CN108683615B

CN108683615B - Message distribution method and device and distribution switch

Info

Publication number: CN108683615B
Application number: CN201810399111.2A
Authority: CN
Inventors: 王明辉; 闫波
Original assignee: New H3C Technologies Co Ltd
Current assignee: New H3C Technologies Co Ltd
Priority date: 2018-04-28
Filing date: 2018-04-28
Publication date: 2022-03-11
Anticipated expiration: 2038-04-28
Also published as: CN108683615A

Abstract

According to the message distribution method, the message distribution device and the distribution switch, the distribution multicast groups corresponding to the service groups are configured in advance, when the message to be distributed is received, a corresponding mirror image is generated for each distribution multicast group according to the message to be distributed, and then the mirror image message is sent according to the preset ACL matched on the exchange network board or the output port. Therefore, the message to be shunted is firstly copied in a mirror image mode, and then the ACL rule is matched to select the output port, so that the ACL quantity to be configured is reduced under the condition that the output ports are the same in quantity, and the problem that the ACL resource is possibly insufficient when the output ports are too much can be solved.

Description

Message distribution method and device and distribution switch

Technical Field

The present disclosure relates to the field of network communication technologies, and in particular, to a message distribution method and apparatus, and a distribution switch.

Background

In some communication scenarios, the offload switch may need to copy a received packet into multiple copies, and send the copied packets to different service devices for processing according to communication characteristics of the packets (e.g., MAC information or port information carried by the packets). For example, referring to fig. 1, in the network security system, a plurality of service groups may be included, where different service groups are used to perform different security processing operations, each service group includes a plurality of service devices, and each service device corresponds to one output port of the secondary offloading device. After receiving the message from the primary shunting device, the secondary shunting device selects the message to be copied and sent to one or more service groups according to the communication characteristic information of the message, and determines which output port of the service groups to send to. Generally, the secondary offloading device is preconfigured with an Access Control List (ACL), and after receiving a message, searches for a corresponding egress port in the ACL according to communication feature information of the message, and then copies and redirects the message to the egress ports for transmission.

In a message flow distribution scheme adopted in the prior art, a corresponding output port combination is usually searched in a preset ACL according to communication characteristic information of a message, and then the message is copied and redirected to the output ports for sending. For example, if there are 4 service groups accessing the shunting switch for message shunting, a message with communication feature X1 needs to be copied to output port 1.3 of service group 1 and output port 3.2 of service group 3 for transmission, and a message with communication feature X2 needs to be copied to output port 1.3 of service group 1 and output port 2.1 of service group 2 for transmission, an ACL for recording the correspondence between communication feature X1 and output ports 1.3 and 3.2 and an ACL for recording the correspondence between communication feature X2 and output ports 1.3 and 2.1 need to be configured, as shown in table 1.

TABLE 1

Communication features	Service group 1	Service group 2	Service group 3	Service group 4
					X1	Outlet port 1.3	Outlet port 3.2
X2	Outlet port 1.3	Outlet port 2.1

The more the service devices accessing the secondary shunt device, the more the ACL number to be configured, but the limited ACL resources of the secondary shunt device, that is, one secondary shunt device can only support configuring a certain number of ACLs, and when the number of service devices accessing the secondary shunt device is too large, the ACL resources of the secondary shunt device may be insufficient, which results in that the secondary shunt device cannot smoothly perform message shunt operation. For example, in the above scheme, if each service group in 4 service groups of the device accessing the communication corresponds to 255 egress ports, there are 256^4 possible port combinations, that is, 256^4 ACLs are needed to fully cover all possibilities, but a general switch does not support configuring such a large number of ACLs.

Disclosure of Invention

In a first aspect, the present disclosure provides a packet offloading method, applied to an offloading switch, where the offloading switch includes a receiving interface board that receives a packet to be offloaded and a switching network board connected to the receiving interface board; the distribution switch is configured with a plurality of distribution multicast groups corresponding to each service group respectively, and each distribution multicast group comprises an interconnection port connected with the receiving interface board and the switching network board; the method comprises the following steps:

receiving a message to be distributed through the receiving interface board, mirroring the message to be distributed to each distribution multicast group, and generating a mirror message corresponding to each distribution multicast group;

multicasting the mirror image message, so that the mirror image message is sent to the exchange network board through the interconnection port, wherein the mirror image message carries the multicast ID of the shunt multicast group corresponding to the mirror image message;

searching a corresponding output port in an access control list configured in advance by the exchange network board according to the communication characteristic information and the multicast ID carried by the mirror image message, and sending the mirror image message through the searched output port when the corresponding output port is searched

In a second aspect, the present disclosure provides a packet offloading method, applied to an offloading switch, where the offloading switch is configured with a plurality of offloading multicast groups respectively corresponding to each service group, and the offloading multicast group includes an egress port of a service group corresponding to the offloading multicast group; the method comprises the following steps:

receiving a message to be distributed, mirroring the message to be distributed to each distribution multicast group, and generating a mirror message corresponding to each distribution multicast group;

multicasting each mirror image message to a corresponding output port;

and aiming at each output port, detecting whether the received mirror image message is allowed to be sent from the output port or not according to the communication characteristic information carried by the mirror image message and an access control list pre-configured for the output port, and sending the mirror image message when detecting that the mirror image message is allowed to be sent from the output port.

In a third aspect, the present disclosure provides a packet offloading device, applied to an offloading switch, where the offloading switch includes a receiving interface board for receiving a packet to be offloaded and a switching network board connected to the receiving interface board; the distribution switch is configured with a plurality of distribution multicast groups corresponding to each service group respectively, and each distribution multicast group comprises an interconnection port connected with the receiving interface board and the switching network board; the device comprises:

the mirror image module is used for receiving the messages to be distributed through the receiving interface board, mirroring the messages to be distributed to each distribution multicast group and generating mirror image messages corresponding to each distribution multicast group;

a multicast module, configured to multicast the mirror image packet, so that the mirror image packet is sent to the switching network board through the interconnection port, where the mirror image packet carries a multicast ID of a multicast group corresponding to the mirror image packet;

and the sending module is used for searching a corresponding output port in an access control list configured in advance by the exchange network board according to the communication characteristic information and the multicast ID carried by the mirror image message, and sending the mirror image message through the searched output port when the corresponding output port is searched.

In a fourth aspect, the present disclosure provides a packet offloading device, which is applied to an offloading switch, where the offloading switch is configured with a plurality of offloading multicast groups respectively corresponding to each service group, and each offloading multicast group includes an egress port of a service group corresponding to the offloading multicast group; the device comprises:

the mirror image module is used for receiving a message to be distributed, mirroring the message to be distributed to each distribution multicast group and generating a mirror image message corresponding to each distribution multicast group;

the multicast module is used for multicasting each mirror image message to a corresponding output port;

and the sending module is used for detecting whether the received mirror image message is allowed to be sent from the output port or not according to the communication characteristic information carried by the mirror image message and the access control list pre-configured for the output port aiming at each output port, and sending the mirror image message when detecting that the mirror image message is allowed to be sent from the output port.

In a fifth aspect, the present disclosure provides a offload switch, including a processor and a machine-readable storage medium, where the machine-readable storage medium stores machine-executable instructions executable by the processor, and the processor executes the machine-executable instructions to implement the packet offload method provided in the present disclosure.

Compared with the prior art, the method has the following beneficial effects:

according to the message distribution method, the message distribution device and the distribution switch provided by the embodiment of the invention, through pre-configuring the distribution multicast groups corresponding to the service groups, when receiving the message to be distributed, a corresponding mirror image is generated for each distribution multicast group according to the message to be distributed, and then the mirror image message is sent according to the preset ACL matched on the switching network board or the output port. Therefore, the message to be shunted is firstly copied in a mirror image mode, and then the ACL rule is matched to select the output port, so that the ACL quantity to be configured is reduced under the condition that the output ports are the same in quantity, and the problem that the ACL resource is possibly insufficient when the output ports are too much can be solved.

Drawings

To more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings that are required to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present disclosure and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings may be obtained from the drawings without inventive effort.

Fig. 1 is a schematic diagram of a message splitting scenario;

fig. 2 is a schematic flow diagram of a message distribution method according to an embodiment of the present disclosure;

fig. 3 is a schematic diagram of a framed breakout switch provided by an embodiment of the present disclosure;

fig. 4 is a schematic diagram of a principle of a message splitting method according to an embodiment of the present disclosure;

fig. 5 is a second schematic flow chart of the message distribution method according to the embodiment of the present disclosure;

fig. 6 is a second schematic diagram of the message splitting method according to the second embodiment of the present disclosure;

fig. 7 is a schematic hardware structure diagram of a offload switch provided in the embodiment of the present disclosure;

fig. 8 is a schematic diagram of a functional module of a packet offloading device according to an embodiment of the present disclosure.

Icon: 100-a tap changer; 110-a message diversion apparatus; 111-mirror module; 112-multicast module; 113-a sending module; 120-a memory; 130-a processor.

Detailed Description

To make the objects, technical solutions and advantages of the embodiments of the present disclosure more clear, the technical solutions of the embodiments of the present disclosure will be described clearly and completely with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are some, but not all embodiments of the present disclosure. The components of the embodiments of the present disclosure, generally described and illustrated in the figures herein, can be arranged and designed in a wide variety of different configurations.

Thus, the following detailed description of the embodiments of the present disclosure, presented in the figures, is not intended to limit the scope of the claimed disclosure, but is merely representative of selected embodiments of the disclosure. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.

It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.

In the description of the present disclosure, it should be noted that the terms "first", "second", "third", and the like are used only for distinguishing the description, and are not to be construed as indicating or implying relative importance.

Furthermore, the terms "horizontal", "vertical", "overhang" and the like do not imply that the components are required to be absolutely horizontal or overhang, but may be slightly inclined. For example, "horizontal" merely means that the direction is more horizontal than "vertical" and does not mean that the structure must be perfectly horizontal, but may be slightly inclined.

In the description of the present disclosure, it should also be noted that, unless otherwise explicitly specified or limited, the terms "disposed," "mounted," "connected," and "connected" are to be construed broadly, e.g., as meaning either a fixed connection, a removable connection, or an integral connection; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meaning of the above terms in the present disclosure can be understood in specific instances by those of ordinary skill in the art.

The present embodiment provides a flow distribution switch, where the flow distribution switch at least includes an ingress port connected to a previous layer of flow distribution device and used for receiving a message to be distributed, and a plurality of egress ports connected to a service device and used for sending the distributed message. Each service group corresponds to a plurality of output ports of the shunt switch, and for each service group, a message with a certain communication characteristic is sent to the service equipment from one output port in the service group at most for processing. The communication characteristics of the message may include MAC information, port identification or IP address of the message, etc.

In the first case, the shunting switch may be a frame-type switch, including a receiving interface board for receiving the message to be shunted and a switching network board connected to the receiving interface board. The flow distribution exchanger is pre-configured with a plurality of flow distribution and multicast groups corresponding to each service group, and each flow distribution and multicast group comprises an interconnection port connected with a receiving interface board and a switching network board. Accordingly, referring to fig. 2, the present embodiment further provides a message splitting method applied to the foregoing situation, where the method at least includes steps S210 to S230.

Step S210, receiving the to-be-distributed packet by the receiving interface board, and mirroring the to-be-distributed packet to each distribution multicast group to generate a mirrored packet corresponding to each distribution multicast group.

Specifically, the distribution switch may receive the message to be distributed through the ingress port, mirror the message to be distributed to each distribution multicast group according to a mirroring rule configured in advance on the ingress port, and generate a mirror message corresponding to each distribution multicast group.

Step S220, multicast the mirror image packet, so that the mirror image packet is sent to the switching network board through the interconnection port, where the mirror image packet carries the multicast ID of the split multicast group corresponding to the mirror image packet.

Step S230, according to the communication feature information and the multicast ID carried in the mirror image packet, searching a corresponding egress port in an ACL configured in advance in the switching network board, and when the corresponding egress port is found, sending the mirror image packet through the found egress port.

Specifically, the ACL includes a sending rule item and a reject rule item having a processing priority lower than that of the sending rule item, and the sending rule item is used to record a correspondence between communication characteristic information of the packet and the egress port.

And the shunt switch matches a corresponding sending rule item in an ACL (access control list) pre-configured by the switching network board according to the communication characteristic information and the multicast ID carried by the mirror image message.

And if the corresponding sending rule item is matched, sending the mirror image message to an output port recorded by the sending rule item for sending. If so, converting the mirror message into a unicast message and redirecting to the output port recorded by the sending rule item for sending.

And if the mirror image message is not matched with the corresponding sending rule item, discarding the mirror image message according to the rejection rule item.

To facilitate the understanding of the solution adopted by the embodiment in the above situation for those skilled in the art, the above solution is described below by an example.

The splitter switch may be a frame-type switch, and the splitter switch may include a plurality of communication boards with different functions, such as interface boards, switch boards, and the like. The communication boards are detachably mounted in board interfaces in the main body frame of the shunt switch and communicate with each other through board interconnection circuits in the main body frame.

The shunt switch can be used as a secondary shunt device to be connected between the primary shunt device and the service device. The primary shunting device is used for hashing a message to be shunted and modifying the MAC information of the message according to a preset rule, so that a source MAC and a target MAC of the message to be shunted are correspondingly modified according to a service group, a port and a CPU before the message to be shunted is sent to the secondary shunting device.

Referring to fig. 3, the shunting switch may include a plurality of interface boards and a plurality of switching network boards respectively connected to the plurality of interface boards, where the interface boards are configured to receive messages sent by other devices or send messages to other devices, and the switching network boards are configured to forward a message on one interface board to another interface board for sending. For example, if a message received by the interface board a needs to be sent from the interface board B, the message is sent to one of the switching network boards according to the hash selection of the communication characteristics of the message, and the switching network board receives the message and then sends the message to the interface board B. In this embodiment, an interface board connected to the primary shunting device is used as a receiving interface board, and a port on the receiving interface board connected to the primary shunting device is used as an input port; and taking an interface board connected with the next-stage service equipment as a sending interface board, and taking a port connected with the next-stage service equipment on the sending interface board as an output port.

In this embodiment, a mirror rule is configured on the ingress port, where the mirror rule is used to copy a to-be-shunted packet received by the ingress port for each shunting multicast group, and add multicast IDs of different shunting multicast groups to different mirror packets.

Referring to fig. 4, of the output ports of the shunting switch, output ports 1.1 to 1.N are output ports of the service group 1, output ports 2.2 to 2.N are output ports of the service group 2, output ports 3.1 to 3.N are output ports of the service group 3, and output ports 4.1 to 4.N are output ports of the service group 4.

A shunting switch is also configured with shunting multicast groups corresponding to each service group, wherein the service group 1 corresponds to the shunting multicast group 1, and the multicast ID is 1; the service group 2 corresponds to the split-flow multicast group 2, and the multicast ID is 2; the service group 3 corresponds to the split multicast group 3, and the multicast ID is 3; the service group 4 corresponds to the split multicast group 4, and the multicast ID is 4. The multicast member ports in the 4 shunting multicast groups are all the interconnected ports of the receiving interface board and the exchange network board.

Each switching network board is configured with an ACL in the ingress direction, the ACL records a corresponding relationship between a multicast ID and communication characteristic information and an egress port, that is, when a corresponding ACL rule is searched, two conditions of the multicast ID and the communication characteristic information of a message to be shunted need to be matched. The shunting switch redirects the message received by the switching network board to the corresponding output port for sending according to the multicast ID and the communication characteristic information carried by the message to be shunted.

For example, in a scenario, if a message with communication characteristic X3 needs to be copied to egress port 1.3 and egress port 3.2 for transmission, and a message with communication characteristic X4 needs to be copied to egress port 1.3 and egress port 2.1 for transmission, each switch board is configured with an ACL that records the correspondence between the multicast ID of the split multicast group 1 and the communication characteristic X3 and port 1.3, an ACL that records the correspondence between the split multicast group 3 and the communication characteristic X3 and port 3.2, and an ACL that records the correspondence between the split multicast group 2 and the communication characteristic X4 and port 2.1.

Based on the above configuration, when an ingress port of a receiving interface board receives a to-be-shunted packet a with characteristic communication X3, the to-be-shunted packet a is copied into mirror packets a1 to a4 according to a mirror rule pre-configured on the ingress port, where a multicast ID carried by the mirror packet a1 is 1, a multicast ID carried by the mirror packet a2 is 2, a multicast ID carried by the mirror packet a3 is 3, and a multicast ID carried by the mirror packet a4 is 4.

Then, the receiving interface board multicasts the 4 mirror image messages, and because the member ports of each shunting multicast group are the interconnection ports of the receiving interface board and the exchange network board, the 4 mirror image messages are multicasted to the interconnection ports. When the mirror image message is sent through the interconnection port, the receiving interface board hashes 4 mirror image messages, and sends the 4 mirror image messages to the corresponding exchange network board according to the hash result. According to the hash result, the 4 mirror messages may be sent to different switch boards, or several mirror messages may be sent to the same switch board.

If the mirror image message a1 is sent to the switching network board 1, the switching network board 1 searches the corresponding sending rule item in the pre-configured ACL according to the multicast ID and the communication feature information of the mirror image message a 1. Since the multicast ID of the mirror message a1 is 1 and the communication characteristic is X3, the switching network board 1 may match a corresponding sending rule item, and the egress port indicated in the sending rule item is the egress port 1.3, then the switching network board 1 redirects the mirror message a1 to the egress port 1.3. Since the switching network board is connected to all the interface boards, when performing redirection action, the switching network board 1 sends the mirror image message a1 to the sending interface board where the output port 1.3 is located, and then the sending interface board sends the mirror image message out from the output port 1.3.

Similarly, if the mirror image message a3 is sent to the switching network board 3, the switching network board 3 searches the corresponding sending rule item in the pre-configured ACL according to the multicast ID and the communication feature information of the mirror image message a 3. Since the multicast ID of the mirror message a3 is 3 and the communication characteristic is X3, the switching network board 3 may match a corresponding sending rule item, and the egress port indicated in the sending rule item is the egress port 3.2, and then the switching network board 3 redirects the mirror message a3 to the egress port 3.2 for sending.

If the mirror image message a2 is sent to the switch network board 2, and the switch network board 2 cannot find the sending rule item which simultaneously satisfies the multicast ID of 2 and the communication characteristic of X3, the switch network board 2 discards the mirror image message a2 according to the discarding rule item.

Similarly, if the mirror image message a4 is sent to the switch board 4, and the switch board 4 cannot find the sending rule item that simultaneously satisfies the multicast ID of 4 and the communication characteristic of X3, the switch board 4 discards the mirror image message a4 according to the discarding rule item.

Finally, the message with the communication characteristic of X3 is sent out from the egress port 1.3 and the egress port 3.2 of the shunting switch.

Based on the scheme, the message to be distributed is firstly copied indiscriminately to each service group in a mode of mirroring the message to be distributed to the distribution multicast group, and then the switching network board selects an output port according to the multicast ID and the communication characteristic matching ACL rule of the mirrored message. Thus, for each switch network board, only one ACL rule item is needed for each port. If each service group corresponds to 255 egress ports in 4 service groups of the device accessing the communication, only 256 × 4 ACLs need to be configured on each switching network board, that is, all possible egress port combinations are satisfied. That is, when there are m switch boards, a total of only 256 × 4 × n ACLs is needed to cover the possibility of all port combinations. Compared with the scheme of 256^4 ACLs in the prior art, the scheme provided by the embodiment greatly reduces the configuration amount of the ACL rules, and avoids the problem of ACL insufficiency caused by excessive output ports in a message distribution scene.

In a second scenario of this embodiment, the breakout switch may be a box switch without a dedicated switching network board. The distribution switch is configured with a plurality of distribution multicast groups corresponding to the service groups respectively, and the distribution multicast groups comprise the output ports of the service groups corresponding to the distribution multicast groups.

Correspondingly, referring to fig. 5, the present embodiment further provides a message splitting method applied to the foregoing situation, where the method at least includes steps S510 to S530.

Step S510, receiving the message to be distributed, mirroring the message to be distributed to each distribution multicast group, and generating a mirror message corresponding to each distribution multicast group.

S520, multicasting each mirror image message to a corresponding output port.

S530, aiming at each output port, according to the communication characteristic information carried by the mirror image message and the ACL pre-configured by the output port, detecting whether the received mirror image message is allowed to be sent from the output port, and sending the mirror image message when detecting that the mirror image message is allowed to be sent from the output port.

Specifically, the ACL preconfigured in the egress port includes a sending rule item and a rejection rule item having a processing priority lower than that of the sending rule item, and the sending rule item is used to record communication feature information of the mirror image packet allowed to be sent from the egress port.

And the flow distribution switch detects whether the communication characteristic information carried by the mirror image message conforms to the communication characteristic information recorded in the sending rule item or not when receiving the mirror image message aiming at each output port.

And if the communication characteristic information carried by the mirror image message is detected to be in accordance with the communication characteristic information recorded by the sending rule item, converting the mirror image message into a unicast message according to the sending rule item and then sending the unicast message from the output port.

And if the communication characteristic information carried by the mirror image message is detected not to be consistent with the communication characteristic information recorded by the sending rule item, discarding the message to be distributed according to the rejection rule item.

In the above case, the shunt switch may be a box-type shunt switch, which does not divide a dedicated switching network board as compared to a frame-type shunt switch.

The shunting switch provided in this embodiment may be connected as a secondary shunting device between the primary shunting device and the service device. The port connected with the first-stage shunting device is used as an input port, and the port connected with the service device is used as an output port.

Referring to fig. 6, in the present embodiment, a plurality of split multicast groups respectively corresponding to each service group are pre-configured on the split switch, and each split multicast group includes an egress port of the service group corresponding to the split multicast group. For example, the service group 1 corresponds to the split multicast group 1, and the multicast ID is 1; the service group 2 corresponds to the split-flow multicast group 2, and the multicast ID is 2; the service group 3 corresponds to the split multicast group 3, and the multicast ID is 3; the service group 4 corresponds to the split multicast group 4, and the multicast ID is 4.

In a plurality of output ports of the shunting switch, the output ports 1.1 to 1.N are output ports of the service group 1, and multicast IDs of the output ports 1.1 to 1.N are 1; the output ports 2.2 to 2.N are output ports of the service group 2, and the multicast IDs of the output ports 2.1 to 2.N are 2; the output ports 3.1 to 3.N are output ports of the service group 3, and the multicast IDs of the output ports 3.1 to 3.N are 3; the egress ports 4.1 to 4.N are egress ports of the service group 4, and the multicast IDs of the egress ports 4.1 to 4.N are 4.

Each egress port is provided with an egress-direction ACL in which communication characteristic information allowing a message to be transmitted from the egress port is recorded.

For example, in a scenario, if a message with communication feature X5 needs to be copied to be sent from egress port 1.3 and egress port 3.2, and a message with communication feature X6 needs to be copied to be sent from egress port 1.3 and egress port 2.1, an ACL recording correspondence between communication features X5 and X6 and egress port 1.3 is configured on egress port 1.3, an ACL recording correspondence between communication feature X5 and egress port 3.2 is configured on egress port 3.2, and an ACL recording correspondence between communication feature X6 and egress port 2.1 is configured on egress port 2.1.

The ACL further configured on each output port comprises a sending rule item and a rejection rule item with the processing priority lower than that of the sending rule item, wherein the sending rule item is used for recording the communication characteristic information of the mirror image message allowed to be sent from the output port, and the rejection rule item is used for discarding the message when the sending rule item is not matched.

Based on the above configuration, when the ingress port of the offload switch receives the to-be-offloaded packet B with the characteristic communication of X5, the to-be-offloaded packet B is copied into mirror packets B1 to B4 according to a mirror rule pre-configured on the ingress port, where the mirror packet B1 carries a multicast ID of 1, the mirror packet B2 carries a multicast ID of 2, the mirror packet B3 carries a multicast ID of 3, and the mirror packet B4 carries a multicast ID of 4.

Then, the shunting switch carries out multicast on the 4-branch mirroring messages in the corresponding shunting multicast groups respectively. The mirror message b1 is multicast to all the egress ports with multicast ID 1, i.e. the mirror message b1 is multicast to the egress ports 1.1 to 1. N; the mirror message b2 is multicast to all egress ports with multicast ID 2, i.e. the mirror message b2 is multicast to the egress ports 2.1 to 2. N; the mirror message b3 is multicast to all egress ports with multicast ID 3, i.e. the mirror message b3 is multicast to the egress ports 3.1 to 3. N; the mirror message b4 is multicast to all egress ports with multicast ID 4, i.e. mirror message b4 is multicast to egress ports 4.1 to 4. N.

When the egress port 1.3 receives the multicast mirror image message b1, the corresponding sending rule item is matched in the egress port configuration ACL, and because the communication characteristic of the message is X5, the sending rule item whose corresponding egress port is the egress port 1.3 can be matched, and the egress port 1.3 sends the message. When other egress ports except the egress port 1.3 in the split multicast group 1 receive the multicast mirror message b1, the corresponding sending rule item cannot be found in the ACL configured in the port, and the egress ports discard the received mirror message b1 according to the preset rejection rule item.

Similarly, when the egress port 3.2 receives the multicast mirror image message b3, the corresponding sending rule item is matched in the egress port configuration ACL, and since the communication characteristic of the message is X5, the sending rule item whose corresponding egress port is the egress port 3.2 can be matched, and the egress port 3.2 sends the message. When other egress ports except the egress port 3.2 in the split multicast group 3 receive the multicast mirror message b3, the corresponding sending rule item cannot be found in the ACL configured in the port, and the egress ports discard the received mirror message b3 according to the preset rejection rule item.

When the egress ports of the multicast breakout group 2 or the multicast breakout group 4 receive the mirror image message b2 or perform the mirror image message b4, since the corresponding sending rule item cannot be found, the egress ports discard the received mirror image message according to the preset rejection rule item.

Finally, the message with the communication characteristic of X5 is sent out from the egress port 1.3 and the egress port 3.2 of the shunting switch.

Based on the above scheme, the distribution switch provided in this embodiment mirrors the to-be-distributed packet to each distribution multicast group for multicast after receiving the to-be-distributed packet from the ingress port of the to-be-distributed packet. The mirror image message is multicast to each output port, and each output port selects to send the message or discard the message according to the configured ACL of the output port.

Thus, if each service group corresponds to 255 egress ports in 4 service groups accessed to the communication device, and the reject rule item of each egress port is calculated, 256 × 4 × 2 ACLs are configured to satisfy all possible egress port combination situations.

Referring to fig. 7, fig. 7 is a schematic diagram of a hardware structure of a shunting switch 100 according to an embodiment of the present disclosure. The shunting switch 100 includes a message shunting device 110, a memory 120, and a processor 130.

The memory 120 and the processor 130 are electrically connected to each other directly or indirectly to enable data transmission or interaction. For example, the components may be electrically connected to each other via one or more communication buses or signal lines. The message shunting device 110 includes at least one software functional module which can be stored in the memory 120 in the form of software or firmware (firmware) or solidified in an Operating System (OS) of the shunting switch 100. The processor 130 is configured to execute executable modules stored in the memory 120, such as software functional modules and computer programs included in the message distribution apparatus 110.

The Memory 120 may be, but is not limited to, a Random Access Memory (RAM), a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Read-Only Memory (EPROM), an electrically Erasable Read-Only Memory (EEPROM), and the like. The memory 120 is used for storing programs, and the processor 130 executes the programs after receiving the execution instructions.

Referring to fig. 8, the present embodiment further provides a message offloading device 110 applied to the offloading switch 100, which is functionally divided, and the message offloading device 110 may include a mirror module 111, a multicast module 112, and a sending module 113.

In the first case, the shunting switch 100 includes a receiving interface board for receiving the message to be shunted and a switching network board connected to the receiving interface board. The distribution switch 100 is configured with a plurality of distribution multicast groups corresponding to each service group, and each distribution multicast group includes an interconnection port where a receiving interface board is connected to a switching network board.

The mirror image module 111 is configured to receive a message to be distributed through the receiving interface board, mirror the message to be distributed to each distribution multicast group, and generate a mirror image message corresponding to each distribution multicast group.

In this embodiment, the mirror module 111 can be used to execute step S310 shown in fig. 3, and reference may be made to the description of step S310 for a detailed description of the mirror module 111.

The multicast module 112 is configured to multicast the mirror image packet, so that the mirror image packet is sent to the switching network board through the interconnection port, where the mirror image packet carries the multicast ID of the split multicast group corresponding to the mirror image packet.

In this embodiment, the multicast module 112 may be configured to execute step S220 shown in fig. 2, and the detailed description about the multicast module 112 may refer to the description about step S220.

The sending module 113 is configured to search a corresponding egress port in an ACL configured in advance in the switching network board according to the communication feature information and the multicast ID carried in the mirror image packet, and send the mirror image packet through the searched egress port when the corresponding egress port is found.

In this embodiment, the sending module 113 may be configured to execute step S230 shown in fig. 3, and reference may be made to the description of step S230 for a detailed description of the sending module 113.

In the second case, the offload switch 100 is configured with a plurality of offload multicast groups corresponding to the respective service groups, and each offload multicast group includes an egress port of the service group corresponding to the offload multicast group.

The mirror image module 111 is configured to receive a message to be distributed, mirror the message to be distributed to each distribution multicast group, and generate a mirror image message corresponding to each distribution multicast group.

In this embodiment, the mirror module 111 can be used to execute step S510 shown in fig. 6, and reference may be made to the description of step S510 for a detailed description of the mirror module 111.

The multicast module 112 is configured to multicast each mirror packet to a corresponding egress port.

In this embodiment, the multicast module 112 may be configured to execute step S520 shown in fig. 6, and reference may be made to the description of step S520 for a detailed description of the multicast module 112.

The sending module 113 is configured to detect, for each egress port, whether the received mirror packet is allowed to be sent from the egress port according to the communication feature information carried in the mirror packet and an ACL configured in advance at the egress port, and send the mirror packet when detecting that the mirror packet is allowed to be sent from the egress port.

In this embodiment, the sending module 113 may be configured to execute step S530 shown in fig. 6, and reference may be made to the description of step S530 for a detailed description of the sending module 113.

In summary, according to the message offloading method, the message offloading device, and the offloading switch provided in the embodiments of the present disclosure, by pre-configuring the offloading multicast groups corresponding to each service group, when receiving a message to be offloaded, a corresponding mirror image is generated for each offloading multicast group according to the message to be offloaded, and then the mirror image message is sent according to a preset ACL matched on the switching network board or the egress port. Therefore, the message to be shunted is firstly copied in a mirror image mode, and then the ACL rule is matched to select the output port, so that the ACL quantity to be configured is reduced under the condition that the output ports are the same in quantity, and the problem that the ACL resource is possibly insufficient when the output ports are too much can be solved.

In the embodiments provided in the present disclosure, it should be understood that the disclosed apparatus and method may be implemented in other ways. The apparatus embodiments described above are merely illustrative, and for example, the flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, functional modules in the embodiments of the present disclosure may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

The functions, if implemented in the form of software functional modules and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present disclosure may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present disclosure. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

The above description is only for the specific embodiments of the present disclosure, but the scope of the present disclosure is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present disclosure, and all the changes or substitutions should be covered within the scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be subject to the protection scope of the claims.

Claims

1. A message shunting method is characterized in that the method is applied to a shunting switch, and the shunting switch comprises a receiving interface board for receiving a message to be shunted and a switching network board connected with the receiving interface board; the distribution switch is configured with a plurality of distribution multicast groups corresponding to each service group respectively, and each distribution multicast group comprises an interconnection port connected with the receiving interface board and the switching network board; the method comprises the following steps:

according to the communication characteristic information and the multicast ID carried by the mirror image message, searching a corresponding output port in an access control list configured in advance by the exchange network board, and when the corresponding output port is searched, sending the mirror image message through the searched output port:

the access control list comprises a sending rule item and a rejection rule item with the processing priority lower than that of the sending rule item, wherein the sending rule item is used for recording the corresponding relation between the communication characteristic information of the message and the output port; the step of searching a corresponding output port in an access control list configured in advance by the switching network board according to the communication characteristic information and the multicast ID carried by the mirror image message, and sending the mirror image message through the searched output port when the corresponding output port is searched, includes:

matching a corresponding sending rule item in an access control list configured in advance by the exchange network board according to the communication characteristic information and the multicast ID carried by the mirror image message;

if the corresponding sending rule item is matched, the mirror image message is sent to an output port recorded by the sending rule item for sending;

if the corresponding sending rule item is not matched, the mirror image message is discarded according to the rejection rule item;

the communication characteristic information comprises MAC information, port identification or IP address of the message.

2. The method according to claim 1, wherein the receiving interface board comprises an ingress port for receiving the message to be split; the step of receiving the message to be distributed through the receiving interface board, mirroring the message to be distributed to each distribution multicast group, and generating a mirror message corresponding to each distribution multicast group includes:

and receiving the message to be distributed through the input port, mirroring the message to be distributed to each distribution multicast group according to a mirroring rule configured on the input port in advance, and generating a mirroring message corresponding to each distribution multicast group.

3. The method according to claim 1, wherein the step of sending the mirror message to an egress port recorded in the sending rule item for sending if the corresponding sending rule item is matched includes:

if the corresponding sending rule item is matched, the mirror image message is converted into a unicast message and is redirected to an output port recorded by the sending rule item for sending.

4. A message distribution method is characterized in that the method is applied to a distribution switch, the distribution switch is provided with a plurality of distribution multicast groups corresponding to each service group respectively, and the distribution multicast groups comprise output ports of the service groups corresponding to the distribution multicast groups; the method comprises the following steps:

multicasting each mirror image message to a corresponding output port;

for each output port, detecting whether the received mirror image message is allowed to be sent from the output port or not according to the communication characteristic information carried by the mirror image message and an access control list pre-configured for the output port, and sending the mirror image message when detecting that the mirror image message is allowed to be sent from the output port:

the access control list pre-configured by the output port comprises a sending rule item and a rejection rule item with the processing priority lower than that of the sending rule item, wherein the sending rule item is used for recording the communication characteristic information of the mirror image message allowed to be sent from the output port;

the step of detecting whether the mirror image message is allowed to be sent from the output port or not according to the communication characteristic information carried by the mirror image message and the access control list pre-configured for the output port when receiving the mirror image message for each output port, and sending the mirror image message when detecting that the mirror image message is allowed to be sent from the output port, includes:

for each output port, when the mirror image message is received, detecting whether the communication characteristic information carried by the mirror image message conforms to the communication characteristic information recorded in the sending rule item;

if the communication characteristic information carried by the mirror image message is detected to be in accordance with the communication characteristic information recorded by the sending rule item, the mirror image message is converted into a unicast message according to the sending rule item and then is sent from the output port;

if the communication characteristic information carried by the mirror image message is detected not to be consistent with the communication characteristic information recorded by the sending rule item, discarding the message to be distributed according to the rejection rule item;

5. The method according to claim 4, wherein the offload switch comprises an ingress port for receiving the message to be offloaded; the step of receiving the message to be distributed, mirroring the message to be distributed to each of the multicast groups, and generating a mirror message corresponding to each multicast group includes:

6. A message shunting device is characterized by being applied to a shunting switch, wherein the shunting switch comprises a receiving interface board for receiving a message to be shunted and a switching network board connected with the receiving interface board; the distribution switch is configured with a plurality of distribution multicast groups corresponding to each service group respectively, and each distribution multicast group comprises an interconnection port connected with the receiving interface board and the switching network board; the device comprises:

a sending module, configured to search a corresponding egress port in an access control list configured in advance by the switching network board according to the communication feature information and the multicast ID carried in the mirror image packet, and send the mirror image packet through the searched egress port when the corresponding egress port is found;

the access control list comprises a sending rule item and a rejection rule item with the processing priority lower than that of the sending rule item, wherein the sending rule item is used for recording the corresponding relation between the communication characteristic information of the message and the output port;

the sending module is specifically configured to:

7. A message shunting device is characterized in that the message shunting device is applied to a shunting switch, the shunting switch is provided with a plurality of shunting multicast groups corresponding to all service groups respectively, and each shunting multicast group comprises an output port of the service group corresponding to the shunting multicast group; the device comprises:

a sending module, configured to detect, for each egress port, whether the received mirror image packet is allowed to be sent from the egress port according to communication feature information carried in the mirror image packet and an access control list preconfigured in the egress port, and send the mirror image packet when detecting that the mirror image packet is allowed to be sent from the egress port;

the sending module is specifically configured to:

8. A offload switch comprising a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor executing the machine-executable instructions to implement the method of any of claims 1-5.