JP2002281071A - Router device and ip filtering processing method to be used for the same device and its program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a router device capable of reducing transmission delay, reducing throughput decreasing width in filtering, and reducing overhead. SOLUTION: A search machine 14 is able to register a 48 bit retrieval key and accessory information 1 byte in one entry, and the retrieval instruction of 48 bits from a CPU 11 is carried out by writing a search key in a command area 141, and the accessory information 1 byte of the matched entry as the full-match retrieval is outputted to a result area 142. When a packet is in the middle of fragment, a filtering logic 111 of the CPU 11 extracts the retrieved result from the search machine 14, and decides the abandonment/transfer of the packet.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a router, an IP filtering method used therefor, and a program therefor, and more particularly to an IP implemented in a router or the like.
(Internet Protocol) This relates to a filtering function.

[0002]

2. Description of the Related Art In recent years, with the spread of the Internet, needs for security such as measures against unauthorized access have been increasing. For this security, an IP filtering function implemented in a router or the like is an effective means.

[0003] However, the IP filtering function generally performs a condition comparison of the IP address itself of each of a source IP address and a destination IP address, or an IP filtering function.
Subnet-based condition comparison (comparison of the result of logical AND with the IP subnet mask) is required, and in addition, TCP (Transmission Control)
l Protocol) Comparison by port number [ftp
(File transfer protocol), but not the telnet protocol).

[0004]

In the above-described conventional IP filtering function, it is also required to set a plurality of filter conditions as described above, which causes an increase in overhead for the router device.

[0005] In particular, when filtering a plurality of fragmented packets, filtering is performed on each of the fragmented packets.
There is a problem that transmission delay occurs for each packet, and the throughput is further reduced as compared with filtering of unfragmented packets.

Accordingly, an object of the present invention is to solve the above-mentioned problems, to suppress transmission delay, to reduce the decrease in throughput during filtering, and to reduce the overhead. An object of the present invention is to provide an IP filtering processing method and a program therefor.

[0007]

A router device according to the present invention includes a search machine which is a memory device having a fixed address space, and performs a filtering process on a plurality of fragmented packets. A registration unit that registers a filter result of a packet at the head of the fragment in the search machine when performing the filtering process; and performs a filter result from a search result of the search machine when performing the filtering process on a subsequent fragment packet. It is configured to obtain.

An IP filtering processing method according to the present invention is an IP filtering processing method for a router device that includes a search machine which is a memory device having a fixed address space and performs a filtering process on a plurality of fragmented packets. Registering a filter result of a packet at the head of a fragment in the search machine when performing the filtering process, and obtaining a filter result from a search result of the search machine when performing the filtering process on a subsequent fragment packet. And steps.

A program for an IP filtering processing method according to the present invention includes a search machine, which is a memory device having a fixed address space, and performs an IP filtering processing method for a router device that performs filtering processing on a plurality of fragmented packets. A program that registers, in the computer, a filter result of a packet at the head of a fragment when performing the filtering process in the search machine; and a computer that executes the filtering process when performing the filtering process on a subsequent fragment packet. And a process of obtaining a filter result from the search result.

That is, according to the IP filtering method of the present invention, when filtering a plurality of fragmented packets, the filtering result of the packet at the head of the fragment is determined by using the source IP address and the ID (identification information) value as keys. It is registered in the search machine and obtains the filter result from the search result of the search machine when filtering the subsequent fragment packet.

[0011] As described above, when filtering a plurality of fragmented packets, the filter result of the first packet is stored in the search machine, so that the packets subsequent to the first packet are retrieved from the search result of the search machine. Since it is possible to determine whether to discard or transfer the packet, it is possible to suppress the transmission delay, and it is possible to reduce the decrease in the throughput during filtering. Also, by reducing software processing, overhead can be reduced.

[0012]

Next, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a router device according to one embodiment of the present invention. In FIG. 1, a router device 1 includes a CPU (central processing unit) 11 and
Line interfaces 12 and 15 and RAM (Rand)
om Access Memory (13), a search machine (14), and a recording medium (16) for storing a program to be executed by the CPU (11).
rnet Protocol) route the packet.

The CPU 11 is connected to the RAM 1 via a bus 100.
3 and the search machine 14 (RE / RE)
AD / WRITE) access, and can instruct the line interface 12 to transmit and receive data via the bus 100. The data can be transmitted to the line interface 15 similarly to the line interface 12. Can be instructed to transmit and receive. The CPU 11 has a filtering logic 111 for performing an IP filtering process.

The search machine 14 uses a CAM (Conten
ts Addressable Memory) and a general logic IC (integrated circuit). The memory device has a fixed address space. The memory device includes a command area 141, a result area 142, and a plurality of entries 143.

The search machine 14 has four entries for one entry.
A search key of 8 bits (bit) and one byte of supplementary information can be registered, and a 48-bit search instruction from the CPU 11 searches the command area 141 (the physical address in the search machine is set to “0”). This is performed by writing a key. As a result of the full match search, one byte of additional information of the matched entry is output to the result area 142 (the physical address in the search machine is set to “8”).

FIG. 2 is a diagram showing the format of an IP packet. In FIG. 2, IP packets are VER (version), HL (Internet header length), TOS (service type), TL (total length), ID (identifier), FL (Frag: flag), and FO (Fragme).
nt Offset: fragment offset), TT
L (survival time), PROT (protocol type), HC
(Header checksum), SOURCE (source address), DEST (destination address), and datagram.

FIG. 3 is a diagram showing a format of a search key and additional information used in the search machine 14 of FIG. 1, and FIG. 4 is a diagram showing a read format of the result area 142 of the search machine 14 of FIG.

FIG. 5 is a flowchart illustrating the operation of the filtering logic 111 of FIG. The operation of the router device 1 according to one embodiment of the present invention will be described with reference to FIGS. Note that the operation of the filtering logic 111 is realized by the CPU 11 executing a program stored in the recording medium 16.

In the following description, it is assumed that the first IP packet data is transmitted from the network 2 to the network 3 in the format shown in FIG. 2 and is fragmented as an IP packet.

The contents of the IP header of the first packet are as follows: VER = 4 HL = 5 TOS = 30 (Hex) TL = 144 (Hex) ID = 9010 (Hex) FL = 001 (Binary) FO = 00 (Hex) PROT = 08 (Hex) SOURCE = 001010101 (Hex) DEST = 011010201 (Hex).

When the FO in the IP header is "0", the filtering logic 111 determines that the packet is the first packet (step S1 in FIG. 5), and determines whether the packet is a fragmented packet (step S2 in FIG. 5).

At that time, the filtering logic 111
MF (More Fragment) in FL in header
If the bit is "OFF", the packet is not a fragment packet, so that a normal filtering process is performed (step S3 in FIG. 5), and the process ends. However, in this case, since MF = 1, the entry is registered in the search machine 14 after performing the normal filtering process (step S4 in FIG. 5).

When registering an entry in the search machine 14, the filtering logic 111 discards / discards the packet.
Since it is necessary to distinguish the transfer as additional information, the determination is first made (step S5 in FIG. 5).

When the filtering logic 111 determines that the packet is to be transferred, the source IP address [01010101 (He
x)] + ID [9010 (Hex)] + Additional information 01h
Is registered in the entry 143 (step S7 in FIG. 5).

When the filtering logic 111 determines that the packet is to be discarded, the source IP address [01010101]
(Hex)] + ID [9010 (Hex)] + Additional information 00h is registered in the entry 143 (step S in FIG. 5).
6).

In this case, the IP address + ID value becomes a search key. FIG. 3 shows the format of the search key and the supplementary information at this time. In this embodiment, the search machine 14 has a data bus width of 64 bits.

The ID value is set by the source having the source address for each destination and each IP datagram.
Packets that are the same among the fragmented packets are assembled at the destination receiving the fragmented packet based on the ID value and the source address.

Next, from the network 2 to the network 3
In the following description, it is assumed that the packet is fragmented as an IP packet in the format shown in FIG. 2 and the second IP packet data is transmitted.

The contents of the IP header of the second packet are as follows: VER = 4 HL = 5 TOS = 30 (Hex) TL = 144 (Hex) ID = 9010 (Hex) FL = 001 (Binary) FO = 28 (Hex) PROT = 08 (Hex) SOURCE = 001010101 (Hex) DEST = 001010201 (Hex).

When the FO in the IP header is other than "0", the filtering logic 111 determines that the packet is in the middle of a fragment (step S1 in FIG. 5). At this time, the filtering logic 111 extracts the source IP address and the ID value from the IP header, and requests the search machine 14 to search (step S8 in FIG. 5). Specifically, a search key having the format shown in FIG. 3 is written in the command area 141 (WRITE).

Next, the filtering logic 111 receives the search result and determines whether to discard or transfer the packet (step S9 in FIG. 5). Specifically, read access is made to the result area 142, and discard / transfer is determined according to the contents of the accompanying information. FIG. 4 shows a read format of the result area 142 at this time.

As for the read result, if "00h" is registered as supplementary information in step S6, the supplementary information of the search result becomes "00", and "01h" is registered as supplementary information in step S7. For example, the supplementary information of the search result is “01”.

Based on the search result, the filtering logic 111 instructs transfer in the case of packet transfer (step S10 in FIG. 5), and instructs discard in the case of packet discard (step S11 in FIG. 5).

As described above, when filtering a plurality of fragmented packets, the filter result of the first packet is stored in the search machine, so that the packets subsequent to the first packet are not included in the search result of the search machine. Since discard / transfer can be determined, the transmission delay can be suppressed, and the decrease in throughput during filtering can be reduced. Also, overhead can be reduced by reducing software processing.

In this embodiment, hardware means such as the search machine 14 is used to hold the IP filter result. However, even if software-based search means such as the HASH method is used, the effect can be obtained. can get. However, hardware-based search means are more effective than software-based search means because they are superior in terms of performance.

[0036]

As described above, according to the present invention, a filtering device including a search machine which is a memory device having a fixed address space and performing a filtering process on a plurality of fragmented packets is provided. By registering the filter result of the packet at the head of the fragment in the search machine when performing the search, and obtaining the filter result from the search result of the search machine when performing the filtering process on the subsequent fragment packet, transmission delay can be suppressed. It is possible to reduce the decrease in throughput when filtering,
There is an effect that overhead can be reduced.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a router device according to one embodiment of the present invention.

FIG. 2 is a diagram showing a format of an IP packet.

FIG. 3 is a diagram showing a format of a search key and additional information used in the search machine of FIG. 1;

FIG. 4 is a diagram showing a read format of a result area of the search machine of FIG. 1;

FIG. 5 is a flowchart illustrating the operation of the filtering logic of FIG.

[Explanation of symbols]

 Reference Signs List 1 router device 2, 3 network 11 CPU 12, 15 line interface 13 RAM 14 search machine 141 command area 142 result area 143 entry

Claims (13)

[Claims] 1. A router device including a search machine, which is a memory device having a fixed address space, and performing a filtering process on a plurality of fragmented packets. A router configured to register the filter result of the search machine in the search machine, and configured to obtain a filter result from a search result of the search machine when performing the filtering process on a subsequent fragment packet. apparatus. 2. The apparatus according to claim 1, wherein the registering means registers the filter result in the search machine using a source IP (Internet Protocol) address and an identifier of the packet as a search key. The router device as described. 3. The search machine according to claim 1, wherein a plurality of search entries can be registered, and the search key and the supplementary information are registered in one search entry to perform a search using the search key. Item 3. The router device according to item 2. 4. The router device according to claim 3, wherein the search machine is configured to return the value of the incidental information when the search entry is found by the search using the search key. 5. The search machine is configured to register operation information of discard / transfer, which is a result of normal filtering processing on the packet at the head of the fragment, as supplementary information based on the transfer source IP address and the identifier. The router device according to any one of claims 2 to 4, wherein: 6. A filtering means for a packet in the middle of a fragment, which determines filtering / discarding of the packet from a search result of the search machine based on the source IP address and identifier of the packet. The router device according to any one of claims 2 to 5, wherein 7. An IP filtering processing method for a router device including a search machine which is a memory device having a fixed address space and performing a filtering process on a plurality of fragmented packets, wherein the filtering process is performed. Registering the filter result of the packet at the head of the fragment in the search machine, and obtaining the filter result from the search result of the search machine when performing the filtering process on the subsequent fragment packet. IP filtering processing method. 8. The method according to claim 8, wherein the step of registering the filter result in the search machine includes:
8. The IP filtering processing method according to claim 7, wherein the filter result is registered in the search machine by using an address and an identifier as a search key. 9. The search machine according to claim 1, wherein a plurality of search entries can be registered, and the search key and supplementary information are registered in one search entry, and a search is performed using the search key. Item 10. The IP filtering processing method according to Item 8. 10. The IP filtering processing method according to claim 9, wherein the search machine returns the value of the incidental information when the search entry is found by the search using the search key. 11. The search machine may register discard / transfer operation information, which is a result of a normal filtering process on the packet at the head of the fragment, as supplementary information based on the transfer source IP address and the identifier. The IP filtering processing method according to any one of claims 8 to 10, wherein: 12. The method according to claim 1, further comprising the step of determining a discard / forward of the packet based on a search result of the search machine based on the source IP address and the identifier of the packet in the middle of the fragment. The IP filtering processing method according to claim 8. 13. A program for an IP filtering processing method of a router device, which includes a search machine which is a memory device having a fixed address space, and performs a filtering process on a plurality of fragmented packets. A process of registering a filter result of a fragment head packet in the search machine when performing a filtering process, and a process of obtaining a filter result from a search result of the search machine when performing the filtering process on a subsequent fragment packet. A program for executing