JP2003198608A - Packet transfer system, and retrieving method and updating method of policy table - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide packet transfer system which can prevent deterioration of throughput by performing updating work of a policy table without making a period when policy retrieval is impossible. <P>SOLUTION: The policy table 1 is constituted of a stored address 11 of each policy, a priority level number 12, an identifier 13 for storing an identifier to be compared with an identifier extracted from a packet, an action 14 which is executed when the two identifiers coincide with each other, and a next policy pointer 15 for showing a policy which is next subjected to comparison trial. The table 1 is used for retrieval of a policy of an address shown by the pointer 15, after a policy is not hit. When a policy is added, an additional policy is written in an empty address of the table 1, and the next policy address of a policy is rewritten which policy is retrieved just before the additional policy. When a policy is eliminated, the next policy address of a policy is rewritten which policy is retrieved just before the eliminated policy. An empty address in the table 1 is managed by a table 3. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a packet transfer device, a policy table search method and a policy table update method,
In particular, the present invention relates to a packet transfer device which is an inter-network connection device applied to a communication network of packets represented by IP packets, and a search method and an update method of a policy table used by the packet transfer device for packet identification.

[0002]

2. Description of the Related Art The Internet, which has been explosively developed in recent years, basically consists of a number of IP-based networks connected by packet transfer devices (hereinafter referred to as routers) which are inter-network connection devices. is there. The router has a function of controlling the exchange of packets between networks, and its basic function is to extract and recognize the destination of the received packet, and transfer the packet to the network that is close to the destination or the destination. is there.

When the Internet develops and various people access it to develop various services, packets flowing on the network are finely identified and various processes including processing of the packets are performed. The need for want is emerging. For example, in a so-called firewall, in order to limit the hosts on the internal network that can directly access the Internet from security requirements, the source of the packet is recognized to determine whether to pass or the Internet In the information providing service, there is a need to identify the packet destination and increase the charging counter in order to charge according to the packet amount.

The above-mentioned function may be implemented in the server itself which provides independent products and services, but originally has a similar function and is suitable for performing the above-mentioned service on the network. In many cases, such a function is implemented in a router that is often placed in the. As a router having such a function, for example, a router manufactured by Cisco is known. this
IOS, which is the control software installed in the router manufactured by Cisco, has a function called an access list that provides flexible packet transfer condition settings to meet the above security needs.

The above-mentioned router technology is based on Cisco IO
It is disclosed in S Security Configuration Guide, Release 12.1, and according to this document, the characteristics of the packet to be recognized (protocol, destination network, destination host, source network, source host, port number) and if there is a hit By creating a table called an access list in which items that specify two types of processing (whether or not to pass the packet) are arranged in order of priority, and adapting this table to any of the interfaces that the router has, It is to realize the function. Then, when a packet tries to pass through an interface to which an access list is applied, this conventional technique extracts features that the router should recognize from the packet, and the items from the highest priority item to the lowest priority item of the applied access list are extracted. The first item in which the characteristics of the passing packet and the specified characteristic match is processed, and the same is repeated for the packet to be passed next, and the priority is given to the matching item. Ignore low items.

The implementation of the packet identification function using the priority order as described above is adopted not only in the access list of Cisco IOS, but also in various devices and software which provide a so-called firewall function. Also, the processing provided by these is often so-called access control that mainly controls the input / output of packets, but it is necessary to be able to specify various processing when the items match. Therefore, it can be applied to a wide range of purposes such as billing processing.

In the specification of the present application described below,
For convenience of explanation, the characteristics of the packet to be identified are called identifiers, the processing performed when the identifiers match is called an action, and the item that combines both with the priority is called a policy. We will call it the policy table. In addition, a match between the identifier extracted from the packet and the policy identifier is regarded as a hit.

[0008]

DISCLOSURE OF THE INVENTION Problems to be Solved by the Invention
When the policy table having the above-described structure is directly expanded on the interface memory of the router, the following problem occurs when performing the process of adding a new policy in the table.

That is, in the above-mentioned prior art, since the policies are arranged in the memory in the order of priority, if a new policy having an arbitrary priority is added, all policies having a lower priority are set to 1. Since the policy table cannot be kept consistent during this process, it is necessary to stop the normal search process, especially when there are many policies. However, there is a problem that the processing capacity is seriously deteriorated.

An object of the present invention is to solve the above-mentioned problems of the prior art and to cause a period in which search is impossible when adding a new policy to a policy table or deleting an existing policy. Another object of the present invention is to provide a packet transfer device, a policy table search method, and a policy table update method that do not reduce processing capacity.

[0011]

According to the present invention, the above object is to provide a packet transfer apparatus which is connected to one or a plurality of input / output lines, identifies a packet input from each input, and outputs the packet to a corresponding output line. A policy table for identifying each packet is provided, the policy table is configured by storing one or more policies, and each policy is
It consists of a priority, an identifier for identifying a packet, a processing operation to be performed on the identified packet, and a next policy pointer indicating the start address of the policy to be searched next. This is achieved by providing a head policy pointer register that stores the head address of the policy for performing.

[0012] Further, the purpose is to, when a new policy is added to the policy table, write the policy itself in an arbitrary free area in the policy table, and retrieve it next to the policy in the storage area of the next policy pointer. This is accomplished by storing the start address of the policy to be added and changing the next policy pointer of the policy to be searched immediately before the newly added policy to the start address of the added new policy.

[0013]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of a packet transfer device, a policy table search method, and an update method according to the present invention will be described below with reference to the drawings.

FIG. 6 is a block diagram showing a configuration example of a packet transfer device according to an embodiment of the present invention, FIG. 7 is a block diagram showing a configuration of a packet processing unit, and FIG. 8 is a diagram explaining a configuration of a packet header. Then, first, an example of a packet transfer apparatus to which the policy table according to the present invention is applied will be described with reference to FIGS. 6 to 8. 6 and 7,
100 is a packet transfer device, 102-1 to 102-X are line interface units, 103 is a switch unit, 104 is a control unit, 101-1-1 to 101-1-M ₁ , ..., 1
01-X-1~101-X- M X is input and output lines, 111
-1 to 111-X are physical terminators, 112, 112-1 to
112-X is a packet processing unit, 113-1 to 113-X
Is an input / output control unit, 121A and 121B are header extraction units,
122A and 122B are policy search units and 123A and 12
3B is a routing processing unit, 124A and 124B are packet processing executing units, 141A and 141B are policy table memories, 142A and 142B are routing table memories, and 143A and 143B are FIFO memories and 144.
A and 144B are management tables.

The packet transfer apparatus 100 according to the embodiment of the present invention, as shown in FIG. 6, has a plurality of input / output lines 10.
1-1-1 to 101-1-M ₁ , ..., 101-X-1
To 101-X-M _X, and X line interface units 102-1 for accommodating one or a plurality of input / output lines
˜101-X and each line interface section 102-1˜
A switch unit 103 that transfers packets input from 101-X to the corresponding line interface units 102-1 to 101-X, and a control unit that performs routing protocol processing and management of routing information regarding each packet, and controls the entire device. And 104. And
Each of the line interface units 102-1 to 101-X has an input line 101-1-1 to 101-1-M ₁ , ..., 10
1-X-1 to 101-X-M _X physical terminators 111-1 to 111 for terminating signals input and extracting packets
-X, a packet processing unit 112-1 to 112-X that identifies each packet and performs packet counting and discard processing, and an input / output control unit 113-1 that controls the input / output of the packet between the switch unit 103. .About.113-X. Further, the policy table according to the present invention, which is not shown in FIG. 6, is expanded in the memory based on the policy information given from the control unit 104 to the respective line interface units 102-1 to 102-X), and the packet processing unit 112. -1-
Used in 112-X.

The packet processing unit 112, as shown in FIG. 7, receives the physical terminating unit 1 via lines 131A and 131B.
11-1 to 111-X and lines 132A and 132B
The input / output control units 113-1 to 113-X are connected to the control unit 104 via a line 135.

Then, the packet processing section 112 extracts headers from the packet input via the line 131A or 132B.
B, the policy tables 141A and 141B including a plurality of policies, and the policy table 141 based on the header information extracted by the header extraction units 121A and 121B.
The policy search unit 12 that searches A and 141B and notifies the packet processing execution units 124A and 124B of the search results (discard instruction, statistical information count, QoS mapping, etc.).
2A and 122B, a routing table 142A that indicates an output line or address corresponding to each packet
And 142B and the header extraction units 121A and 121B, the routing tables 142A and 142B are searched based on the header information extracted, and the routing processing unit 123A that notifies the packet processing execution units 124A and 124B of the search results (such as output line numbers). And 123B, FIFO memories 143A and 1 for temporarily storing packets
43B, management tables 144A and 144B that store the number of passed packets, the number of discarded packets, and the like, the policy search unit 1
The packet is discarded or the number of packets is counted based on the search result from 22A or 122B, the packet is read from the FIFO memory 143A or 143B, and the output line number or address is obtained based on the search result from the routing processing unit 123A or 123B. Packet processing execution units 124A and 12 for inserting the header and outputting the packet to the line 132A or 132B
4B is included.

The entries stored in the policy tables 141A and 141B and the routing tables 142A and 142B are stored in the routing processing unit 123 according to the information notified from the control unit 104 via the line 135.
The information of the management tables 144A and 144B, which are set by the A and 123B and the policy search units 142A and 142B, are periodically read from the control unit 104 via the line 135, for example.

In the packet processing unit 112 having the above-mentioned configuration, the line 131 from the physical processing unit 111.
Packets sent via A are stored in the FIFO memory 1
The header is temporarily stored in 43A, and the header is extracted by the header extracting unit 121A. The packet sent to the packet processing unit 112 has an additional header 51, a MAC header 52, and an IP header 5 as shown as a packet 50 in FIG.
It has 3 types of headers of 3 and IP data 54 following this header. A frame check sequence (FCS) may be added after the IP data 54.

The additional header 51 is an output line number 51-
1, the QoS class 51-2, the input line number 51-3, the MAC header 52 is the destination MAC address 52-
1, a source MAC address 52-2, a protocol type 52-3, and a VLAN ID 52-4 and a priority bit 52-5 when a VLAN (Virtual LAN) is supported, and the IP header 53 includes a service type (TOS) 53-1. Length 53-2, protocol number 5
3-3, a source IP address 53-4, a destination IP address 53-5 and the like. In the above,
The input line number 51-1 in the additional header 51 is inserted by the physical terminating unit 111.

The routing processing section 123A and the policy searching section 122A respectively use the routing table 142A and the policy table with all or part of the headers 51, 52 and 53 extracted by the header extracting section 121A as identifiers d _p. 141A is searched, and the respective search results are notified to the packet processing execution unit 124A. When a packet discard instruction is issued based on the search result of the policy search unit 122A, the packet processing execution unit 124A discards the packet temporarily stored in the FIFO memory 143A, counts up the number of discarded packets, and increments the management table. It is stored in 144A. When the packet discard instruction has not been issued, the packet processing execution unit 124A reads the packet from the FIFO memory 143A and outputs the output line number notified from the routing processing unit 123A as the output line number in the additional header 51. 5
QoS class 5 according to the QoS mapping method given to the area 1-1 and notified from the policy search unit 122A.
The value is mapped in the area 1-2, and the packet is transmitted to the line 132A. Output line number 5 given above
1-1 and the QoS class 51-2, the input / output control unit 11
3 is used for output control of packets. In addition, the packet processing execution unit 124A has a policy search unit 122A.
The number of packets is counted up in accordance with the counting processing method notified from and stored in the management table 144A.

The packet output from the input / output control unit 113 to the switch 103 and arriving at the input / output control unit 113 is
When input to the packet processing unit 112 via the line 132B, it is temporarily stored in the FIFO memory 143B,
The header is extracted by the header extraction unit 121B.

Each of the routing processing unit 123B and the policy searching unit 122B uses the routing table 142B and the policy, with all or part of the information of the headers 51, 52 and 53 extracted by the header extracting unit 121B as the identifier d _p ′. Search table 141B,
The search result of each is notified to the packet processing execution unit 124B. When a packet discard instruction is issued according to the search result of the policy search unit 122B, the packet processing execution unit 124B discards the packet temporarily stored in the FIFO memory 143B, counts up the number of discarded packets, and increments the management table. It is stored in 144B. When the packet discard instruction has not been issued, the packet processing execution unit 124A reads the packet from the FIFO memory 143B, and at the same time, outputs the destination MAC address and the source MAC address notified from the routing processing unit 123B to the MAC header 52. In the area of the destination MAC address 52-1 and the area of the source MAC address 52-2,
Send the packet out to line 132A. Input line number 5
1-3 are used when the physical processing unit 111 distributes packets to each line. Further, the packet processing execution unit 124A counts up the number of packets according to the counting processing method notified from the policy search unit 122B, and stores it in the management table 144B.

FIG. 1 is a diagram showing the configuration of a policy table used in the embodiment of the present invention, which will be described below.

The policy table 1 shown in FIG. 1 is shown in FIG.
Applied to policy tables 141A and 141B in
Policy table containing n policies
1 is stored in the transfer unit memory. Policy table
Each with priority P (1) to P (N) stored in 1
The policy is the address AD where each policy is stored.
(1) to the area of the storage address 11 that stores AD (N)
Area, priority number that stores priority P (1) to P (N)
No. 12 area, identifier d extracted from the packet _p And ratio
Identifier 1 that stores the compared identifiers D (1) to D (N)
Area 3, identifier d_p And the identifiers D (1) to D (N)
Action AC to be executed if they match
(1) to the area of action 14 that stores AC (N),
The next port that indicates the storage address of the policy to be compared next.
Store the receipt pointers NPP (1) to NPP (N)
It is composed of the area of the next policy pointer 15. Case
The delivery address 11 corresponds to each policy shown for convenience of explanation.
Is stored at addresses AD (1) to AD (N)
Yes, the address is actually stored in memory
Does not indicate.

FIG. 2 is a diagram for explaining the operation when the policy table 1 is actually tried to be searched for one packet. Next, referring to FIG. 2, the policy table 1 will be described.
The operation of searching for will be described.

When the search of the policy table 1 is started, the policy search unit first reads the contents of the search start pointer register SSPR2 indicating the address storing the policy having the highest priority, and the address indicates Regarding the policy, the identifier d _p extracted from the packet is compared with the identifier D (M) included in the area of the identifier 13, and if they match, the action AC (M) stored in the area of the action 14 is read. Then, the packet processing execution unit is caused to perform the processing instructed by the processing, and the search processing is terminated. On the other hand, when the identifiers do not match, the policy search unit reads the next policy pointer NPP (M) stored in the next policy pointer storage area, and performs the search processing from the policy stored in the address designated by the pointer. To resume. The above operation is performed up to the policy having the lowest priority = P (L). In many cases, the identifier D (L) included in the policy with the lowest priority = P (L) is specified to match all packets, and the next policy included in the policy with the lowest priority is designated. The content of the pointer NPP (L) is not an address but a special value (= end code) indicating the end of the search process.

In the example shown in FIG. 2, it is assumed that the destination network address 10.0.0.0 extracted from the packet is the identifier d _p , and the smaller the number of priorities in the table, the higher the priority. In this case, if the search process of the policy 21 is ended due to a mismatch, the process described above is continued, and then the process of the policy 22 of the next policy address AD (b) included in the area of the next policy pointer 15 of the policy 21 is performed. . The content of the identifier D (b) of the policy 22 is 192.168.24.0, which does not match the identifier d _p extracted from the packet.
The second action AC (b) is ignored, and the next policy pointer NPP (b) is read. Since NPP (b) indicates the storage address AD (c) of the policy 23,
Next, the policy 23 search processing is performed. Policy 23
Since the identifier D (c) (= 10.0.0.0) included in the packet matches the identifier d _p extracted from the packet, the action AC (c) (= discard) of the policy 23 is executed and the search processing is performed. To finish.

Next, a method of updating the policy table for adding a new policy to the policy table or deleting a policy will be described with reference to the drawings.

FIG. 3 is a diagram showing the structure of the policy table and the free address management table before the update, and FIG. 4 is the policy table and the free address management table after the process of adding a new policy to the table shown in FIG. 3 is completed. FIG. 5 is a diagram showing the configuration, and FIG. 5 is a diagram showing the configurations of the policy table and the vacant address management table after the process of deleting one policy from the table shown in FIG. 3 is completed.

In addition to the policy table, the embodiment of the present invention utilizes the free address management table 3 for managing the policy table. This free address management table 3 includes N invalid address pointers, and each invalid address pointer NAA (1) to NAA.
(N) includes one unused address in the memory space prepared for the policy table. When adding a new policy to the policy table 1, the address to which the pointer to be added is read is read from the Nth invalid address pointer NAA (N) of the free address management table 3, and the value of N is decremented by one. On the contrary, when an arbitrary policy is deleted from the policy table 1, the address in which the policy to be deleted is stored is stored in NAA (N) after incrementing N by one.

Now, it is assumed that a new policy of priority P (d) (= 1020) is added to the policy table shown in FIG. In this case, first, as shown in FIG. 4, the policy 24 is added as an additional policy to the address in the policy table 1 indicated by the Nth invalid address pointer NAA (N) of the empty address table 3.
At that time, the three elements of the policy to be added, that is,
The priority order P (d) is assigned to the area of the priority order 12 and the identifier D
(D) is written in the area of the identifier 13, and action AC (d) is written in the area of the action 14. After that, the policy table is sequentially scanned from the highest priority policy, and the policy having the priority to be searched immediately before the policy to be added, in this case, the policy 22,
Immediately after, a policy having priority to be searched, in this case, the policy 23 is searched. The value indicating the priority order of each policy stored in the area of the priority order 12 of the policy table 1 can insert another policy between adjacent priority orders as in the example shown in FIG. Different values are set. Next, the address AD (c) of the policy 23 to be searched next is written in the area of the next policy pointer 15 of the policy 24 as the next policy pointer NPP (d). Finally, the next policy pointer NPP of the policy 22 to be searched immediately before
The content of (b) is the storage address AD (d) of the policy 24.
Rewrite

By the above-mentioned processing, the update work for adding a new policy is completed. Figure 4 shows the completed work
Is shown in. During the series of updating operations as described above, there is no moment when the policy table 1 contains a contradiction that hinders the searching operation. Therefore, according to the embodiment of the present invention, the packet is transmitted during the updating operation of the policy table. It is possible to eliminate the need to interrupt the search operation of the extracted identifier d _p . Further, when adding a policy having a higher priority than the policy having the highest priority P (M), the policy table can be updated by almost the same procedure, but in this case, immediately before the policy to be added is added. Instead of rewriting the next policy pointer of the policy to be searched for, the content of the search start pointer register 2 may be rewritten to the address of the added policy.

Next, the processing operation for deleting the policy 22 from the policy table 1 shown in FIG. 3 will be described. In this case, as shown in FIG. 5, the next policy pointer NPP of the policy 21 searched immediately before the policy 22.
The content of (a) may be the address AD (c) of the policy 23 searched next to the policy 22, whereby the policy table 1 and the free address management table 3 after the policy 22 is deleted are shown in FIG. 5 is updated. Then, the address of the policy 22 is added to the free address management table 3. Also in this case, during the series of updating operations as described above, there is no moment when the policy table 1 contains a contradiction that hinders the searching operation. Therefore, according to the embodiment of the present invention, the updating operation of the policy table is performed. In the meantime, it is possible to eliminate the need to interrupt the search operation of the identifier d _p extracted from the packet. Also, when deleting the policy with the lowest priority, you can update the policy table by almost the same procedure,
In this case, the next policy pointer of the policy searched immediately before the policy to be deleted may be rewritten to the end code.

According to the above-described embodiment of the present invention, when the policy table is expanded in the memory, for each policy in the policy table, the address of the policy to be searched next after the completion of the search of the policy is indicated. Adding a new policy by providing a next policy pointer,
It is possible to update the policy table, such as deleting an existing policy, without creating a policy non-searchable period, and it is possible to prevent a reduction in the processing capability of the packet transfer device.

[0036]

As described above, according to the present invention, the update work of the policy table can be performed without creating the policy unsearchable period, and it is possible to prevent the processing capacity of the packet transfer device from being lowered. You can

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a policy table used according to an embodiment of the present invention.

FIG. 2 is a diagram for explaining an operation when an attempt is made to actually search the policy table 1 for one packet.

FIG. 3 is a diagram showing configurations of a policy table and an empty address management table before updating.

FIG. 4 is a diagram showing configurations of a policy table and a free address management table after the process of adding a new policy to the table shown in FIG. 3 is completed.

5 is a diagram showing configurations of a policy table and a free address management table after the process of deleting one policy from the table shown in FIG. 3 is completed.

FIG. 6 is a block diagram showing a configuration example of a packet transfer device according to an embodiment of the present invention.

FIG. 7 is a block diagram showing a configuration of a packet processing unit.

FIG. 8 is a diagram illustrating the configuration of a packet header.

[Explanation of symbols]

100 packet transfer device 102-1 to 102-X line interface unit 103 switch unit 104 control unit 101-1-1 to 101-1-M ₁ , 101-X- ₁ to 101-XM _X input / output line 111-1 to 111-X Physical termination unit 112, 112-1 to 112-X Packet processing unit 113-1 to 113-X Input / output control unit 121A, 121B Header extraction unit 122A, 122B Policy search unit 123A, 123B Routing processing unit 124A, 124B Packet processing execution units 141A and 141B Policy table memories 142A and 142B Routing table memories 143A and 143B FIFO memories 144A and 144B Management table

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Akio Makimoto             216 Totsuka Town, Totsuka Ward, Yokohama City, Kanagawa Prefecture             Ceremony Company Hitachi Ltd. Communication Division (72) Inventor Masami Takahashi             216 Totsuka Town, Totsuka Ward, Yokohama City, Kanagawa Prefecture             Ceremony Company Hitachi Ltd. Communication Division (72) Inventor Ken Anzai             216 Totsuka Town, Totsuka Ward, Yokohama City, Kanagawa Prefecture             Ceremony Company Hitachi Ltd. Communication Division (72) Inventor Masanori Uga             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation (72) Inventor Masaaki Shigetani             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation (72) Inventor Kohei Shiomoto             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation F term (reference) 5K030 GA15 HA08 HB16 HC01 HD03                       KA02 KX12 KX24 LC13 MA04                 5K033 AA08 CB08 CB17 DA06 DB12                       DB16

Claims (6)

[Claims] 1. A packet transfer device which is connected to one or a plurality of input / output lines and identifies a packet input from each input and outputs the packet to a corresponding output line, comprising a policy table for identifying each packet, The policy table stores one or a plurality of policies, and each policy has a priority and an identifier for identifying a packet.
A packet transfer device comprising: a processing operation to be performed on the identified packet; and a next policy pointer that indicates a start address of a policy to be searched next. 2. A packet transfer device that is connected to one or more input / output lines and identifies a packet input from each input and outputs the packet to a corresponding output line, storing one or more policies and identifying each packet. Then, the packet transfer apparatus is provided with a policy table for executing processing for the packet and a head policy pointer register storing a head address of a policy to be searched first. 3. One or a plurality of policies in a packet transfer device which is connected to one or a plurality of input / output lines and which is input from each input is identified and output to a corresponding output line is stored, and each packet is identified. In the search method of the policy table for executing the process for that packet, the search starts from the policy at the address indicated by the first policy pointer register that stores the first address of the policy to be searched first, and the search for any policy ends. Then, the policy stored in the address indicated by the next policy pointer of the policy is searched, and the policy table is searched. 4. One or a plurality of policies in a packet transfer device connected to one or a plurality of input / output lines to identify a packet input from each input and output to a corresponding output line are stored, and each packet is identified. When a new policy is added to the policy table in the method of updating the policy table for executing the processing for the packet, the policy itself is written in an arbitrary free area in the policy table, and the storage area for the next policy pointer is stored. A method of updating a policy table, characterized in that the start address of a policy to be searched next to that policy is stored in. 5. When writing a new policy to an arbitrary free area in the policy table, the next policy pointer of the policy to be searched immediately before the newly added policy is set to the start address of the added new policy. The method of updating a policy table according to claim 4, wherein the policy table is updated. 6. One or a plurality of policies in a packet transfer device connected to one or a plurality of input / output lines to identify a packet input from each input and output to a corresponding output line are stored, and each packet is identified. In the method of updating the policy table for executing the processing for the packet, when deleting the policy from the policy table, the next policy pointer of the policy searched immediately before the policy to be deleted is the next policy pointer of the policy to be deleted. The method of updating the policy table is characterized by changing to the address indicated by.