CN115412431A

CN115412431A - Network switch and abnormality detection method

Info

Publication number: CN115412431A
Application number: CN202110504048.6A
Authority: CN
Inventors: 王思翰; 郑凯文; 陈明道
Original assignee: Realtek Semiconductor Corp
Current assignee: Realtek Semiconductor Corp
Priority date: 2021-05-10
Filing date: 2021-05-10
Publication date: 2022-11-29

Abstract

A network switch is used for receiving a plurality of packet data and comprises a memory and a processor. The memory is used for storing an access control table and an abnormality detection program, filtering the grouped data according to the access control table, and executing an abnormality detection process on the grouped data according to the abnormality detection program. If at least one abnormal event occurs in one of the time intervals, the count value is increased. When the count value reaches the count threshold, the memory issues an exception notification to the processor to cause the processor to perform an exception handling process on the packet data.

Description

Network switch and abnormality detection method

Technical Field

Embodiments described in the present disclosure relate to network technologies, and more particularly, to a network switch and an anomaly detection method.

Background

With the development of technology, network systems have been widely used in business or life. Generally, a network switch is configured in a network system. The network switch is mainly used for exchanging data of different network devices. In some related techniques, the network switch performs exception handling procedures immediately upon the occurrence of an exception event. However, this can cause the processors in the network switch to perform exception handling processes too frequently, thereby reducing their utilization.

Disclosure of Invention

Some embodiments of the present disclosure pertain to a network switch. The network switch is used for receiving a plurality of grouped data and comprises a memory and a processor. The memory is used for storing an access control table and an abnormality detection program, filtering the grouped data according to the access control table, and executing an abnormality detection process on the grouped data according to the abnormality detection program. If at least one abnormal event occurs in one of the time intervals, the count value is increased. When the count value reaches the count threshold, the memory issues an exception notification to the processor to cause the processor to perform an exception handling process on the packet data.

Some embodiments of the present disclosure relate to an abnormality detection method. The abnormality detection method includes: receiving, by a network switch, a plurality of packet data; filtering the packet data according to the access control table by a memory in the network switch, and performing an anomaly detection process on the packet data according to an anomaly detection program; if at least one abnormal event occurs in one of the time intervals, increasing the count value; and when the counting value reaches the counting threshold value, sending an exception notice to a processor in the network switch by the memory so that the processor executes an exception handling process on the grouped data.

Drawings

The foregoing and other objects, features, advantages and embodiments of the disclosure will be more readily understood from the following description taken in conjunction with the accompanying drawings in which:

fig. 1 is a schematic diagram of a network switch according to some embodiments of the present disclosure;

FIG. 2 is a timing diagram illustrating an exception detection process according to some embodiments of the present disclosure;

FIG. 3 is a schematic diagram of a parameter configuration according to some embodiments of the present disclosure; and

fig. 4 is a flowchart illustrating an abnormality detection method according to some embodiments of the disclosure.

Detailed Description

As used herein, the term "coupled" can also refer to electrically coupled "and the term" connected "can also refer to electrically connected. Coupling and connection can also mean that two or more elements are matched or interacted with each other.

Refer to fig. 1. Fig. 1 is a schematic diagram of a network switch 100 according to some embodiments of the disclosure. In some embodiments, network switch 100 is an ethernet network switch.

For the example of fig. 1, network switch 100 includes port P1, port P2, and port P3. The network switch 100 is coupled to the networking device D1 through the port P1, coupled to the networking device D2 through the port P2, and coupled to the external analysis device D3 through the port P3. Network switch 100 may receive packet data PK from networking device D1 via port P1 and output packet data PK' to networking device D2 via port P2 according to the destination address. And the external analysis device D3 may perform an analysis process on the packet data PK.

For the example of fig. 1, network switch 100 includes memory 110, processor 120, counter 130, and register 140. In addition to the ports P1-P3, the memory 110 is further coupled to the processor 120, the counter 130, and the register 140. Register 140 is coupled to processor 120.

The memory 110 is used for storing an access control table AL and an exception detection program AD. The memory 110 may filter the packet data PK according to the access control table AL. For example, the access control table AL may include a plurality of entries (entries). Each entry may correspond to a rule and an action. The memory 110 may compare the packet data PK with the rules and perform corresponding actions on the packet data PK according to the comparison result to complete the filtering process and generate the packet data PK'. The "behavior" may be, for example, notification, rate limiting, discarding packets, forwarding packets, etc.

In some embodiments, the Memory 110 is a Ternary Content Addressable Memory (TCAM). In these embodiments, the packet data PK is compared to the rules in a "parallel" manner. That is, the packet data PK may be compared against these rules simultaneously.

Taking the example of fig. 1, the access control table AL includes a control block AL1 and a control block AL2. The control blocks AL1 and AL2 respectively include a plurality of entries. In some embodiments, control block AL1 is an ingress control block and control block AL2 is an egress control block. In other words, the control block AL1 (ingress control block) can be used to filter the packet data PK that is input into the network switch 100 and has not been processed by the network switch 100. The control block AL2 (egress control block) is used to filter the packet data PK processed by the network switch 100.

Taking the control block AL1 as an example, the header of the packet data PK that has just been input into the network switch 100 and has not been processed by the network switch 100 can be intercepted. Then, the intercepted header is compared with the rules of the entries in the control block AL1, and corresponding actions are performed on the packet data PK according to the comparison result, so as to complete the entry filtering process. The control block AL2 has similar operations to complete the outlet filtering process, and therefore, the description thereof is omitted.

Since the control block AL1 and the control block AL2 share the storage space of the memory 110, the architecture of fig. 1 is also referred to as a "shared ternary content addressable memory (share TCAM) architecture". In some embodiments, the ratio of the control blocks AL1 and AL2 in the memory 110 can be adjusted by the user according to actual needs. For example, when the user inputs (sets) the ratio of the control blocks AL1 and AL2 through the input device, the network switch 100 generates a corresponding partition number command PN. Then, the ratio of the control blocks AL1 and AL2 in the memory 110 is configured according to the dividing value command PN.

On the other hand, the memory 110 may perform an abnormality detection process on the packet data PK according to the abnormality detection procedure AD. The anomaly detection procedure AD includes a detection block AD1 and a detection block AD2.

In the example of fig. 1, the detection block AD1, the control block AL2, and the detection block AD2 are sequentially disposed in the memory 110. Explained another way, the detection block AD1 is adjacent to the control block AL1, and the detection block AD2 is adjacent to the control block AL2. With this arrangement, detection block AD1 may be used to enable control block AL1 to support the anomaly detection process, and detection block AD2 may be used to enable control block AL2 to support the anomaly detection process. Accordingly, the detection blocks AD1 and AD2 can support the anomaly detection process.

In some related art, only one abnormality detection procedure is configured and is adjacent to the control block AL1 (or the control block AL 2). Accordingly, only the control block AL1 (or the control block AL 2) can support the abnormality detection process.

Compared to the related arts, in the present disclosure, the detection blocks AD1 and AD2 are configured at the same time. Accordingly, the detection blocks AD1 and AD2 can be used to support the abnormality detection process for both the control blocks AL1 and AL2.

Next, fig. 1 and fig. 2 are referred to simultaneously. Fig. 2 is a timing diagram illustrating an anomaly detection process according to some embodiments of the present disclosure.

The following description will be given taking an example in which the detection block AD1 makes the control block AL1 support the abnormality detection process. Since the detection block AD2 and the control block AL2 have similar operations, they are not described again.

In operation, when the network switch 100 receives the packet data PK, the control block AL1 filters the packet data PK and the detection block AD1 enables the control block AL1 to support the anomaly detection process.

First, a plurality of time intervals T1-T4 (e.g., 1 msec) may be set for a specific type of packet data PK. In practical applications, different types of packet data PK may correspond to different time interval lengths. In addition, a traffic upper limit value (e.g., 10M bits per second) may be set for this particular type of packet data PK. In practical applications, different types of packet data PK may correspond to different upper limit values of traffic.

In some embodiments, when the traffic value of this particular type of packet data PK reaches the traffic upper limit value, it represents that an abnormal event occurs. For the example of fig. 2, two abnormal events occur in the time interval T1, and five abnormal events occur in the time interval T3. In some embodiments, the counter 130 is incremented by 1 whenever several exception events occur within a time interval. Accordingly, in the example of fig. 2, the initial count value of the counter 130 is 0, and after the time interval T1 elapses, the count value of the counter 130 is increased by 1 (the count value becomes 1). Then, after the time interval T3 elapses, the count value of the counter 130 is increased by 1 again (the count value becomes 2).

In addition, a count threshold may be set for this particular type of packet data PK. In practical applications, different types of packet data PK may correspond to different count thresholds. The count value of the counter 130 may be compared to a count threshold. When the count value of the counter 130 reaches the count threshold, the memory 110 will issue an exception notification IRT to the processor 120 to notify the processor 120 to execute an exception handling process on the packet data PK.

In some embodiments, the length of the time intervals T1-T4, the upper flow limit or the count threshold may be buffered in the register 140. In some embodiments, the length of the time interval T1-T4, the traffic ceiling or the count threshold registered in the register 140 may be adjusted by the user according to the actual needs (e.g., the importance of the specific type of packet data PK or the degree of impact on the system). For example, when the user inputs (sets) the length of the time interval T1-T4, the upper limit value of the flow rate, or the count threshold value through the input device, the network switch 100 generates a corresponding setting command CM. Then, the processor 120 may issue an update signal US according to the setting instruction CM to update the length, the upper limit value of the flow rate, or the count threshold of the time interval T1-T4 temporarily stored in the register 140. Accordingly, the flexibility of the network switch 100 can be increased.

It is specifically noted that in some other embodiments, the register 140 may be implemented by a plurality of registers.

In some embodiments, the exception handling process may be a packet discard process or a packet forwarding process. In other words, when the count value of the counter 130 reaches the count threshold, the packet data PK may be discarded or forwarded to port P3.

With respect to the packet discard process, in some embodiments, when the count value of the counter 130 reaches a count threshold, a large amount of packet data PK of a particular type is often received on behalf of the network switch 100. Which can take up internal bandwidth of network switch 100. However, if the packet data PK is discarded if the count value of the counter 130 reaches the count threshold, the internal bandwidth of the network switch 100 can be effectively saved, and the server at the back end can be prevented from being crashed (e.g., crashed) due to a large number of packets.

Regarding the packet forwarding process, in some embodiments, when the count value of the counter 130 reaches the count threshold, the packet data PK may be forwarded to the external analysis device D3, and the external analysis device D3 may analyze the forwarded packet data PK to generate an analysis result AR (e.g., analyze the current network status). The network switch 100 can then automatically adjust the parameter (e.g., the upper limit value or the count threshold value) buffered in the register 140 according to the analysis result AR. For example, if the analysis result AR indicates that the specific type of packet data PK really requires a larger bandwidth in the network status, the processor 120 may send an update signal US according to the analysis result AR to increase the upper limit value of the traffic buffered in the register 140. Accordingly, the network switch 100 can achieve the effects of self-learning and dynamic adjustment.

In some other embodiments, the processor 120 may adjust the count threshold temporarily stored in the register 140 according to the frequency of receiving the exception notification IRT. For example, if the frequency of receiving the exception notification IRT is too high, the processor 120 may issue an update signal US to increase the count threshold temporarily stored in the register 140. If the frequency of receiving the exception notification IRT is too low, the processor 120 may issue an update signal US to lower the count threshold temporarily stored in the register 140. Accordingly, the utilization rate of the processor 120 can be improved.

In some related techniques, the network switch performs exception handling procedures immediately upon the occurrence of an exception event. This may cause the processors in the network switch to perform exception handling too frequently, thereby reducing processor utilization.

In contrast to the related arts described above, in the present disclosure, if an exception occurs within a time interval, the count value is incremented and the exception notification IRT is issued to the processor 120 to perform an exception handling process on the packet data PK when the count value reaches the count threshold. Accordingly, the processor 120 can be prevented from executing the exception handling process too frequently, and the utilization rate of the processor 120 can be improved. In addition, since in some embodiments of the present disclosure, the count value is increased by 1 regardless of the number of abnormal events occurring within a time interval. Accordingly, the number of bits required for the counter 130 can be reduced to reduce hardware cost.

Refer to fig. 1, 2 and 3. Fig. 3 is a schematic diagram of a parameter configuration 300 according to some embodiments of the disclosure.

For example, as shown in fig. 3, the parameter configuration 300 can be stored in the register 140 and used for the user to set the time interval length TS, the count threshold MT and the exception handling process RD. The time interval length TS represents the length of the time intervals T1-T4 for detecting whether the abnormal event occurs. The count threshold MT represents that an exception notification IRT is issued to the processor 120 if the count value of the counter 130 reaches this value. The exception handling process RD represents the discarding or forwarding of the packet data PK. For example, if the exception handling process RD is 0, it represents that the currently set exception handling process RD is discarding the packet data PK, and if the exception handling process RD is 0x000A, it represents that the currently set exception handling process RD is forwarding the packet data PK to the port P3. In some embodiments, the parameter configuration 300 further includes the aforementioned upper flow limit value, so that a user can set the upper flow limit value. The upper limit value of the flow is a judgment standard for judging whether an abnormal event occurs.

Refer to fig. 4. Fig. 4 is a flow chart of an anomaly detection method 400 according to some embodiments of the present disclosure. In some embodiments, the anomaly detection method 400 is applied to the network switch 100 in fig. 1, but the disclosure is not limited thereto. Taking the example of fig. 4, the anomaly detection method 400 includes operations S402, S404, S406, and S408.

In operation S402, a plurality of packet data PKs are received by the network switch 100. In some embodiments, network switch 100 is an ethernet network switch.

In operation S404, the packet data PK is filtered according to the access control table AL by the memory 110, and the anomaly detection process is performed on the packet data PK according to the anomaly detection procedure AD. In some embodiments, memory 110 is a tri-state content addressable memory.

In operation S406, if at least one abnormal event occurs in one of the time intervals T1-T4, the count value is incremented. In some embodiments, the counter 130 is incremented by 1 whenever several exception events occur within a time interval.

In operation S408, when the count value reaches the count threshold, an exception notification IRT is issued to the processor 120 via the memory 110, so that the processor 120 performs an exception handling process on the packet data PK. In some embodiments, the exception handling process may be a packet discard process or a packet forwarding process.

In summary, in the network switch and the anomaly detection method of the present disclosure, the count value is incremented if an anomaly event occurs within a time interval, and the processor is notified of an anomaly when the count value reaches the count threshold value, so as to perform an anomaly handling process on the packet data. Therefore, the processor can be prevented from executing the exception handling process too frequently, and the utilization rate of the processor is further improved.

Various functional elements and blocks have been disclosed herein. It will be apparent to those of ordinary skill in the art that functional blocks may be implemented by circuits (whether dedicated circuits or general purpose circuits that operate under the control of one or more processors and coded instructions), which generally comprise transistors or other circuit elements that control the operation of the electrical circuits in accordance with the functions and operations described herein. It is further understood that the specific structure and interconnections of circuit elements in general may be determined by a compiler, such as a Register Transfer Language (RTL) compiler. Register transfer language compilers operate on instruction codes (script) that are quite similar to assembly language codes (assembly language codes), compiling the instruction codes into a form for layout or fabrication of the final circuit.

Although the present disclosure has been described with reference to exemplary embodiments, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the disclosure, and therefore, the scope of the disclosure should be determined by that of the appended claims.

Description of the reference numerals

100 network exchanger

110 memory

120 processor

130: counter

140 register

300 parameter configuration

400 abnormality detection method

P1, P2, P3: port

D1, D2 networking device

D3 external analysis device

PK, PK': packet data

AL access control table

AL1, AL2 control Block

AD abnormality detection program

AD1, AD2 detection block

PN distinguishing numerical value instruction

T1-T4 time interval

IRT-anomaly Notification

Results of AR analysis

CM set instruction

US update signal

TS time interval length

MT count threshold

RD Exception handling procedure

S402, S404, S406, S408.

Claims

1. A network switch for receiving a plurality of packet data, wherein the network switch comprises:

a memory for storing an access control table and an anomaly detection program, filtering the plurality of grouped data according to the access control table, and performing an anomaly detection process on the plurality of grouped data according to the anomaly detection program; and

a processor, wherein if at least one abnormal event occurs in one of the plurality of time intervals, the count value is increased,

and when the counting value reaches the counting threshold value, the memory sends an exception notification to the processor so that the processor executes an exception processing process on the plurality of grouped data.

2. The network switch of claim 1, wherein the exception event is the flow value of the plurality of packet data reaching a flow cap value, wherein the network switch further comprises:

at least one register for storing the lengths of the time intervals, the count threshold value or the upper flow rate value.

3. The network switch of claim 2, wherein the lengths of the time intervals, the count threshold or the upper flow limit are updated according to a setting command corresponding to a user input.

4. The network switch of claim 1, wherein processor is configured to adjust a count threshold based on a frequency of receiving the exception notification.

5. The network switch of claim 1, wherein the count value is incremented by 1 when at least one exception event occurs in one of the plurality of time intervals.

6. The network switch of claim 1, wherein the exception handling process comprises a packet discard process or a packet forwarding process.

7. The network switch of claim 6, wherein the packet forwarding process is to forward the plurality of packet data to a port of the network switch coupled to an external analysis device, wherein the abnormal event is that the traffic value of the plurality of packet data reaches a traffic upper limit value, and wherein the processor is further configured to adjust the traffic upper limit value according to an analysis result of the external analysis device.

8. The network switch of claim 1, wherein the access control table comprises a first control block and a second control block, and the anomaly detection procedure comprises a first detection block and a second detection block, wherein the first detection block, the first control block, the second control block, and the second detection block are sequentially disposed in the memory, and the first detection block and the second detection block are respectively configured to enable the first control block and the second control block to support the anomaly detection procedure.

9. The network switch of claim 1, wherein the memory is a ternary content addressable memory.

10. An anomaly detection method, comprising:

receiving, by a network switch, a plurality of packet data;

filtering the plurality of grouped data according to an access control table by a memory in the network switch, and executing an abnormality detection process on the plurality of grouped data according to an abnormality detection program;

if at least one abnormal event occurs in one of the time intervals, increasing the count value; and

when the counting value reaches the counting threshold value, sending an exception notice to a processor in the network switch by the memory so that the processor executes an exception processing process on the plurality of grouped data.