JP5092842B2 - Packet processing apparatus and packet processing method - Google Patents

Description

  The present invention relates to a packet processing device and a packet processing method.

  An IP fragment packet transferred in an IP network refers to a packet that is transmitted by dividing (fragmenting) an IP packet of a size that is too large to be transmitted at once. The size of each IP fragment packet is limited by a size “MTU (Maximum Transmission Unit)” that can be transmitted at a time determined for each physical network.

  In some cases, such a fragmented IP packet may be processed in a network relay device according to a protocol higher than the IP such as the TCP protocol for the entire IP packet before being fragmented. However, among the IP fragment packets, the IP fragment packet that was at the top when it was divided contains information of a protocol header higher than IP (hereinafter referred to as an upper header), but other IP fragments. The packet does not include upper header information. For this reason, conventionally, when processing is to be performed according to a higher-level protocol, processing is performed by reconstructing the IP packet from the IP fragment packet on the relay device.

In the following document, fragmented IP packets are accumulated on the relay device, all fragmented IP packets are accumulated, and the IP packet before fragment processing is reconstructed, and then the entire packet before fragmentation A conventional processing method is disclosed in which processing is performed.
Japanese Patent Laid-Open No. 2005-12698

  However, in the conventional method described above, the entire IP packet is temporarily stored in the buffer of the relay device. Therefore, the relay device needs to include a buffer (a buffer for one IP packet) having the maximum MTU size on the IP network. Furthermore, it is assumed that the IP fragment packets that are accumulated are not all the same IP packets that are fragmented, but that IP fragment packets that are fragmented with other IP packets are received. Therefore, a plurality of buffers having the maximum MTU size as described above need to be provided. Furthermore, since the number of buffers as described above is limited by the limit of the internal memory capacity, when the number of buffers reaches the limit during the reconstruction of the IP packet, the IP fragment packets received thereafter are not No reconfiguration is performed and no processing is performed on the IP packet. In this case, the received IP fragment packet may be discarded.

  As described above, when it is desired to process an IP packet that has been fragmented by a relay device in accordance with a protocol higher than the IP for the entire IP packet that has not been fragmented, a large amount of buffer memory is required. In addition, in order to relax the restriction on the number of fragment packets that can be processed simultaneously, it is necessary to mount more memories, which increases the equipment cost.

  Therefore, the present invention has been made in view of the above problems, and an object of the present invention is to process the entire IP packet before being fragmented according to a protocol higher than IP for an IP fragment packet. It is an object of the present invention to provide a new and improved packet processing apparatus capable of reducing the buffer capacity required when performing the process.

  In order to solve the above-described problem, according to an aspect of the present invention, a combination of a packet identifier, which is a combination of identifiers including information on upper headers, and an identifier not including information on upper headers from a fragment head packet among fragment packets A first fragment identifier is extracted, and an identifier extraction unit that extracts a subsequent fragment identifier that is a combination of identifiers that do not include upper header information from the fragment subsequent packet among the fragment packets, and is extracted by the identifier extraction unit The packet packet is fragmented based on the packet identifier stored in the storage unit and the head and subsequent fragment identifiers. layer Characterized in that it and a search management unit for determining a packet processing according to the higher-layer protocol, the packet processing apparatus is provided.

  The search management unit searches the storage unit based on the packet identifier to determine packet processing for the fragment head packet, and stores a head fragment identifier extracted from the fragment head packet. A first fragment identifier registration unit to be registered with the first fragment identifier, an association unit that associates the first fragment identifier registered with the first fragment identifier registration unit and the packet processing determined with the first fragment processing determination unit, and the fragment subsequent packet A subsequent fragment identifier registration unit that registers the subsequent fragment identifier extracted from the storage unit, and a subsequent fragment that searches for the subsequent fragment identifier registered by the subsequent fragment identifier registration unit based on the head fragment identifier A placement identifier search unit, based on the information associated by said associating unit, and the subsequent fragment processing determination unit for determining a packet processing for the fragment subsequent packets may be provided.

  The subsequent fragment processing determining unit may determine packet processing for the fragment subsequent packet of the subsequent fragment identifier hit by the subsequent fragment identifier searching unit based on the information associated by the associating unit.

  The packet processing device further includes a packet processing execution unit that performs packet processing determined for each of the fragment head packet and the fragment subsequent packet based on the packet processing information determined by the search management unit. Also good.

  When the fragment head packet is received before the fragment subsequent packet, the subsequent fragment processing determining unit detects a head fragment identifier registered in the storage unit corresponding to the subsequent fragment identifier, and the storage unit The packet processing for the fragment subsequent packet of the subsequent fragment identifier may be determined based on the detected head fragment identifier stored in association with the packet and the packet processing.

  When the fragment subsequent packet is received before the fragment head packet, the subsequent fragment identifier registration unit registers the subsequent fragment identifier of the fragment subsequent packet in the storage unit, and the subsequent fragment processing determination unit includes the When a fragment head packet is received, packet processing for the fragment subsequent packet is determined by searching for the subsequent fragment identifier registered in the storage unit based on the head fragment identifier extracted from the fragment head packet. May be.

  In order to solve the above-mentioned problem, according to another aspect of the present invention, a packet identifier that is a combination of identifiers including upper header information from a fragment head packet among received fragment packets and upper header information An identifier extraction step of extracting a first fragment identifier that is a combination of identifiers that does not include an identifier, and extracting a subsequent fragment identifier that is a combination of identifiers that do not include upper header information from the fragment subsequent packets among the fragment packets; and the identifier A storage step for storing the packet identifier extracted by the extraction unit and the head and subsequent fragment identifiers, and a fragment method for the fragment packet based on the stored packet identifier and the head and subsequent fragment identifiers. Wherein the packet processing determining step of determining a packet processing according to the bets of been a layer from the upper layer protocols, in that they are composed, the packet processing method is provided.

  As described above, according to the present invention, it is possible to reduce the buffer capacity required when processing an IP fragment packet according to a protocol higher than IP for the entire IP packet before being fragmented. A new and improved packet processing apparatus is provided.

  Exemplary embodiments of the present invention will be described below in detail with reference to the accompanying drawings. In addition, in this specification and drawing, about the component which has the substantially same function structure, duplication description is abbreviate | omitted by attaching | subjecting the same code | symbol.

(First embodiment)
(System configuration)
First, a first embodiment of the present invention will be described. First, a communication system using the packet processing apparatus 100 according to the present embodiment will be described. FIG. 1 shows an example of a communication system using the packet processing apparatus according to the present embodiment. A packet processing apparatus 100 according to the present embodiment is connected to a computer 20. The packet processing apparatus 100 is connected to the computer 30 via the network 10 such as an IP network. The computer 20 and the computer 30 are all computers that can communicate on a network such as a personal computer, a mobile phone, and a PDA.

  The packet processing apparatus 100 processes an IP fragment packet (hereinafter referred to as a fragment packet) transmitted from the computer 20 according to a protocol higher than the IP for the entire IP packet (hereinafter referred to as a packet) before being fragmented. And transferred to the computer 30 via the network 10. The packet processing device 100 may be, for example, a network switch device such as a router or a layer 3 switch, or may be a security device such as a gateway. In the packet processing device 100, for example, fragment packets are discarded and information in the fragment packets is processed according to a protocol higher than IP.

  The communication system shown in FIG. 1 is an example, and the system configuration of the communication system using the packet processing apparatus 100 of the present embodiment is not limited to the configuration of FIG. For example, FIG. 1 shows only one packet processing device for the sake of simplicity, but there are a plurality of packets between the computer 20 and the network 10 and between the computer 30 and the network 10. There may be a processing device. Further, although only the computer 20 is described as the computer directly connected to the packet processing device, a plurality of computers may be connected to the packet processing device 100.

(IP packet fragment)
Next, the fragment packet processed by the packet processing apparatus 100 according to the present embodiment will be described. FIG. 2 shows an example of a packet fragment. The packet P200 includes a MAC header 201, an IP header 202, an upper header 203, data 204, and an FCS 205. The MAC header 201 is a header related to a data link layer protocol, the IP header 202 is a header related to a network layer protocol, and the upper header 203 is a header related to a protocol higher than the transport layer. FCS 205 is an error detection code.

  In the example of FIG. 2, the packet P200 is divided into fragment packets F210, F220, and F230. Fragment packets F210, F220, and F230 are added with a MAC header and an IP header when they are generated from packet P200, and are sequentially transmitted to the network. Such packet division and fragmentation are repeated until the packet reaches the destination computer by the packet processing device that relays the packet. As a result, the packet is finely divided.

  Depending on the route through which the packet passes, the order of fragmented packets may arrive out of order or may be discarded in the middle of the fragmented packet, but the fragmented IP packet is reconstructed by the destination computer that finally arrives. The This reconfiguration uses information such as MAC address, IP address, etc. and ID, MF, and offset, which are identifiers included in the header of each IP packet described below, while ensuring the uniqueness of the packet. Done.

  The fragment packet F210 is a head fragment packet (hereinafter referred to as a fragment head packet), and includes a MAC header 211, an IP header 212, an upper header 213, data 214, and an FCS 215. The MAC header 211 includes the same information as the MAC header 201 of the packet P200. The upper header 213 includes the same information as the upper header 203 of the packet P200. Data 214 is obtained by dividing data 204 of packet P200. FCS 215 is an error detection code.

  When the fragment packet F210 is generated, the information of the IP header 202 of the packet P200 is processed and the IP header 212 is added to the fragment packet F210. The IP header 212 includes an ID (IDentification) 216, an MF (More Fragment) 217, and an offset 218. ID 216 is an identifier for identifying a packet before being fragmented, and the IDs of fragment packets divided from the same packet have the same value. The value of ID216 is ID1, as shown in FIG.

  The MF 217 is an identifier indicating whether there is a subsequent fragment packet. If the value of MF217 is 0, there is no subsequent fragment packet, and if the value of MF217 is 1, there is a subsequent fragment packet. Since the fragment packet F220 exists after the fragment packet F210, the value MF1 of the MF217 of the fragment packet F210 is MF1 = 1.

  The offset 218 is an identifier indicating the byte position from the top of the packet P200 (the top of the IP header 202) before the fragment packet F210 is fragmented. Since the fragment packet F210 is a fragment head packet, the value OF1 of the offset 218 is OF1 = 0.

  The fragment packet F220 is a subsequent fragment packet (hereinafter referred to as a fragment subsequent packet), and includes a MAC header 221, an IP header 222, data 223, and an FCS 224. Since the fragment packet F220 is a fragment subsequent packet, the information of the upper header is not included in the fragment packet F220. The MAC header 221 includes the same information as the MAC header 201 of the packet P200. Data 223 is obtained by dividing data 204 of packet P200 following data 214 included in fragment packet F210. FCS 224 is an error detection code.

  When the fragment packet F220 is generated, the IP header 222 is added to the fragment packet F220 by processing the information of the IP header 202 of the packet P200. The IP header includes ID 225, MF 226, and offset 227. Since the fragment packet F220 is divided from the same packet P200 as the fragment packet F210, the value of ID225 is the same as the value of ID216 and is ID1. Since the fragment packet F230 exists after the fragment packet F220, the MF226 value MF2 = 1 of the fragment packet F220. Since the fragment packet F220 is a fragment subsequent packet, the value OF2 ≠ 0 of the offset 227.

  The fragment packet F <b> 230 is a fragment subsequent packet, and includes a MAC header 231, an IP header 232, data 233, and FCS 234. Since the fragment packet F230 is a fragment succeeding packet, the information of the upper header is not included like the fragment packet F220. The MAC header 231 includes the same information as the MAC header 201 of the packet P200. Data 233 is data subsequent to data 223 included in fragment packet F220 among data 204 of packet P200. FCS 234 is an error detection code.

  The IP header 232 is added to the fragment packet F230 after the information of the IP header 202 of the packet P200 is processed when the fragment packet F230 is generated. The IP header includes ID 235, MF 236, and offset 237. Since the fragment packet F230 is divided from the same packet P200 as the fragment packets F210 and F220, the value of ID235 is the same as the values of ID216 and ID225 and is ID1. Since there is no fragment packet subsequent to the fragment packet F230, the value MF3 = 0 of the MF 236 of the fragment packet F230 is set. Since the fragment packet F230 is a fragment subsequent packet, the value OF3 ≠ 0 of the offset 237.

(Configuration of packet processing device)
Next, the configuration of the packet processing apparatus according to the present embodiment will be described. FIG. 3 is a functional block diagram of the packet processing apparatus according to the present embodiment. The packet processing apparatus 100 according to the present embodiment includes physical media 110A to 110N, a physical termination unit (MAC / PHY) 120, a received packet processing unit 130, a CAM 140 that is an example of a storage unit, and a network processor (NPU: Network Processing Unit). 150 and a transmission packet processing unit 160.

  The physical medium (port 1) 110A to the physical medium (port N) 110N are physical media including a plurality of external physical interfaces (ports) such as RJ-45 connectors, and are signals from computers connected via a network such as the computer 20. Receive. The received signal is transferred to the physical termination unit 120. In addition, the physical medium (port 1) 110A to the physical medium (port N) 110N transmit the signal received from the physical termination unit 120 to computers connected via a network.

  The physical termination unit 120 performs physical layer (PHY) processing and media access control (MAC) processing on signals received at each port of the physical medium. In the physical termination unit 120, for example, port multiplexing processing is performed. Packets generated as a result of processing by the physical termination unit 120 are transferred to the received packet processing unit 130. The physical termination unit 120 also performs physical layer (PHY) processing and media access control (MAC) processing on the packet received from the transmission packet processing unit 160. A signal generated as a result of the packet received from the transmission packet processing unit 160 being processed by the physical termination unit 120 is transferred to the physical medium (port 1) 110A to the physical medium (port N) 110N.

  The received packet processing unit 130 identifies a packet generated by performing processing in the physical termination unit 120 on the received signal, and performs processing. More specifically, the received packet processing unit 130 performs the following processing. The reception packet processing unit 130 temporarily stores the packet generated by the physical termination unit 120 in a buffer. Next, a plurality of identifiers are extracted from the packet stored in the buffer. Further, whether or not the packet is a fragment packet is identified, and packet processing is performed on each fragment packet without reconfiguring the packet based on the combination of the extracted identifiers. The processing performed here is packet processing according to a protocol higher than IP for the entire packet before fragmentation. A more detailed description of the received packet processing unit 130 will be described later with reference to FIG.

  The CAM 140 is a dedicated search memory that stores a combination of identifiers extracted from fragment packets by the received packet processing unit 130. The CAM 140 stores information for packet identification associated with packet processing in advance. The information stored in the CAM 140 is searched when the received packet processing unit 130 identifies and processes fragment packets. A more detailed description of the CAM 140 will be described later with reference to FIG.

  Based on the packet identified by the received packet processing unit 130, the NPU 150 performs advanced packet processing according to a protocol higher than IP. The processing performed by the NPU 150 may be processing such as security gateway and NAPT conversion. The transmission packet processing unit 160 transfers the packet processed by the NPU 150 to the physical termination unit 120.

(Configuration of received packet processing unit)
Next, the configuration of the received packet processing unit 130 will be described in more detail with reference to FIG. FIG. 4 is a functional block diagram of the received packet processing unit according to the present embodiment. The received packet processing unit 130 includes a packet buffer unit 132, an identifier extraction unit 134, a search management unit 300, and a packet processing execution unit 136.

(Packet buffer 132)
The packet buffer unit 132 is a component such as a buffer memory that temporarily stores packets received from the physical termination unit. The packet received and stored in the packet buffer unit 132 includes a non-fragmented packet, a fragment head packet, and a fragment subsequent packet. An identifier is extracted from the packet stored in the packet buffer unit 132 by the identifier extraction unit 134. Further, the packet stored in the packet buffer unit 132 is processed by the packet processing execution unit 136 based on the packet processing information determined by the search management unit 300. When packet processing completion is notified from the packet processing execution unit 136, the packet buffer unit 132 releases the buffer area in which the packet is stored.

(Identifier extraction unit 134 and extracted identifier)
The identifier extraction unit 134 extracts a plurality of identifiers used for packet identification from the packet stored in the packet buffer unit 132. FIG. 5 is a chart showing an example of identifiers extracted from fragment packets. As shown in Table 250, the plurality of identifiers extracted by the identifier extraction unit 134 include MAC that is a combination of identifiers extracted from the MAC header, and IP and TCP headers that are combinations of identifiers extracted from the IP header. An upper header that is a combination of identifiers extracted from an upper header such as IP, and an ID, MF, and offset for identifying a fragment packet are included.

  Table 250 illustrates identifiers extracted from fragment packets F210, F220, and F230 described in FIG. Hereinafter, each identifier shown in Table 5 will be described. The ID, MF, and offset for identifying the fragment packet are identifiers for identifying the fragment packet described with reference to FIG.

  The information contained in the MAC headers 211, 221 and 231 of the fragment packets F210, F220 and F230 is the same as described with reference to FIG. The combination data of identifiers such as MAC addresses extracted from these MAC headers is indicated by MAC1.

  The information included in the IP headers 212, 222, and 232 of the fragment packets F210, F220, and F230 is obtained by partially processing the information of the IP header 202 of the packet P200 as described with reference to FIG. is there. IP1 is combination data of identifiers such as IP addresses that are common to these IP headers, extracted from the IP headers 212, 222, and 232 of the fragment packets F210, F220, and F230.

  UP1 indicates combination data of identifiers extracted from a header higher than IP such as a TCP header included in a fragment packet F210 which is a fragment head packet.

  The plurality of identifiers extracted by the identifier extraction unit 134 are used to determine packet processing in the search management unit 300. In the present embodiment, the search management unit 300 uses the following combinations of identifiers among the plurality of identifiers.

  The “packet identifier” is a combination of identifiers including information on the upper header extracted from the fragment head packet by the received packet processing unit 130. Referring to the fragment packet F210 described in FIG. 2, the packet identifier 252 is extracted from the fragment packet F210 and is composed of MAC1, IP1, and UP1.

  The “head fragment identifier” is a combination of identifiers that are extracted from the fragment head packet by the received packet processing unit 130 and do not include information on the upper header. Referring to the fragment packet F210 described in FIG. 2, the head fragment identifier 254 is extracted from the fragment packet F210 and is composed of MAC1, IP1, and ID1.

  The “subsequent fragment identifier” is a combination of identifiers that are extracted from the fragment subsequent packet by the reception packet processing unit 130 and do not include information on the upper header. Referring to the fragment packet F220 described with reference to FIG. 2, the subsequent fragment identifier 256 is extracted from the fragment packet F220 and is composed of MAC1, IP1, and ID1. The same applies to the fragment packet F230 described with reference to FIG. 2, and the subsequent fragment identifier 258 is extracted from the fragment packet F230 and includes MAC1, IP1, and ID1.

(Search management unit 300)
Returning to FIG. 4, the search management unit 300 searches various information such as an identifier stored in the CAM 140 based on the packet identifier, the head fragment identifier, and the subsequent fragment identifier extracted by the identifier extraction unit 134, and processes the packet. To decide. First, the search management unit 300 identifies whether the packet received by the packet buffer unit 132 is a fragmented packet or a non-fragmented packet based on the identifier extracted by the identifier extraction unit 134. To do. If the received packet is an unfragmented packet, the search management unit 300 determines packet processing for the packet, and notifies the packet processing execution unit 136 of the determined packet processing information.

  When the packet received by the packet buffer unit 132 is a fragmented packet, the search management unit 300 determines whether the fragment packet is a fragment head packet based on the identifier extracted by the identifier extraction unit 134. Identifies whether it is a fragment subsequent packet. Thereafter, the search management unit 300 performs processing by the functional units described below, and determines packet processing for the fragment head packet and the fragment subsequent packet.

  The search management unit 300 includes a head fragment processing determination unit 302, a head fragment identifier registration unit 304, an association unit 306, a subsequent fragment processing determination unit 308, a subsequent fragment identifier registration unit 310, and a subsequent fragment identifier search unit 312. Hereinafter, the fragment head packet is referred to as a fragment packet F210, a fragment subsequent packet received after the fragment head packet is referred to as a fragment packet F220, and a fragment subsequent packet received prior to the fragment head packet is referred to as a fragment packet F230. To do. That is, the packet buffer unit 132 receives packets in the order of the fragment packet F230, the fragment packet F210, and the fragment packet F220.

(First fragment processing determination unit 302)
The head fragment processing determination unit 302 searches the packet identifier entry 142 of the CAM 140 based on the packet identifier 252 and determines packet processing for the fragment packet F210. More specifically, the head fragment processing determination unit 302 searches the packet identifier entry 142 stored in the CAM 140 based on the packet identifier 252, and the search result that matches (hits) the identifier registered in the packet identifier entry. Is notified to the packet processing execution unit 136. Here, the packet identifier entry 142 is a table registered in advance for associating a combination of identifiers corresponding to the packet identifiers extracted from the packets by the identifier extraction unit 134 with packet processing. For example, the identifier combination may be registered in association with one entry number in the packet identifier entry 142, and the entry number may be associated with a corresponding packet process in another pre-registered table. . Therefore, the search result includes packet processing information for the fragment packet F210.

(First fragment identifier registration unit 304)
The leading fragment identifier registration unit 304 registers the leading fragment identifier 254 extracted from the fragment packet F210 in the fragment identification entry 144 of the CAM 140. The leading fragment identifier 254 registered in the fragment identifier entry 144 is associated with the packet processing of the fragment packet F210 by the associating unit 306. The head fragment identifier 254 registered in the fragment identifier entry 144 is searched by the subsequent fragment processing determining unit 308 when the packet buffer unit 132 receives a fragment packet F220 that is a fragment subsequent packet.

(Association unit 306)
The associating unit 306 associates the head fragment identifier 254 registered by the head fragment identifier registering unit 304 with the packet processing for the fragment packet F210 determined by the head fragment processing determining unit 302. At this time, the association information described above is stored in the subsequent packet entry table 146 of the CAM 140. More details will be described later with reference to FIG. The information stored in the subsequent packet entry table 146 by the associating unit 306 is searched by the subsequent fragment processing determining unit 308, and the search result is used for determining packet processing for the fragment packets F220 and F230, which are fragment subsequent packets.

(Subsequent fragment processing determination unit 308)
The subsequent fragment processing determining unit 308 determines packet processing for the fragment packets F220 and F230, which are fragment subsequent packets, based on the information associated by the associating unit 306. The packet processing determination for the fragment packet F220 will be described in more detail. The subsequent fragment processing determination unit 308 searches the fragment identifier entry 144 based on the subsequent fragment identifier 256 extracted from the fragment packet F220. Based on the search result, the subsequent fragment processing determination unit 308 determines packet processing for the fragment packets F220 and F230. When the first fragment identifier 256 of the fragment packet F210 is registered in the fragment identifier entry 144 (that is, when the fragment packet F210 has already been received), the search is hit, and the packet processing for the fragment packet F220 is determined. The Conversely, if the first fragment identifier 256 is not registered in the fragment identifier entry 144 (that is, if the fragment packet F210 has not yet been received), the search does not hit and packet processing is not determined.

(Subsequent fragment identifier registration unit 310)
The subsequent fragment identifier registration unit 310 receives the fragment identifier 258 extracted from the fragment packet F230 of the CAM 140 when the subsequent fragment identifier registration unit 310 receives the fragment subsequent packet before the fragment head packet. Registered in the completed subsequent packet entry table 148. The received subsequent packet entry 148 in which the subsequent fragment identifier is registered by the subsequent fragment identifier registration unit 310 is searched by the subsequent fragment identifier search unit 312.

(Subsequent fragment identifier search unit 312)
The subsequent fragment identifier search unit 312 searches the received subsequent packet entry 148 registered by the subsequent fragment identifier registration unit 310 based on the head fragment identifier 254 extracted from the fragment packet F210. Based on the search result, the subsequent fragment processing determination unit 308 determines packet processing for the fragment subsequent packet F220. When the subsequent fragment identifier 256 of the fragment packet F220 is registered in the received subsequent packet entry 148, the search is hit, so that the subsequent fragment processing determining unit 308 does not process the packet stored in the packet buffer unit 132. Packet processing is determined for the fragment packet F220. Conversely, if the subsequent fragment identifier 256 is not registered in the received subsequent packet entry 148, the search is not hit and no packet processing decision is made for the fragment subsequent packet.

(Packet processing execution unit 136)
The packet processing execution unit 136 performs packet processing based on the packet processing information determined by the search management unit 300. That is, the packet processing is performed based on the search result notified from the search management unit 300. The packet processed by the packet processing execution unit 136 is transferred to the NPU 150. The packet processing execution unit 136 may add the packet processing information determined by the search management unit 300 to the corresponding packet and transfer it to the NPU 150, or the packet processing information determined by the search management unit 300 The processed packet may be transferred to the NPU 150 by performing the process indicated by. When the processing in the packet processing execution unit 136 is completed and the packet is transferred to the NPU 150, the packet processing execution unit 136 notifies the packet buffer unit 132 that the processing of the packet is completed.

(Receive fragment subsequent packet after fragment first packet)
Next, referring to FIGS. 6, 7, 10 </ b> A to 10 </ b> D, and FIGS. 11A and 11B, among the fragmented packets, the first fragment packet is received first, and then the subsequent fragment packet is received. In this case, processing performed by the received packet processing unit according to the present embodiment will be described. FIG. 6 is a flowchart showing the processing for the fragment head packet when the fragment head packet is received first. FIG. 7 is a flowchart showing processing for a fragment subsequent packet when the fragment head packet is received first.

  FIGS. 10A to 10D show the data structure of each table of the CAM 140 that accompanies the processing for the fragment head packet when the fragment head packet is received first. FIG. 10A is a chart showing an example of a data configuration of a packet identifier entry. FIG. 10B is a chart showing an example of the data structure of the fragment identifier entry. FIG. 10C is a chart showing an example of the data configuration of the subsequent packet entry table. FIG. 10D is a chart showing an example of the data structure of the received subsequent packet entry.

  FIG. 11A and FIG. 11B show the data structure of each table of the CAM 140 that accompanies the processing for the fragment subsequent packet when the fragment head packet is received first. FIG. 11A is a chart showing an example of the data structure of a fragment identifier entry. FIG. 11B is a chart showing an example of the data configuration of the subsequent packet entry table. In the following description, it is assumed that the fragment subsequent packet F220 is received after the fragment head packet F210.

(Processing for the first fragment packet received)
First, the process for the first fragment packet received will be described with reference to FIG. 6 and FIGS. 10A to 10D. Signals received at the physical medium (port 1) 110A to physical medium (port N) 110N ports of the packet processing apparatus 100 are processed by the physical termination unit 120, and packets resulting from the processing are received. Received by the packet processing unit 130.

  When the received packet processing unit 130 receives a packet, the received fragment head packet F210 is stored in the packet buffer unit 132 in step S402. Next, in step S404, the identifier extraction unit 134 extracts a plurality of identifiers from the fragment head packet F210 stored in step S402. In step S406, the head fragment processing determination unit 302 searches for the packet identifier entry 142 based on the packet identifier 252 that is a combination of the plurality of identifiers extracted in step S404.

  In the example of FIG. 10A, as a result of the search, the packet identifier 252 matches (hits) the identifier registered in the entry number PE (1) of the packet identifier entry 142, so in step S408, the head fragment processing determination unit 302 Obtains the entry number PE (1) of the packet identifier.

  Next, in step S410, the head fragment processing determination unit 302 notifies the packet processing execution unit 136 of the entry number PE (1) of the packet identifier entry acquired in step S408. The packet processing execution unit 136 performs packet processing on the fragment head packet F210 based on the entry number PE (1) of the notified packet identifier entry. Thereafter, in step S412, the packet processing execution unit 136 notifies the packet buffer unit 132 that the packet processing for the fragment head packet F210 has been completed, and the buffer area corresponding to the fragment head packet F210 stored in the packet buffer unit 132 Is released.

  Next, in step S414, the head fragment identifier registration unit 304 registers the head fragment identifier 254, which is a combination of the plurality of identifiers extracted in step S404, in the fragment identifier entry 144. In the example of FIG. 10B, the head fragment identifier 254 is registered in the entry number FE (1).

  In step S416, the associating unit 306 adds the entry number PE (1) acquired in step S408 to the address that matches the entry number FE (1) in which the first fragment identifier 254 is registered in step S414 in the subsequent packet entry table. Is registered as data.

  Thereafter, in step S418, the subsequent fragment identifier search unit 312 searches for the received subsequent packet entry 148. Since the fragment head packet F210 is first received among the packets fragmented from the packet P200 before being fragmented, the subsequent fragment identifier of the fragment subsequent packet that has already been received is registered in the received subsequent packet entry 148. It has not been. Therefore, the search is not hit, and the processing for the fragment head packet F210 ends.

(Processing for fragment subsequent packets received after the fragment first packet)
Next, processing for a fragment subsequent packet received after the fragment head packet F210 described with reference to FIG. 6 and FIGS. 10A to 10D will be described. Hereinafter, description will be made with reference to FIGS. 7, 11A, and 11B. Signals received at the physical medium (port 1) 110A to physical medium (port N) 110N ports of the packet processing apparatus 100 are processed by the physical termination unit 120, and packets resulting from the processing are received. Received by the packet processing unit 130.

  When the received packet processing unit 130 receives a packet, the received fragment subsequent packet F220 is stored in the packet buffer unit 132 in step S502. Next, in step S504, the identifier extraction unit 134 extracts a plurality of identifiers from the fragment subsequent packet F220 stored in step S502.

  Further, in step S506, the subsequent fragment processing determination unit 308 searches the fragment identifier entry 144 based on the subsequent fragment identifier 256 that is a combination of the plurality of identifiers extracted in step S504. In the fragment identifier entry 144, since the first fragment identifier 254 is already registered in step S414, the search is hit, and in step S508, the subsequent fragment processing determination unit 308 registers the first fragment identifier 254 as a search result. The number FE (1) is acquired.

  Thereafter, in step S510, the subsequent fragment processing determination unit 308 reads data registered in the address of the entry number FE (1) acquired in step S508 of the subsequent packet entry table 146. At this time, the entry number of the packet identifier entry obtained in step S408 is already registered in the subsequent packet entry table 146 in step S416. Therefore, in step S512, the subsequent fragment processing determination unit 308 acquires the same PE (1) as the search result obtained for the fragment head packet F210 in step S408.

  Next, in step S514, the subsequent fragment processing determination unit 308 notifies the packet processing execution unit 136 of PE (1) acquired in step S512. The packet processing execution unit 136 performs packet processing based on the notified PE (1) for the fragment subsequent packet F220. Thereafter, in step S516, the packet processing execution unit 136 notifies the packet buffer unit 132 that the packet processing for the fragment head packet F220 has been completed, and the buffer area corresponding to the fragment head packet F220 stored in the packet buffer unit 132 Is released.

(Receive fragment subsequent packet after fragment first packet)
Next, referring to FIG. 8, FIG. 9, FIG. 12A and FIG. 12B, and FIG. 13A to FIG. 13D, among the fragmented packets, the fragment subsequent packet was received first, and then the fragment head packet was received. In this case, processing performed by the received packet processing unit according to the present embodiment will be described. FIG. 8 is a flowchart showing a process for a fragment subsequent packet when the fragment subsequent packet is received first. FIG. 9 is a flowchart showing processing for a fragment head packet when a fragment subsequent packet is first received.

  FIG. 12A and FIG. 12B show the data structure of each table of the CAM 140 that accompanies the processing for the fragment subsequent packet when the fragment subsequent packet is received first. FIG. 12A is a chart showing an example of the data structure of the fragment identifier entry. FIG. 12B is a chart showing an example of the data configuration of the received subsequent packet entry.

13A to 13D show the data structure of each table of the CAM 140 that accompanies the processing for the fragment head packet when the fragment subsequent packet is received first.
FIG. 13A is a chart showing an example of the data structure of the packet identifier entry. FIG. 13B is a chart showing an example of the data structure of the fragment identifier entry. FIG. 13C is a chart showing an example of the data configuration of the subsequent packet entry table. FIG. 13D is a table showing an example of the data configuration of the received subsequent packet entry. In the following description, it is assumed that a fragment subsequent packet (hereinafter referred to as a fragment packet F240) having MAC2, IP2, and ID2 as subsequent fragment identifiers is received first. After that, it is assumed that a fragment head packet (hereinafter referred to as fragment packet F245) having MAC2, IP2, UP2 as packet identifiers and having MAC2, IP2, ID2 as head fragment identifiers is received.

(Process for the first fragment subsequent packet received)
First, the processing for the fragment subsequent packet received first will be described with reference to FIG. 8 and FIGS. 12A and 12B. Signals received at the physical medium (port 1) 110A to physical medium (port N) 110N ports of the packet processing apparatus 100 are processed by the physical termination unit 120, and packets resulting from the processing are received. Received by the packet processing unit 130.

  When the received packet processing unit 130 receives a packet, the received fragment subsequent packet F240 is stored in the packet buffer unit 132 in step S602. Next, in step S604, the identifier extraction unit 134 extracts a plurality of identifiers from the fragment subsequent packet F240 stored in step S602.

  Further, in step S606, the subsequent fragment processing determination unit 308 searches the fragment identifier entry 144 based on the subsequent fragment identifier that is a combination of the plurality of identifiers extracted in step S604. Since the fragment packet F240, which is a fragment subsequent packet, was received before the fragment packet F245, which is the fragment head packet, the head fragment identifier of the fragment packet F245 is not registered in the fragment identifier entry 144. Therefore, the search does not hit.

  Thereafter, in step S608, the subsequent fragment identifier registration unit 310 registers the subsequent fragment identifier extracted in step S604 in the received subsequent packet entry 148. Here, the fragment packet F240, which is a fragment subsequent packet, is held in the packet buffer unit 132 because packet processing is not performed.

(Processing for fragment head packet received after fragment subsequent packet)
Next, a process for the fragment head packet received after the fragment packet F240 which is the fragment subsequent packet described with reference to FIG. 8 and FIGS. 12A and 12B will be described. Hereinafter, description will be made with reference to FIGS. 9 and 13A to 13D. Signals received at the physical medium (port 1) 110A to physical medium (port N) 110N ports of the packet processing apparatus 100 are processed by the physical termination unit 120, and packets resulting from the processing are received. Received by the packet processing unit 130.

  When the received packet processing unit 130 receives the packet, the received fragment head packet F245 is stored in the packet buffer unit 132 in step S702. Next, in step S704, the identifier extraction unit 134 extracts a plurality of identifiers from the fragment head packet F245 stored in step S702. In step S706, the head fragment processing determination unit 302 searches for the packet identifier entry 142 based on the packet identifier extracted in step S704.

  In the example of FIG. 13A, as a result of the search, the packet identifier matches (hits) the identifier registered in the entry number PE (2) of the packet identifier entry 142, so in step S708, the head fragment processing determination unit 302 The packet identifier entry number PE (2) is acquired.

  Next, in step S710, the head fragment processing determination unit 302 notifies the packet processing execution unit 136 of the entry number PE (2) of the packet identifier entry acquired in step S708. The packet processing execution unit 136 performs packet processing on the fragment head packet F245 based on the entry number PE (2) of the notified packet identifier entry. Thereafter, in step S712, the packet processing execution unit 136 notifies the packet buffer unit 132 that the packet processing for the fragment head packet F245 has been completed, and the buffer area corresponding to the fragment head packet F245 stored in the packet buffer unit 132 Is released.

  Next, in step S714, the head fragment identifier registration unit 304 registers the head fragment identifier extracted in step S704 in the fragment identifier entry 144. In the example of FIG. 13B, the head fragment identifier is registered in the entry number FE (2).

  In step S716, the associating unit 306 adds the entry number PE (2) acquired in step S708 to the address that matches the entry number FE (2) in which the head fragment identifier is registered in step S714 in the subsequent packet entry table. Register as data. Accordingly, the subsequent packet received after the fragment packet F245 can be subjected to packet processing according to the procedure described with reference to FIG. 7, FIG. 11A, and FIG. 11B.

  Thereafter, in step S718, the subsequent fragment identifier search unit 312 searches for the received subsequent packet entry 148. Since the fragment head packet F245 was received after the fragment subsequent packet F240, the subsequent fragment identifier of the fragment subsequent packet F240 that has already been received is registered in the received subsequent packet entry 148. Therefore, the search is a hit, and in step S720, the subsequent fragment identifier search unit 312 acquires the subsequent fragment identifier of the fragment subsequent packet F240 registered in step S608. As a result, the subsequent fragment processing determining unit 308 recognizes that the fragment subsequent packet F240 has already been received.

  Thereafter, in step S722, packet processing is performed on the fragment subsequent packet F240 held in the packet buffer unit 132 based on the subsequent fragment identifier acquired in step S718. In step S722, packet processing for the fragment subsequent packet F240 is performed according to steps S506 to S516 shown in FIG. Thereby, the fragment subsequent packet F240 can acquire the same entry number as the entry number PE (2) of the packet identifier entry acquired in step S708. Therefore, the packet processing execution unit 136 can perform the same packet processing on the fragment subsequent packet F240 as the packet processing performed on the fragment head packet F245.

  As described above, in a packet processing device such as a network relay device, when a fragment packet that passes through is processed according to a protocol higher than IP for the entire packet before being fragmented, the fragment packet is fragmented. There is no need to reassemble previous packets. Therefore, it is not necessary to store all fragmented fragment packets in the buffer memory in order to reconstruct the packet. Further, the fragment head packet and the fragment subsequent packet that arrives after the fragment head packet are processed immediately after being received, and the buffer storing the fragment packet is released immediately. Therefore, the amount of buffer memory can be reduced, and the device cost can be reduced.

  Hereinafter, as an example, when it is desired to simultaneously process 10 packets having a maximum packet size of 10 kilobytes before being fragmented, the buffer memory amounts required in the prior art and this embodiment are compared. Assume that a 10 kilobyte packet is fragmented into 1 kilobyte fragment packets and transmitted over the network.

  The amount of buffer memory required when packet processing is performed by reconfiguring all fragment packets as in the prior art is as follows.

  On the other hand, in the packet processing apparatus according to the present embodiment, when fragmented and arrive at the apparatus in order from the first packet, the fragment packet is processed immediately after arrival. Therefore, the required buffer memory amount is one fragment packet size per packet. Therefore, the amount of buffer memory required when processing 10 packets simultaneously is as follows.

  Thus, in the case of the example described above, the amount of buffer memory required in the packet processing apparatus 100 according to the present embodiment can be reduced to 1/10 of the conventional amount.

  Furthermore, as described above, since the packet processing apparatus 100 according to the present embodiment processes a packet immediately after receiving a fragment packet, the time for which the packet is stored in the buffer is short. Therefore, it is possible to suppress the latency that occurs when the packet is transmitted to the packet processing apparatus 100.

  The preferred embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to such examples. It is obvious that a person having ordinary knowledge in the technical field to which the present invention pertains can come up with various changes or modifications within the scope of the technical idea described in the claims. Of course, it is understood that these also belong to the technical scope of the present invention.

  In this embodiment, as elements constituting a fragment identifier for identifying a fragment packet, combination data of an identifier such as a MAC address extracted from the MAC header and combination data of an identifier such as an IP address extracted from the IP header The fragment ID (ID) is used, but the configuration of the fragment identifier is not limited to this. For example, identifier combination data extracted from the MAC header may not be used. Further, for example, other identifiers such as MF and offset may be used.

1 is a system configuration diagram illustrating an example of a communication system using a packet processing device according to a first embodiment of the present invention. It is explanatory drawing which shows an example of the fragment of a packet. It is a functional block diagram of the packet processing apparatus concerning the 1st Embodiment of this invention. FIG. 3 is a functional block diagram of a received packet processing unit according to the first embodiment of the present invention. It is a chart which shows an example of the identifier extracted from a fragment packet. It is a flowchart which shows the process with respect to a fragment head packet. It is a flowchart which shows the process with respect to a fragment subsequent packet. It is a flowchart which shows the process with respect to a fragment subsequent packet. It is a flowchart which shows the process with respect to a fragment head packet. It is the table | surface which showed an example of the data structure of a packet identifier entry. It is the table | surface which showed an example of the data structure of a fragment identifier entry. It is the table | surface which showed an example of the data structure of a subsequent packet entry table. It is the table | surface which showed an example of the data structure of the received subsequent packet entry. It is the table | surface which showed an example of the data structure of a fragment identifier entry. It is the table | surface which showed an example of the data structure of a subsequent packet entry table. It is the table | surface which showed an example of the data structure of a fragment identifier entry. It is the table | surface which showed an example of the data structure of the received subsequent packet entry. It is the table | surface which showed an example of the data structure of a packet identifier entry. It is the table | surface which showed an example of the data structure of a fragment identifier entry. It is the table | surface which showed an example of the data structure of a subsequent packet entry table. It is the table | surface which showed an example of the data structure of the received subsequent packet entry.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Packet processing apparatus 130 Reception packet processing part 132 Packet buffer part 134 Identifier extraction part 136 Packet processing execution part 140 CAM
DESCRIPTION OF SYMBOLS 300 Search management part 302 First fragment process determination part 304 First fragment identifier registration part 306 Association part 308 Subsequent fragment process determination part 310 Subsequent fragment identifier registration part 312 Subsequent fragment identifier search part

Claims (7)

From fragments leading packet among the fragmented packets, and a packet identifier is a combination of identifiers including the information in the header of the fragmented upper layer than the fragmented layer information of the header of the lower layer from the layer, the lower layer A first fragment identifier, which is a combination of identifiers including the header information of the upper layer and not including the header information of the higher layer, and including the header information of the lower layer from the fragment subsequent packet of the fragment packets. An identifier extraction unit that extracts a subsequent fragment identifier that is a combination of identifiers not including layer header information;
A storage unit that stores the packet identifier extracted by the identifier extraction unit, and the head and subsequent fragment identifiers;
The stored packet identifier in the storage unit, and the head and on the basis of the subsequent fragment identifier, with respect to the fragment packet, the search management unit for determining a packet processing according to the higher layer protocol,
A packet processing apparatus comprising: The search management unit
A leading fragment processing determining unit that searches the storage unit based on the packet identifier to determine packet processing for the fragment leading packet;
A leading fragment identifier registration unit for registering a leading fragment identifier extracted from the fragment leading packet in the storage unit;
An associating unit for associating the first fragment identifier registered in the first fragment identifier registering unit with the packet processing determined by the first fragment processing determining unit;
A subsequent fragment identifier registration unit for registering a subsequent fragment identifier extracted from the fragment subsequent packet in the storage unit;
A subsequent fragment identifier search unit for searching for a subsequent fragment identifier registered in the subsequent fragment identifier registration unit based on the head fragment identifier;
A subsequent fragment processing determining unit that determines packet processing for the fragment subsequent packet based on the information associated by the associating unit;
The packet processing device according to claim 1, comprising:   The subsequent fragment processing determining unit determines packet processing for the fragment subsequent packet of the subsequent fragment identifier hit by the subsequent fragment identifier search unit based on the information associated by the associating unit. Item 3. The packet processing device according to Item 2. Furthermore, on the basis of the search information of the packet processing determined by the management unit, characterized in that it comprises a packet processing execution unit for the determined packet processing respectively the fragment head packet and the fragment subsequent packets The packet processing device according to claim 1. When the fragment head packet is received before the fragment succeeding packet,
The subsequent fragment processing determining unit detects a leading fragment identifier registered in the storage unit corresponding to the subsequent fragment identifier, and the detected leading fragment identifier and packet processing stored in association with the storage unit; The packet processing apparatus according to claim 2, wherein packet processing for the fragment subsequent packet of the subsequent fragment identifier is determined based on the packet. When the fragment subsequent packet is received before the fragment head packet,
The subsequent fragment identifier registration unit registers the subsequent fragment identifier of the fragment subsequent packet in the storage unit,
The subsequent fragment processing determination unit searches the subsequent fragment identifier registered in the storage unit based on a head fragment identifier extracted from the fragment head packet when the fragment head packet is received, 3. The packet processing device according to claim 2, wherein packet processing for the fragment subsequent packet is determined. From fragments leading packet among the received fragment packets, a packet identifier is a combination of identifiers including the information in the header of the fragmented upper layer than the fragmented layer information of the header of the lower layer from the layer, the includes information in the header of the lower layer was extracted with head fragment identifier is a combination of identifiers does not include the information in the header of the upper layer, from the fragment subsequent packets of the fragmented packets, the information in the header of the lower layer An identifier extraction step for extracting a subsequent fragment identifier that is a combination of identifiers that does not include the header information of the upper layer ,
Before Ki抽 out packet identifier, and a storage step of storing the leading and trailing fragment identifier,
The stored packet identifier, and, based on the leading and trailing fragment identifier, with respect to the fragment packet, the packet processing determining step of determining a packet processing according to the protocol of the upper layer,
A packet processing method comprising:

Images