all fragment packets to be assembled for reassembly.

  In the IP layer of a TCP (Transmission Control Protocol) / IP network, it is possible to transmit data of up to 64 Kbytes at a time, but in reality, shorter data [for example, Ethernet (registration) is limited due to physical layer limitations. In the case of trademark), only 1500 bytes] can be transmitted.

  Therefore, when data longer than the length that can be transmitted at one time is transmitted, the data is divided into lengths that can be transmitted on the transmission side, and is reconstructed on the reception side. Although this is called an IP fragment, when processing an IP fragment packet, the intermediate / final fragment packet does not include the layer 4 header information. Therefore, the processing requiring the layer 4 header information cannot be performed as it is. Need to be reassembled.

  Further, since the fragmented IP packets are independently transferred within the network, they do not always arrive in the order of transmission. Therefore, in order to reassemble, it is necessary to buffer in a large-capacity buffer memory until all fragmented packets are collected. As a result, the conventional IP fragment packet processing method causes an increase in memory cost and a decrease in performance. With the technique described in Patent Document 1, it is impossible to change the output port information in the subsequent processing.

  Accordingly, an object of the present invention is to provide an IP fragment packet processing apparatus, an IP fragment packet processing method, and a program used therefor, which can solve the above problems, reduce the memory cost, and reduce the performance degradation. There is to do.

An IP fragment packet processing apparatus according to the present invention is an IP fragment packet processing apparatus that processes an IP (Internet Protocol) fragment packet,
Means for buffering a fragment packet until the first fragment packet arrives; means for sending out a fragment packet that has been buffered up to that packet when the first fragment packet arrives; Means for caching the layer 4 header information and means for processing the packet using the cached layer 4 header information when receiving the intermediate and final fragment packets.

  According to the IP fragment packet processing method of the present invention, an IP fragment packet processing device that processes an IP (Internet Protocol) fragment packet buffers the fragment packet until the first fragment packet arrives, and the first fragment packet arrives A process of sending a fragment packet that has been buffered up to the beginning of the packet, a process of caching layer 4 header information when the head fragment packet is received, and the cached layer 4 header information Is used when intermediate and final fragment packets are received to process the packets.

A program according to the present invention is a program that can be executed by a computer and executed in an IP fragment packet processing apparatus that processes an IP (Internet Protocol) fragment packet,
Processing to buffer the fragment packet until the first fragment packet arrives at the computer, processing to send the fragment packet that has been buffered up to the beginning when the head fragment packet arrives, and the head A process of caching layer 4 header information when a fragment packet is received, and a process of processing the packet using the cached layer 4 header information when receiving intermediate and final fragment packets Yes.

  That is, the IP fragment packet processing method of the present invention caches the layer 4 header information when the first fragment packet is received, and uses the information that is cached when the intermediate or final fragment packet is received. It is possible to execute a process that requires.

  Regarding the arrival order of IP (Internet Protocol) fragment packets, it is not buffered until all fragment packets arrive, but is buffered until the first fragment packet arrives. It is possible to always process from the first fragment packet by processing the fragment packet that has been buffered up to the beginning.

  According to the IP fragment packet processing method of the present invention, when processing an IP (Internet Protocol) fragment packet in a TCP / IP (Transmission Control Protocol / Internet Protocol) network, the layer 4 header information of the first fragment packet is an intermediate / subsequent fragment. It is characterized in that an intermediate / subsequent fragment packet can be processed without reassembling by making it usable from a packet.

  Therefore, in the IP fragment packet processing method of the present invention, it is possible to reduce an increase in memory cost and a decrease in performance due to securing a large-capacity buffer memory that is usually required for reassembling.

  By adopting the configuration and operation as described above, the present invention can reduce the memory cost and the effects of reducing the performance degradation.

  Next, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing the configuration of an IP fragment packet processing apparatus according to an embodiment of the present invention. In FIG. 1, an IP fragment packet processing apparatus according to one embodiment of the present invention includes a packet analysis unit 1, an IP (Internet Protocol) fragment packet processing unit 2, a high-speed small-capacity storage memory 3, an associative storage memory 4, The cache memory 5 and the access control list controller 6 are configured.

  The packet analysis unit 1 extracts / stores layer 3 header information, determines whether or not it is a fragment packet, and extracts / stores layer 4 header information if it exists. The IP fragment packet processing unit 2 is connected to the packet analysis unit 1 through a queue, rearranges the top fragment packet including the layer 4 information to be the top, and returns the packet to the packet analysis unit 1.

  The associative memory 4 is connected to the packet analysis unit 1 and registers / searches the fragment packet identification information 41. Similarly to the associative memory 4, the cache memory 5 is connected to the packet analysis unit 1 and stores / reads the layer 4 header information 51.

  The high-speed small-capacity storage memory 3 is connected across the packet analysis unit 1 and the access control list control unit 6, and stores / reads the layer 3 header information 31 and the layer 4 header information 32. Since the access control list controller 6 is well known to those skilled in the art and is not directly related to the present invention, a detailed description of its configuration is omitted.

  FIG. 2 is a flowchart illustrating an IP fragment packet processing method according to an embodiment of the present invention. An IP fragment packet processing method according to an embodiment of the present invention will be described with reference to FIGS.

  When an IP packet (“3”, “1”, “2”) is given, the packet analysis unit 1 analyzes the IP packet (“3”, “1”, “2”) (step S1 in FIG. 2). The fragment identification information and the layer 3 / layer 4 header information are extracted (step S2 in FIG. 2), and the layer 3 header information and the layer 4 header information are stored in the high-speed small-capacity memory 3 (step S3 in FIG. 2).

  When the received packet (“3”, “1”, “2”) is a fragment packet (step S4 in FIG. 2), the packet analysis unit 1 converts the received packet (“3”, “1”, “2”) to IP The data is transferred to the fragment packet processing unit 2 (step S5 in FIG. 2).

  The IP fragment packet processing unit 2 buffers the non-first fragment packet (“3”) until the first fragment packet (“1”) including the layer 4 header information is received. When the IP fragment packet processing unit 2 receives the fragment packet (“1”) including the layer 4 header information, the fragment packet (“1”, “3”, “ 2 ") is transmitted to the packet analysis unit 1.

  When the packet (“1”, “3”, “2”) received from the IP fragment packet processing unit 2 is the first fragment packet (“1”) (step S6 in FIG. 2), the packet analysis unit 1 performs associative memory 4 The fragment identification information is registered (step S7 in FIG. 2), and the layer 4 header information is stored in the area of the cache memory 5 corresponding to the registration information in the associative memory 4 (step S8 in FIG. 2).

  When the received fragment packet is an intermediate or final fragment packet (“3”, “2”), the packet analysis unit 1 searches the associative memory 4 using the packet identification information as a search key (step S9 in FIG. 2), and finds a hit entry Layer 4 header information is read from the area of the cache memory 5 corresponding to, and the layer 4 header information on the high-speed small-capacity memory 3 stored in step S3 is overwritten (step S10 in FIG. 2).

  The access control list control unit 6 performs access control using the layer 4 header information using the information in the high-speed small-capacity memory 3 (step S11 in FIG. 2), and receives the received packets (“1”, “3”, “2”). )).

  Thus, in this embodiment, since processing can be performed without reassembling, a large amount of buffer area for reassembling is not required, and the memory cost can be reduced. In this embodiment, since processing can be performed without reassembling, it is not necessary to wait for all fragment packets to be assembled for reassembling, and the degree of performance degradation can be reduced.

  FIG. 3 is a diagram showing a cache data configuration according to another embodiment of the present invention. In another embodiment of the present invention, the basic configuration is the same as that of the above-described embodiment of the present invention, but the contents of the cache data are further devised.

  In FIG. 3, in the cache data configuration according to another embodiment of the present invention, layer 3 option information is stored as cache data in addition to layer 4 header information. That is, in another embodiment of the present invention, the cache data includes “ESP identification flag”, “AH identification flag”, “IPv4 / v6 Options identification flag”, “Destination Port Number (TCP / UDP)”, “Source Port”. "Number (TCP / UDP)", "Sequence Number (TCP)", "Acknowledgement Number (TCP)", "Data Offset (TCP)", "TCP flags (TCP)", "Window Size (TCP)" ing.

  Accordingly, in another embodiment of the present invention, even if the layer 3 option information is different between the head fragment packet and the intermediate / final fragment packet, the layer 3 option information of the head fragment packet is used. Even if there is a processing unit that changes the processing with the layer 3 option information in the subsequent stage, the same processing as that of the top packet can be performed.

  As described above, in this embodiment, even the layer 3 option information is targeted as the cache data. Therefore, even when there is a processing unit whose processing contents are changed by the layer 3 option information in the subsequent stage, The effect that the same processing can be performed is obtained.

It is a block diagram which shows the structure of the IP fragment packet processing apparatus by one Example of this invention. 4 is a flowchart illustrating an IP fragment packet processing method according to an embodiment of the present invention. It is a figure which shows the cache data structure by the other Example of this invention.

Explanation of symbols

1 Packet analyzer
2 IP fragment packet processor
3 High-speed small-capacity storage memory
4 Associative memory
5 Cache memory
6 Access Control List Control Unit 31 Layer 3 Header Information 32, 51 Layer 4 Header Information 41 Fragment Packet Identification Information

Claims (7)

An IP fragment packet processing apparatus that processes an IP (Internet Protocol) fragment packet,
Means for buffering a fragment packet until the first fragment packet arrives; means for sending out a fragment packet that has been buffered up to that packet when the first fragment packet arrives; Means for caching layer 4 header information, and means for processing the packet by using the cached layer 4 header information when receiving intermediate and final fragment packets. Fragment packet processing device.   2. The IP fragment packet processing apparatus according to claim 1, wherein the IP fragment packet processing apparatus processes an IP fragment packet in a TCP / IP (Transmission Control Protocol / Internet Protocol) network.   3. The IP fragment packet processing apparatus according to claim 1, wherein layer 3 option information is stored as cache data in addition to the layer 4 header information.   An IP fragment packet processing apparatus that processes an IP (Internet Protocol) fragment packet buffers the fragment packet until the first fragment packet arrives, and when the first fragment packet arrives, buffers the packet up to that point. Processing for sending out fragmented packets, processing for caching layer 4 header information when receiving the first fragment packet, and using the cached layer 4 header information when receiving intermediate and final fragment packets And a process for processing the packet.   5. The IP fragment packet processing method according to claim 4, wherein the IP fragment packet processing apparatus processes an IP fragment packet in a TCP / IP (Transmission Control Protocol / Internet Protocol) network.   6. The IP fragment packet processing method according to claim 4, wherein the IP fragment packet processing device stores layer 3 option information as cache data in addition to the layer 4 header information. An IP fragment packet processing apparatus that processes an IP (Internet Protocol) fragment packet and is a computer executable program,
Processing to buffer the fragment packet until the first fragment packet arrives at the computer, processing to send the fragment packet that has been buffered up to the beginning when the head fragment packet arrives, and the head In order to execute processing for caching layer 4 header information when a fragment packet is received, and processing for processing the packet using the cached layer 4 header information when receiving intermediate and final fragment packets Program.

Images