CN100391155C - Port adaptater network-analyzer - Google Patents

Abstract

Methods and devices are provided for encapsulating FC frames from a network device as Ethernet frames. Preferably, the FC frames represent traffic for a plurality of ports of the network device. The encapsulated Ethernet frames may be input to a conventional network interface card of a personal computer (''PC'') or laptop. Therefore, encapsulating the FC frames allows an engineer to use software installed on a conventional PC to troubleshoot problems with a network using FC protocol. According to some aspects of the invention, FC frames may be truncated to various degrees, to allow smaller data frames to be output at an appropriate rate to the analyzing personal computer, laptop, etc.

Description

The method and apparatus that is used for the assistant analysis network traffics

Technical field

Relate generally to network management of the present invention specifically, relates to the problem that solves the network equipment that uses fiber channel (" FC ") agreement.

Background technology

The network equipment can break down once in a while.These faults can cause congested and other negative effects of flow on network equipment shutdown, the network.When these faults occurred, network manager need be analyzed the flow on one or more network equipments, so that deal with problems.In addition, in other situations, also answer the phase-split network flow, for example during the system upgrade, when foundation is used for the network of monitoring network or the like.

The FC agreement is used to storage area network and similar network just more and more.A kind of such equipment that is used as the structural network equipment of storage area network is the multi-layer data switch of being made by Cisco Systems Inc. (" MDS ").Data enter the MDS of FC agreement via the FC port, and data are gone out via the MDS of FC port from the FC agreement.Therefore, when network manager need solve the problem of the network equipment that uses the FC agreement, the frame of FC agreement must be caught and analyze to the employed equipment of this network manager.(term " frame " and " grouping " are equal to use here.)

At present, the equipment that is known as the FC analyzer can be used to catch and analyze the data from the FC port.The FC analyzer is configured to receive the FC frame from the network equipment, and allows observation such as engineer, network manager and analyze this FC frame.By analyzing the FC frame and determining the type of error that this FC frame is associated, can derive the problem that network exists usually.Yet the FC analyzer is very expensive.Therefore, wish to have a kind of so not expensive equipment to come the FC frame is analyzed.

Summary of the invention

Provide the FC frame that is used for automatic network equipment in future to be encapsulated as the method and apparatus of ethernet frame.Preferably, the FC frame is represented the flow of a plurality of ports of the network equipment.Encapsulated Ethernet frames can be imported into traditional network interface unit of personal computer (" PC ") or kneetop computer.Therefore, encapsulation FC frame has allowed the engineer to use traditional PC to go up the problem that installed software solves the network that uses the FC agreement.

According to some aspect of the present invention, the FC frame can be blocked to some extent, to allow with suitable speed to less Frames of output such as the personal computer of analyzing, kneetop computers.The preferred embodiments of the present invention are used in combination with switching port analyzer (" SPAN ") or remote span (" RSPAN ") feature, and this has allowed to monitor easily the network traffics by fibre channel interface.The work of SPAN pattern allows to be replicated by the flow of any fibre channel interface of the network equipment, and is passed to the single port on the consolidated network equipment.The flow that the RSPAN permission is duplicated is passed to the port on the remote network equipment.

According to some aspect of the present invention, provide a kind of method that helps phase-split network equipment.This method comprises the steps: to receive fiber channel frame from first port of the network equipment; Fiber channel frame is encapsulated as ethernet frame; And output ethernet frame.

This method can also comprise with port arrangement being the step of switching port analyzer pattern, and wherein first port is exported such fiber channel frame, and these fiber channel frame have been duplicated the flow of at least the second port of the network equipment.Encapsulation step can comprise the whole fiber channel frame of encapsulation, perhaps only is the part of fiber channel frame.This method can also comprise the step that adds data to fiber channel frame.

This method can also comprise the step that fiber channel frame is converted to the signal of telecommunication from light signal.This method can also comprise the step of the input speed of adjusting fiber channel frame and/or adjust the step of the output speed of ethernet frame.

According to other aspects of the invention, provide the another kind of method that helps phase-split network equipment.This method comprises the steps: to receive fiber channel frame from first port of the network equipment, and wherein fiber channel frame comprises the flow from least one other port of the network equipment; Fiber channel frame is encapsulated as ethernet frame; And output ethernet frame.

This method can also comprise with port arrangement being the step of switching port analyzer pattern, and wherein this port is exported such fiber channel frame, and these fiber channel frame are duplicated the flow of the every other port of this network equipment.Encapsulation step can comprise the whole fiber channel frame of encapsulation, perhaps only is the part of fiber channel frame.This method can also comprise the step that adds data to fiber channel frame.

This method can comprise the step that fiber channel frame is converted to the signal of telecommunication from light signal.This method can also comprise the step of the input speed of adjusting fiber channel frame and/or adjust the step of the output speed of ethernet frame.

According to some aspect of the present invention, provide a kind of device that helps phase-split network equipment.This device comprises following parts: first port that is used for receiving from the network equipment fiber channel frame; Be used for fiber channel frame is encapsulated as at least one processor of ethernet frame; With second port that is used to export ethernet frame.In some such embodiment, one or more in the processor can encapsulate whole fiber channel frame, perhaps only are the parts of fiber channel frame.

This device can comprise the transducer that is used for fiber channel frame is converted to from light signal the signal of telecommunication.This device can also comprise first adjuster of the input speed that is used to adjust fiber channel frame and/or be used to adjust second adjuster of the output speed of ethernet frame.This device can also be determined the suitable speed to another equipment output ethernet frame.

According to other embodiments of the invention, provide a kind of and be included in computer program in the machine readable media to help phase-split network equipment.This computer program comprises the instruction that is used for control device execution following steps: receive fiber channel frame from first port of the network equipment; Fiber channel frame is encapsulated as ethernet frame; And output ethernet frame.

These and other feature of the present invention is described below with reference to the accompanying drawings.

Description of drawings

Fig. 1 shows the network diagram of the art methods of phase-split network equipment.

Fig. 2 shows the block diagram of an apparatus in accordance with one embodiment of the invention.

Fig. 2 A shows the block diagram of device according to another embodiment of the present invention.

Fig. 3 is the front view of an apparatus in accordance with one embodiment of the invention.

Fig. 4 is the rear view of an apparatus in accordance with one embodiment of the invention.

Fig. 5 has indicated the thumb-acting switch of equipment (dip switch) according to an embodiment of the invention to be provided with and the table of mode of operation.

Fig. 6 shows the block diagram of the internal part of equipment according to an embodiment of the invention.

Fig. 7 has indicated according to the present invention the input and output frame of " non-truncated mode " duration of work of some aspect.

Input and output frame when Fig. 8 shows in " the Ethernet truncated mode " aspect some according to the present invention use equipment.

Input and output frame when Fig. 9 shows in " shallow truncated mode " use equipment.

Figure 10 shows the input and output frame that is used for " degree of depth truncated mode " work.

Figure 11 shows the management packet format.

Figure 12 shows the block diagram of the parts of employed processor in the certain embodiments of the invention.

Embodiment

Fig. 1 shows phase-split network equipment and solves the method for the prior art of its problem.Network 100 comprises structure 105, and this structure 105 comprises the network equipment 110,115 and 120.The network equipment 110,115 and 120 can be the network equipment of any kind of the structure that can be used to form fibre channel networks well known in the prior art.On behalf of personal computer or user, node 125 and 130 can be used for similar devices with structure 105 mutual (for example, for the data in the accessing storage device 135).

The expanded view of the network equipment 120 shows fiber channel port 140,145 and 150.In this example, the network equipment 120 is the aforesaid MDS equipment of being made by Cisco Systems Inc..

Traditional fiber channel analyzer 155 receives fiber channel frame from the port one 50 of the network equipment 120.FC analyzer 155 comprises fiber channel host bus adaptor (" HBA "), and this is a kind of expensive component.Therefore, the overall cost of FC analyzer 155 is sizable.

Fig. 2 shows the device that is used to analyze fiber channel frame according to some embodiment of the present invention.In Fig. 2, the port one 40 and 145 of the network equipment 120 is configured to from/other network equipment reception/transmission fiber channel frame to structure 105.Yet in this embodiment, port one 50 has been configured to switching port analyzer (" SPAN ") pattern, and this is the proprietary mode by Cisco Systems Inc.'s exploitation.

When port was configured to work in the SPAN pattern, grouping was from port (outlet) output, but port can not receive any frame.In addition, port is not current control usually.In addition, do not need and between the external equipment of the port received frame that is configured to the SPAN pattern, work, set up the FC link.On the contrary, the output of data just looks like that data have been placed on the circuit, does not shake hands and carry out.

Therefore, some embodiment of equipment 205 does not have FC media interviews controls (" MAC ").Yet other embodiment of equipment 205 have MAC, and are not can be used when being operated in the SPAN pattern at port one 50 for example.

Equipment 205 receives FC frame 210 via FC port 212 from the network equipment 120.SPAN one or more source ports or flow is copied to the destination port from one or more VSAN from VSAN are to analyze.Therefore, though equipment 205 receives FC frame 210 from port one 50, the operation of SPAN pattern allows these frames to be transmitted from port one 40 and/or 145.In other words, when port one 50 is operated in the SPAN pattern, comprise that the copy (comprising the flow on port one 40 and/or 145) of the FC frame of some or all flow on the equipment 120 can be received by equipment 205.

Other embodiment of the present invention comprise the configuration of the equipment 120 that is used for RSPAN work, allow equipment 205 to monitor flow on one or more switches by network remote thus.

Except other things, equipment 205 also encapsulates FC frame 210, and via ethernet port 214 encapsulated Ethernet frames 215 is outputed to analytical equipment 220.Equipment 220 can be common personal computer, kneetop computer etc., and it comprises Ethernet HBA card 225.Then, equipment 220 for example by 230 downloaded software from the internet, can be analyzed frame 215.This software includes but not limited to Ethereal network analyzer (light network analyser), according to " source code is open " software of GNU permission agreement issue.

Fig. 2 A shows the embodiment that does not need port one 50 is configured to the equipment 205 that SPAN or RSPAN operation just uses.In this embodiment, equipment 205 comprises FC port 212 and 240, and they allow the flow between the network equipment 120 and 250 to pass through equipment 205.Be encapsulated as ethernet frame 215 by the FC frame 210 that any receives in FC port 212 or 240, and be output to analytical equipment 220 via ethernet port 214.

Fig. 3 and Fig. 4 show equipment 205 according to an embodiment of the invention.The layout and the parts that one skilled in the art will appreciate that equipment 205 can be different greatly, and keep within the spirit and scope of the present invention.For example, in this embodiment, the indicating device of equipment 205 uses light-emitting diode (" LED "), but also can use light, switch, dial, knob or other indicating devices well known in the art of any kind.

Fig. 3 is the stereogram that illustrates the front of equipment 205.This embodiment of equipment 205 comprises positioning indicator 305, and its indication power supply is opened or closed.Fiber channel port 310 is used to receive FC frame 210 from the network equipment 120.Link indicating device 315 indication FC links are logical or disconnected.320 indications of FC speed indicator are from the data flow of the network equipment 120.For example, indicating device 320 can indicate the FC link to work in 1Gbps pattern or 2Gbps pattern.

Ethernet port 325 is used to analytical equipment 220 output ethernet frames 215.Indicating device 330 is lighted when the conducting of 100Mbps ethernet link, and flicker when ethernet frame transmits on this ethernet link.Indicating device 335 is lighted when the conducting of 1Gbps ethernet link, and flicker when frame transmits on this link.

Fig. 4 is the stereogram that illustrates according to the back side of the equipment 205 of an embodiment.Thumb-acting switch 405 can be used to configuration device 205 in every way, below with reference to Fig. 5 this is described.Input 410 can be used as the power input mouth, for example 12 Fu Zhiliudianyuanshuruduankou.

Fig. 5 is the table of having indicated the mode of operation of the thumb-acting switch setting of switch 405 and equipment 205.To those skilled in the art, be clear that, can use other equipment and configuration that mode of operation and configuration device 205 in a different manner are set.For example, the mode of operation that describes below (for example, the pattern (if any) of (truncation) amount is blocked in definition) only is the example of multiple possible mode of operation, and never limits the scope of the invention.

In addition, other embodiment of some of equipment 205 can receive the expectant control frame from FC side or Ethernet side joint.Control frame comprises about the new desirable pattern and/or the information of configuration.According to some such embodiment, control frame is by field (for example, in the head of the frame) sign of appointment.Preferably, control frame comprises authentication information.In case receive control frame, equipment 205 is new model and/or configuration by the control frame appointment with its pattern from old pattern and/or configuration change.

According to some embodiment of the present invention, the control frame FC frame 210 that to be equipment 205 receive via port one 50 a kind of.Equipment 205 is control frame with this frame identification, and therefore this control frame is not forwarded to equipment 220.On the contrary, equipment 205 reads other fields of control frame, to obtain pattern and/or the configuration information by this control frame indication, to use when the frame that receives is subsequently handled.

According to various embodiment, control frame can comprise some or all of following message: 1) IP address, thus the frame that receives subsequently can be routed to the internet; 2) filtering frames information, its indicating equipment 205 should leach (abandoning) some frame frame of one or more source addresses (for example, from); 3) ports filter information, its control appliance 205 leaches these frames based on the port that frame is associated; 4) destination-address is used for being included in subsequently grouping by equipment 205; 5) truncated mode information, its control appliance 205 switches to truncated mode, and described truncated mode can be as described in reference to figure 8～11, or other truncated modes; 6) beginning and Stop message, its indicating equipment 205 should begin or stop to Ethernet side transmit frame based on this information; And 7) " Hello " grouping information, its indicating equipment 205 will generate " Hello " grouping, and periodically send it to the Ethernet side, to move to equipment 220 announcement apparatus 205.

In other embodiments, thumb-acting switch 405 has other configurations that extra switch holds other fiber channel patterns, truncated mode or equipment 205.

As shown in the figure, the fiber channel pattern of 505 indication 1Gbps is set, and indicating equipment 205 will work in management mode.According to some aspect of the present invention, equipment 205 sends the ethernet frame of fixed size when being in management mode, and this frame comprises internal debugging information.When being in management mode, equipment 205 will can not accepted fiber channel frame.The information that is comprised in the ethernet frame that is transmitted during management mode belongs to the internal work of equipment 205.To management mode be described in further detail with reference to Figure 11.

The fiber channel pattern of 510 indication 1Gbps is set, and indicating equipment 205 will work in degree of depth truncated mode (" DTM ").In DTM, equipment 205 causes the most serious the blocking of fiber channel frame.Of the present invention aspect some in, equipment 205 blocks the FC frame by frame sign being reduced to maximum 64 bytes.To the work of degree of depth truncated mode be described in further detail with reference to Figure 10.

515 indexed optical fiber channelling modes are set will be with the speed operation of 1Gbps, and equipment 205 will work in shallow truncated mode (" STM ").In STM, if the size of FC frame more than 256 bytes, is then blocked the FC frame.The shallow truncated mode of work will be described in further detail with reference to figure 9.

520 indexed optical fiber channelling modes are set will have the speed of 1Gbps, and equipment 205 will work in Ethernet truncated mode (" ETM ").Because the largest amount of ethernet frame 215 is 1520 bytes (expense that comprises 24 bytes) normally, be 1496 bytes so FC frame 210 blocks.

The fiber channel pattern setting of 525 indication 1Gbps and the truncated mode of NTM (meaning " non-truncated mode ") are set.In NTM, the payload of FC frame 210 is not carried out any modification ground and transmit FC frame 210.Therefore, equipment 220 must can be supported huge ethernet frame 215, so that the NTM mode of operation is suitably moved.

The fiber channel pattern of 530 indication 2Gbps and the degree of depth truncated mode of work are set.The fiber channel pattern of 535 indication 2Gbps and the shallow truncated mode of work are set.540 indications 2 are set

The fiber channel pattern work of Gbps speed, and equipment 205 will work in the Ethernet truncated mode.The fiber channel pattern of 545 indication 2Gbps and the truncated mode of NTM are set.

Fig. 6 shows the block diagram of the parts of equipment 205.One skilled in the art will appreciate that in other embodiments illustrated some parts of Fig. 6 can be merged, separate or remove or the like.Parts shown in Figure 6 have defined specific architecture, and this architecture may be different with the architecture of other aspects and embodiment according to the present invention.In this example, port one 50 sends to port 310 by optical fiber 600 with FC frame 210.The light signal of transducer 605 conversion FC frames 210, and convert them to electric pulse.These equipment comprise special-purpose laser usually, and when illumination was mapped on these lasers, they generated electric pulse.Transducer 605 for example can be an Agilent HFBR-5720L transducer.

Interface 610 contrary serializations are then carried out decoding (for example, 8/10 decodings) if required from the data that enter of transducer 605, and provide data (for example, 8 bit data) to processor 615.According to an embodiment, processor 615 is field programmable gate array (" FPGA ") processors, but can use any suitable processor.For example, other embodiment of the present invention use one or more application-specific integrated circuit (ASIC)s (" ASIC "), the programmable logic device (" PLD ") such as electrically programmable logical device (" EPLD "), microprocessor etc., rather than the FPGA processor.

Processor 615 provides the frame of fiber channel frame 210 to resolve and encapsulation.To describe processor 615 in detail with reference to Figure 12.Processor 615 for example can be the part able to programme from the Xilinx Virtex II FPGA of family processor (such as XC2V1000-5 or XC2V500-4).Except other, processor 615 provides management interface 630 to element 610 and 635.

In this embodiment, equipment 205 comprises serial EEPROM chip 620, is used to store source MAC and other information.Chip 620 for example can be an Atmel AT93C46 chip.Preferably, chip 620 is byte-addressable (byte-addressable).In some such embodiment, chip 620 has 512 addresses altogether.For example, if the data of transmission increase progressively with 2 bytes between chip 620 and fpga chip 615, then chip 620 can be organized as 256 16 bit address.

In this embodiment, equipment 625 comprises serial PROM chip, is loaded into the program mirror image of equipment 615 when being used for being stored in energising.Equipment 625 can be the PROM of Xilinx XC18V00ISP family for example, such as XC18V04.This equipment provides serial loading and loaded in parallel configuration mode, and with all Xilinx FPGA compatibilities.

The FC frame that equipment 615 will be encapsulated on interface 640 in the ethernet payload sends to equipment 635.Interface 640 is industry standard interfaces---be respectively applied for the Media Independent Interface (MII) or the G bit Media Independent Interface (GMII) of 100Mbps and 1Gbps Ethernet.

In this embodiment, equipment 635 is integrated G bit ethernet transceivers, and this is the physical layer equipment that is used for 100/1000 Ethernet.Equipment 635 for example can be the integrated 10/100/1000G bit of Marvell 88E1011S Ethernet transceiver.Equipment 635 sends ethernet frame to equipment 645 on interface 650.

Interface 650 also is an industry standard interface---medium dependent interface (MDI).The ethernet frame that equipment 645 is used to receive on MDI sends to physical interface.

In this embodiment, this physical interface can be CAT 5UTP (5 a class unshielded twisted pair) copper cable.Equipment 645 for example can be RJ45 equipment, and it can be converted to the MDI signaling suitable physical interface signaling.To those skilled in the art, be clear that other equipment can be used for above-mentioned work, such as SFP (miniature pluggable module) and optical fiber, rather than RJ45 and copper cable.

In this embodiment, provide 12 volts of power supplys from external source by importing 410.Converter circuitry of power 655 comprises voltage regulator, is used for each component distribution electric power to equipment 205.

Clock 660 generates the time signal that is used to control various parts.In one embodiment, clock 660 generates the 25MHz signal, and sends it to processor 615.In certain embodiments, clock 660 sends the 106.25MHz signal to element 610.One skilled in the art will appreciate that these clock speeds are exemplary, and can use any clock speed easily (or a plurality of speed).

Ethernet port 325 is to analytical equipment 220 output ethernet frames 215.As mentioned above, ethernet frame 215 can be sent to analytical equipment 220 with various speed.For example, as mentioned above, ethernet frame 215 can perhaps if desired, then can transmit with other speed with the speed rates of 100Mbps or 1Gbps.Preferably, equipment 205 will be indicated the transmission speed of ethernet frame 215.In certain embodiments, indicating device 330 and 335 is indicated 100Mbps transmission rate or 1Gbps transmission rate respectively.

Input FC frame 210 when Fig. 7 shows equipment 205 and works in the NTM pattern and output ethernet frame 705.Ethernet frame 705 is examples of ethernet frame 215 shown in Figure 2.When equipment 205 is in the NTM pattern, the payload of FC frame is not transmitted the FC frame with making amendment, as shown in Figure 7.When FC frame 210 had largest amount, ethernet frame 705 was with the overgauge ethernet frame.Therefore, equipment 220 must can read huge ethernet frame when equipment 205 works in the NTM pattern.

Ethernet head 710 indication frame initial (" SOF ") types, but the SOF data are not directly to copy to the output ethernet frame in this embodiment.Ethernet head 710 comprises Ethernet destination-address (" EDA ").In this embodiment, EDA and ethernet source address (" ESA ") are 6 amount of bytes that are split as 2 row.Here, ESA is the MAC Address of processor 615.In a preferred embodiment, EEPROM 620 will comprise the MAC Address of each chip, and they all are to be read when energising.

The SOF type field is 4 bit fields in this embodiment.The FC agreement provides 12 kinds of dissimilar SOF.Therefore, the SOF type field comprises the corresponding encoded of each SOF type.

The VSAN field indication that has 12 in this embodiment is from the VSAN information of FC frame 210.In a preferred embodiment, if frame 210 is detected as (" the EISL ") type that has extended inter-switch link, then equipment 205 will copy in this field from the VSAN field of FC frame.U.S. Patent application No.10/034, the description to EISL in 160 is incorporated into this with for referencial use for all purposes.According to some aspect of the present invention, if FC frame 210 is not the EISL form, then this field comprises complete zero.

According to some aspect of the present invention, when equipment 205 worked in non-truncated mode, all fields of FC frame 210 (from the EISL field to the FC crc field) were all packed and be included in the ethernet frame 215.Yet the EOF field 725 of FC frame 210 is not hunted down, but its type is coded in the Ethernet afterbody 720.Ethernet afterbody 720 preferably also comprises crc field.

In this embodiment, frame end (" EOF ") type field is 4 byte field, and comprises EOF information, type of error and classified counting information.The FC agreement provides 10 kinds of dissimilar EOF, and therefore the present invention has different codings to every kind of EOF type.In addition, some aspect of the present invention comprises extra coding.For example, according to an aspect of the present invention, when in the FC frame, having control character, provide " no EOF type " coding.In addition, some aspect of the present invention provides (when for example not detecting EOF in the FC frame) employed coding when the FC frame becomes " huge ".

In this example, 8 EOF type field is used to the type of error coding.It will be apparent to one skilled in the art that the field that is used for the type of error coding can have greater or lesser size.According to an aspect of the present invention, 8 corresponding to following type of error: frame inner control character; Huge FC frame; FIFO is full; Bad FC CRC; Block frame; Free of data; With empty frame.1 is reserved other purposes of work.

When entering FC frame 210 and do not comprise data, " empty frame " position is set.Have SOF and EOF but the FC frame that does not have data between the two then is provided with this position if receive.

According to some aspect of the present invention, " free of data " position when only comprising the data (or still less) of 24 bytes between SOF and EOF, the FC frame is set.When pattern when being ETM, STM or DTM and FC frame, " blocking frame " position is set greater than the maximum that allows.In this case, the FC frame will be blocked, and " blocking frame " position will be set.

If FC frame 210 comprises bad CRC, " bad FC CRC " will be set then.Preferably, even when frame is blocked (for example, in ETM, STM or DTM pattern),, and " bad " FC CRC is set if applicable words are also checked FC CRC.

Equipment 205 comprises that at least one is used to enter the buffer of FC frame 210.When this buffer full, " FIFO is full " position is set.When FC moves with identical speed with the Ethernet side, this situation can not appear.Yet, when the speed of service of fiber channel was higher, " FIFO is full " situation may appear.Preferably, before storage FC frame 210, equipment 205 determines whether that enough memories can be used to store FC frame 210.If buffer does not have enough spaces, then abandon FC frame 210.Yet if lost EOF, FC frame 210 may become greater than being confirmed as available expection size.In this situation, " FIFO is full " situation may appear.

If EOF loses, then also another situation may occur: FC frame 210 may become greater than the FC frame of largest amount." huge frame " position in this situation, will be set.Yet, when " huge frame " incident occurring, be not to need to be provided with " FIFO is full " position, this is because buffer still has enough spaces and stores huge frame.According to some aspect of the present invention, need not to wait for the EOF that detects FC frame 210, just can stop huge frame.The EOF type field will be labeled " huge frame type ".

According to some aspect of the present invention, when frame finishes with the control character in the FC frame, be provided with " no EOF type error ".According to some this aspect of the present invention, the EOF type field also will be indicated this situation, as mentioned above.

Fig. 8 shows the encapsulation of FC frame 210 when equipment 205 works in the Ethernet truncated mode.This process uses FC frame 210 as input, and output ethernet frame 805, and this ethernet frame 805 is a kind of of ethernet frame 215 shown in Figure 2.The head 810 of ethernet frame 805 is similar to the head of describing with reference to figure 7 710.Afterbody 830 is also suitable with afterbody 720.

Main difference between ETM pattern and the NTM pattern is that payload 815 can be blocked based on its size in the ETM pattern.In the ETM pattern, equipment 205 will block fiber channel frame, so that it is up to 1496 bytes.Maximum ethernet frame size is 1520 bytes normally, and wherein 24 bytes are expenses, thus the FC frame need to be blocked be 1496 bytes.Yet,, will can not block this frame if the FC frame is 1496 bytes just.On the contrary, payload 815 and FC crc field 825 are with packed.Yet if the FC frame is bigger, FC crc field 825 will be left in the basket, and data field 815 may be blocked.Therefore, the data field 820 of ethernet frame 805 is up to 368 row or 1472 bytes.

Fig. 9 shows the STM work of equipment 205.In STM,, then block this frame if the size of FC frame 210 surpasses 256 bytes (64 row).If FC data field 815 be 63 the row or still less, then crc field 825 will be included in output ethernet frame 905 in.Otherwise crc field will be blocked.Head 910 and afterbody 930 are suitable with the afterbody 730 of the head of describing with reference to figure 7 710.

Figure 10 shows the degree of depth truncated mode of the work of some aspect according to the present invention.In degree of depth truncated mode,, then block this frame if FC frame 210 surpasses 64 bytes.If data field 815 is 64 bytes or still less, then crc field 825 is with packed and be included in the output grouping 1005.Head 1010 is suitable with afterbody 730 with above-mentioned head 710 with afterbody 1030.

Figure 11 shows according to the present invention some aspect by the form of the grouping that equipment generated 1105 that works in " management mode ".According to some aspect of management mode work, the ethernet frame that equipment 205 sends the fixed size (for example, 288 bytes) that includes the Debugging message relevant with equipment 205 is managed being used for.In a preferred embodiment, when working in management mode, equipment 205 will can not accepted FC frame 210.The disparate modules of inner packet generator piece slave unit 205 is collected relevant information, these information is assembled into grouping, and it is sent with form shown in Figure 11.The grouping 1105 that it will be apparent to one skilled in the art that extended formatting also within the scope of the invention.

In this example, head 1110 comprises destination and source address information and type information.Type information obtains from IEEE, and should be all identical to all equipment 205.The actual classified counting numerical value of packet count field 1115 indications.According to some aspect of the present invention, in management mode, send grouping at the beginning, just begin this numerical value.According to some aspect of the present invention, grouping numerical value can circulate after reaching certain restriction.

Field 1120 indicates whether to have mistake and reads EEPROM 620.The version number of field 1125 indicating equipments 205.According to some aspect of the present invention, field 1125 can be indicated the version number of specific features (such as FPGA 615).

Field 1130 is data fields.According to some aspect of the present invention, field 1130 comprises the content of EEPROM 620.According to some such aspect of the present invention, the part of data field 1130 is reserved (for example, last 8 bytes).

Field 1135 is cyclic redundancy codes of the grouping that calculates.In a preferred embodiment, will calculate CRC to the value that is comprised in 1105 the field of dividing into groups.

Figure 12 shows the block diagram according to the parts of the processor 615 of certain embodiments of the invention.It will be apparent to one skilled in the art that in other embodiments the illustrated square frame of Figure 12 can be merged, separate or remove or the like.Square frame shown in Figure 12 has defined concrete architecture, and this can change in other embodiments of the invention.If the architecture of processor 615 changes, then the function of processor 615 may change maybe and may remain unchanged.

Double Data Rate (" DDR ") piece 1205 main being responsible for are converted to haploidy number according to speed data with the Double Data Rate data.For example, if the FC interface is then imported the DDR data with the speed of 53.125MHz in certain embodiments of the present invention with the speed operation of 1Gbps.For the FC interface rate of 2Gbps, corresponding clock speed is 106.25MHz.

Fibre channel interface (" FIF ") piece 1210 is main carry out the DDR clocks (in certain embodiments of the present invention its with 53.125 or the speed operation of 106.25MHz) and the core clock (clock 660 of FPGA, in certain embodiments of the present invention, it is with the operation of speed of 125MHz) between synchronously.FIF piece 1210 and DDR piece 1205 and piece 1215 join by interface.

In certain embodiments of the present invention, when data arrived FIF piece 1210, they were imported in the asynchronous buffer device, and do not carry out the data check or the filtration of any kind.According to one embodiment of present invention, buffer is the fifo buffer of 16 dark, 20 bit wides, and it can accept 20 data in each clock.If read the speed that the speed of data among the FIFO is written into faster than these data in an embodiment, even then have only 2 such buffers, " FIFO is full " can not appear yet.

Piece 1215 receives data from FIF piece 1210.According to some aspect of the present invention, piece 1215 receives 10 bit data block from FIF piece 1210.According to some embodiment, piece 1215 is with the clock work of 125MHz, therefore with the speed of 125MHz from FIF piece 1210 reading of data.Therefore, only when the buffer non-NULL of piece 1210, piece 1215 is just from FIF piece 1210 reading of data.

Whether piece 1210 also check data is any SOF type.According to some aspect of the present invention, if received data are not one of SOF types, then piece 1215 will not carry out any action.Whether yet if received data are SOF types, this SOF type will be as top decoded as described in usually, and be verified, have enough spaces to store at least one fiber channel frame in the pattern that is disposed in buffer to check.

According to some aspect of the present invention, when equipment 205 worked in the NTM pattern, whether piece 1215 checks were had living space and are stored the frame of largest amount.If there is not the space in the buffer, then classified counting will increase, and this frame will be dropped.Piece 1215 will be waited for next frame then.

Piece 1215 can also check next data whether to comprise any EOF coding.If satisfy all conditions, then store these data.According to some aspect of the present invention, when receiving EOF, piece 1215 will be notified FFC piece 1225.When FFC piece 1225 indication CRC states, FFC piece 1225 will form " EOF type " data block for buffer, and these data are written in the memory block 1220.In these cases, the CRC information of received grouping, no matter its quality all can be embedded in " EOF type " field.These data will be written in the MEM piece 1220 then.

Fiber channel frame checker (" FFC ") the piece 1225 main CRC that are responsible for the received FC frame of verification.These data for example receive from piece 1215 by 32 bit data interface.When receiving " EOF type " indication, FFC piece 1225 passes through relatively CRC data of this frame (for example, preceding 4 bytes) and the current C RC that has just calculated, and generates the crc error sign.

The function class of FFC piece 1225 is similar to the function of ECG piece 1235.Yet it is different being calculated by these two CRC that piece carried out or carried out.The CRC that is carried out by FFC piece 1225 does not comprise the type field of EDA, ESA and ethernet frame from the fiber channel frame of reality.

Piece 1215 writes data in the memory block 1220.EIF piece 1230 is from memory block 1220 reading of data.

Ethernet interface (" EIF ") piece 1230 main being responsible for, and output ethernet frame 215 from memory block 1220 reading in packet data.In a preferred embodiment, EIF piece 1230 is carried out automatically with equipment 1220 and is consulted, with the speed of physical link that need between the equipment 205 and 220 to determine to set up.According to some embodiment of the present invention, EIF piece 1230 will be with the speed transmitting grouped data of 25MHz or 125MHz.In certain embodiments of the present invention, EIF piece 1230 also calculates CRC to the ethernet frame that receives from memory block 1220, and this CRC information is appended to the ending of the frame of the equipment that will send to 220.

SPAN and RSPAN

Because some embodiment of the present invention comprises configuration and is used for the additional port of SPAN or RSPAN work, this part is set forth some details about these correlation techniques.Below paragraph in the information set forth represented SPAN when drafting basic technical documentation and " snapshot " of RSPAN.The ability that it will be apparent to one skilled in the art that SPAN and RSPAN is continuing development.Therefore, will can not be suitable for the future that is limited in a lot of clear and definite or hint of SPAN and RSPAN.

SPAN

SPAN (being also referred to as " local span " here) monitors the network traffics by fibre channel interface.Flow by any fibre channel interface can be copied to the private port that is called as SPAN destination port (SD port).Any fiber channel port in the switch can be configured to the SD port.In case interface is in the SD port mode, then it can not be used to conventional data traffic.

The SD port is received frame not.On the contrary, they only transmit the copy of SPAN source flux.The SPAN feature is glitch-free, and does not influence the exchange of the network traffics of any SPAN source port.

The SPAN source is referring to interface that can monitor traffic from it.Also can specify VSAN is the SPAN source, and in this situation, all interfaces of being supported all are included in the SPAN source in specified VSAN.Can select the SPAN flow in Way in, Way out or this both direction of any source interface.

The flow that enters switching fabric by the inlet source interface is extended (span) or is copied to the SD port.

When VSAN was designated as the source, all physical ports and port channel (PortChannel) all were included in the SPAN source among this VSAN.Have only when the port VSAN of relaying E port (" TE port ") and source VSAN coupling, just comprise this TE port.Even the permission VSAN that is disposed tabulation may have source VSAN, but port VSAN is not simultaneously, does not comprise the TE port yet.

Following criterion is suitable for when VSAN is configured to the source.At first, the flow on the total interface that comprises among the VSAN of source only is extended at Way in.When VSAN is designated as the source, can not be to other configuration of interface executive's interface level that comprises among this VSAN.The SPAN special interface information of previous configuration is dropped.If the interface among the VSAN is configured to the SPAN source, then this VSAN can not be configured to the source.On the contrary, before VSAN is configured to the source, must at first remove the existing SPAN configuration on this interface.Only when port VSAN and source VSAN coupling, interface just is included in the source.

Related and various other designated parameter between a destination and the one group of source are represented in each span session, with the monitoring network flow.A destination can be used by one or more span sessions.At present, in a switch, can dispose nearly 16 span sessions.Each session can have several source ports and a destination port.In order to activate span session, at least one source and SD port must start, and operation.Otherwise flow will can not be directed into the SD port.

Can carry out filtration, optionally to monitor the network traffics of specifying on the VSAN based on VSAN.The source that the VSAN filter can be applied to choosing perhaps is applied to sources all in the session.When configuration VSAN filter, have only the flow among the VSAN that is chosen to be extended.Current, can specify two types VSAN filter, they are called as " interface level filter " and " session filter ".Interface level VSAN filter can be applied to the TE port or the trunking port channel of appointment, to filter the flow in Way in, Way out or this both direction.The institute that the session filter filters in the specified session is active.The session filter is two-way, and is applicable to that the institute that disposes in the session is active.

If there is not the given filter device, then the flow from all movable VSAN of this interface all is extended.Effective filter on the port is the intersection point (filter that both have) of interface filter and session filter.Though in interface, can specify any VSAN filter, can only be on the movable VSAN of the port VSAN of this interface or permission monitor traffic.When VSAN is configured to the source, this VSAN by implicitly as specify comprise among the VSAN active interface filter.

In some configuration, SPAN sends a plurality of copies of identical sources flow to the destination port.For example, have two SPAN sources (being known as s1 and s2) in the configuration of the two-way span session (entrance and exit) of SPAN destination port (being known as d1), if grouping enters switch by s1, and be sent to s2 from switch, then send the copy of this grouping to SPAN destination d1, and the outlet SPAN of s2 sends the copy of this grouping to SPAN destination d1 at the inlet SPAN of s1.If this grouping is the second layer grouping that is switched to s2 from s1, then these two SPAN groupings will be the same.If this grouping is the 3rd layer of grouping that is switched to s2 from s1, then the 3rd layer rewrites the second layer address that changes source and destination, and in this case, these two SPAN groupings are with difference.

RSPAN

RSPAN is a kind of like this method, utilizes this method, and the copy of the flow that is monitored is sent to the port on the remote exchange, rather than the port on the local switch.For the copy of the flow that will be monitored is transferred to remote exchange, can encapsulate the frame that is duplicated, to pass through Network Transmission.Encapsulation can have all kinds, for example uses VSAN (or VLAN), use FC capsule header or the IP/GRE capsule header or the MPLS capsule header of separating.U.S. Patent application No.10/346,050 has described the RSPAN that strengthens, and the full content of this application is incorporated into this for all purposes.

Though illustrate and described the present invention particularly with reference to specific embodiments of the invention, it should be appreciated by those skilled in the art, can not break away from the spirit or scope of the present invention the form and the details of the disclosed embodiments made a change.For example, can recognize that at least a portion function of being carried out by FPGA 615 as described herein can be carried out by one or more equipment, for example, is carried out by the microprocessor of another kind of type, is carried out or the like by the cluster microprocessor.In addition, it will also be appreciated that other embodiment of equipment 205 can accept the incoming frame of the extended formatting outside the FC protocol format.Similarly, other embodiment of equipment 205 can export the frame of the extended formatting outside the Ethernet protocol form.In addition, the function that other equipment outside the said equipment can actuating equipment 220.For example, these functions can be carried out by the equipment such as work station.Consider these and other variation, scope of the present invention should be determined with reference to claims.

Claims (25)

1. method that is used for the flow on the assistant analysis network comprises:

Receive fiber channel frame from first port of first network equipment, described fiber channel frame comprises the copy of the whole fiber channel frame that received by second port;

Described fiber channel frame is encapsulated as ethernet frame; With

The described ethernet frame that output is used to analyze.

2. the method for claim 1, wherein said second port is the part of second network equipment, perhaps described second port is the part of described first network equipment.

3. the method for claim 1, also comprise with described port arrangement being the step of switching port analyzer pattern, the such fiber channel frame of wherein said first port output, these fiber channel frame have been duplicated the flow of at least one other port of described first network equipment.

4. the method for claim 1, wherein said encapsulation step comprises the only part of packaged fiber channel frame.

5. the method for claim 1 also comprises the step of the input speed of adjusting described fiber channel frame.

6. the method for claim 1 also comprises the step of the output speed of adjusting described ethernet frame.

7. the method for claim 1, wherein said fiber channel frame comprises the copy from all flows of at least one other port of described first network equipment.

8. device that is used for the assistant analysis network traffics, described device comprises:

First port is used for receiving fiber channel frame from first network equipment, and described fiber channel frame comprises the copy of the whole fiber channel frame that received by the 3rd port;

At least one processor is used for described fiber channel frame is encapsulated as ethernet frame; With

Second port is used to export the described ethernet frame that is used to analyze.

9. device as claimed in claim 8, the part that the part that wherein said the 3rd port is second network equipment or described the 3rd port are described first network equipments.

10. device as claimed in claim 8, wherein said at least one processor is the part of packaged fiber channel frame only.

11. device as claimed in claim 8 also comprises adjuster, is used to adjust the input speed of described fiber channel frame.

12. device as claimed in claim 8 also comprises adjuster, is used to adjust the output speed of described ethernet frame.

13. device as claimed in claim 8 wherein can dispose described device according to the control frame that is received by described device.

14. device as claimed in claim 8 also comprises the 4th port, is used for receiving fiber channel frame from second network equipment, wherein at least one processor will be encapsulated as ethernet frame from the fiber channel frame of described first port and described the 4th port.

15. device as claimed in claim 12, wherein processor is determined the output speed of described ethernet frame to another equipment.

16. device as claimed in claim 13, wherein said control frame are the fiber channel frame that receives from the described network equipment via described first port.

17. device as claimed in claim 13, wherein said control frame are the ethernet frames that receives via described second port.

18. device as claimed in claim 13, wherein said control frame comprises Internet Protocol address, thereby the frame that receives subsequently can be routed to described internet.

19. device as claimed in claim 13, wherein said control frame comprises filtering frames information, and described filtering frames information indicates described device to abandon frame from one or more source addresses.

20. device as claimed in claim 13, wherein said control frame comprises ports filter information, and the port that the described device of described ports filter information Control is associated based on frame comes out these filtering frames.

21. device as claimed in claim 13, wherein said control frame comprises destination-address, is used for making described device that described destination-address is included in the grouping of transmission subsequently.

22. device as claimed in claim 13, wherein said control frame comprises truncated mode information, and the truncated mode that the described device of described truncated mode information Control comes basis to be scheduled to is blocked and entered fiber channel packet.

23. comprising, device as claimed in claim 13, wherein said control frame be used to control the information that described device stops to export ethernet frame.

24. comprising, device as claimed in claim 13, wherein said control frame be used to control the information that described device begins to export ethernet frame.

25. a device that is used for the assistant analysis network traffics comprises:

Be used for receiving the device of fiber channel frame from first port of the network equipment;

The part of payload that is used to abandon each fiber channel frame is to produce the device of intercepted fiber channel frame;

Be used for described intercepted fiber channel frame is encapsulated as the device of ethernet frame; With

Be used to export the device of the described ethernet frame that is used to analyze.

Images