JP2003304293A - Packet repeater - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method allowing high-speed packet processing even if the high-layer packet processing is performed in a packet repeater, such as a router, a layer 2-3 switch. <P>SOLUTION: In the packet repeater, such as the router, the layer 2-3 switch, the multilayer high-speed packet processing method is applied to a packet which is decided to perform relay by layer 2 and 3 routing and low-layer packet filtering by means of a conventional ASIC (Application-Specific Integrated Circuit). Additionally, packet repeating processing is performed by preparing a plurality of high-layer filtering functions by means of the ASIC or a network processor according to the analyzing contents of every layer or the packet. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multi-layer packet processing method for a packet relay device.

[0002]

2. Description of the Related Art In the prior art, in the packet relay of a router which is a packet relay device or a layer 2-3 switch, the relay up to layer 4 can be relayed or filtered by hardware such as packet header information.
SSL (Secure Socket Layer)
r) Session ID and URL (Uniform Resource Locato)
Hardware can assist packet processing for packets of possible applications such as identifiers such as r), but other packets are processed by software.

In the prior art, the assist function by hardware is limited, and the relay processing by software is also C
There is a problem that the upper limit is suppressed by the PU processing performance.

[0004]

In the prior art, in order to execute the packet relay and filtering at high speed by looking at the header information in all layers, the ASIC (Ap
Replication specific integrated circuit) and network processors require packet processing, but the higher the layer, the more the amount of information in the header and information parts of the packet and the more information to manage such as the number of sessions. Therefore, in the ASIC, the assist can be performed only in a certain range, and even in the network processor, there is a problem that the program scale becomes large and the program memory of the network processor cannot be entered.

An object of the present invention is to provide a method capable of performing high-speed packet processing even in high-layer packet processing in a packet relay device such as a router or a layer 2-3 switch.

[0006]

The present invention provides a packet relay device such as a router or a layer 2-3 switch.
Providing one or more ASICs and network processors that perform high-layer packet processing after filtering low-layer packets by ASIC, depending on the layer or packet analysis range, to provide a high-speed packet processing method in multiple layers To do.

[0007]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows a first embodiment of the present invention.
From now on, referring to FIG.

FIG. 1 is a diagram showing a configuration example of a packet relay device to which this embodiment is applied. Packet relay device 100
The routing management unit 1 collects route information by the layer 2 and layer 3 route control protocols, creates and updates the routing table, and sets packet filtering by the network administrator.
01 and the routing table or filtering table distributed from the routing management unit 101,
A plurality of routing processing units 102 (102A, 102B to 102X) that perform packet routing processing
And an internal communication line 103 such as a switch connecting the routing management unit 101 and the plurality of routing processing units 102, and a line interface 104.

The routing management unit 101 includes a CPU 11
4, a main memory 115, and a packet control unit 112 for controlling packet transmission / reception via an internal communication line 116. It also has a packet buffer 113 connected to the packet control unit 112. The packet control unit 112 is connected to the internal communication line 103 by the switch access control unit 111.

The routing processing unit 102 includes a CPU 12
6, a main memory 127, a packet control unit “L” 122 that performs routing of layers 2 and 3 and filtering of layers 2 to 4, and a packet control unit “H” 132 that performs filtering of layers 5 to 7 They are connected by an internal communication line 128 such as a bus. The packet control unit “L” 122 and the packet control unit “H” 132
It is desirable to configure it with an ASIC or a network processor.

The packet control unit "L" 122 has a packet buffer "L" 123 for storing packets to be transmitted and received, and the packet control unit "H" 132 has a packet buffer "H" 133 as well. Further, the packet control unit “L” 122 has a table memory “L” 125 for storing routing tables of layers 2 and 3 and filtering tables of layers 2 to 4 A table search unit “L” 124 for comparison is connected.

Similarly, the packet control unit "H" 132 has a table memory "H" 134 for storing the filtering tables of layers 5 to 7, and a table search unit for comparing with a header of a packet transmitted and received. "H"
135 is connected. The packet control unit “L” 122 is 1
It is connected to the port control unit 113 that connects one or a plurality of line interfaces 104, and is connected to the internal communication line 103 via the switch access control unit 121. The packet control unit “H” 132 is connected to the packet control unit “L” 122, and is connected to the internal communication line 103 via the switch access control unit 121. The other routing processing units 102B to 102X also have the same configuration.

In the configuration example of the packet relay device shown in FIG. 1, information on layers 2 to 7 of a packet is transmitted to a packet control unit 2
An example is shown in which one packet control unit “L” 122 is used to filter layers 2 to 4 and a second packet control unit “H” 132 is used to filter layers 5 to 7. However, the present invention is not limited to this example, and it is also possible to prepare a plurality of packet control units for each layer or according to the analysis contents of the packet.

In the following, first, a general access method to a server such as WEB and an access method using a layer 4-7 switch will be described, and then a packet relay device to which the present embodiment is applied. An example of a network configuration and a processing outline when using is described.

FIG. 2 shows HTTP (Hyper Text Trans) used when accessing a WEB server on the Internet.
It is a figure which shows the example of the packet of (port Protocol). HT
The TP message 210 includes an HTTP header 211 indicating information such as a request and a response, and an HTTP body 2
It consists of 12. In a LAN environment, the HTTP message 210 has a MAC (Media Access Control) header 22.
1, an IP (Internet Protocol) header 222, and a TC
It is configured as an HTTP packet 220 to which a P (Transmission Control Protocol) header 223 is added.

In consideration of security, SSL (Se
When the cure socket layer) is used, the HTTP message 210 becomes an encrypted HTTP message 235, and is configured as an HTTP packet 230 with an SSL header 234 added. Regarding the outline of each data, when the TYPE field of the MAC header 221 is 0x0800 (hexadecimal number), it indicates that the upper protocol is IP, and the PRO of the IP header 222 is PRO.
When the TOCOL field is 6, it indicates that the upper protocol is TCP, when the destination port number of the TCP header 223 is 80, it indicates that the upper protocol is HTTP, and the TCP header 223
If the destination port number of 443 is 443, it indicates that the upper protocol is HTTP using SSL.

In FIG. 3, the client is the Internet or L
WEB server or F via network such as AN
It is a figure which shows an example of a network structure when utilizing a TP (File Transfer Protocol) server. Terminal 301
When A accesses the WEB server 302A, first, a DNS (Domain Name Server) 3 in the network 300
The message is exchanged with 04.
Obtain the IP address from the host name of the server 302A,
An HTTP request message 306A addressed to this IP address is transmitted to the WEB server 302A. The WEB server 302A transmits an HTTP response message 307A corresponding to the request content of the HTTP request message 306A to the terminal 301A.

HTTP response message 307A
Since the source IP address of the request message 306A is used as the destination address of, the DNS 304 is not used. The DNS 304 manages the correspondence between the host name and the IP address, and although only one is shown in this network configuration example, when there are multiple domains, there may be multiple domains depending on the domain management range. Yes, a plurality of DNSs cooperate with each other to manage the correspondence between host names and IP addresses. Terminal 301B is WEB server 302
When accessing C, the terminal 301C is the FTP server 3
When accessing 03B, the same message exchange as described above is performed. However, when accessing the FTP server 303, there are cases where an HTTP message is used and cases where the FTP protocol is used.

In FIG. 4, the client is the Internet or L
WEB server or F via network such as AN
It is a figure which shows an example of a network structure when using a layer 4-7 switch, when using a TP server. The WEB servers 402A to 402C are layer 4-
7 switch 406A manages as virtual host name 402G, and FTP servers 403A to 403C are virtual host name 403G by layer 4-7 switch 406B.
It is assumed that the layer 4-7 switch 406 and the DNS 304 are exchanging information in order for the client to access the server with the virtual host name.

When the terminal 401A accesses the WEB server 402G, the HTTP request message 40 is transmitted after the exchange with the DNS 304 as described in FIG.
7A is transmitted to the WEB server 402G. At that time, the layer 4-7 switch 406A makes an H request to an appropriate WEB server depending on the content of the HTTP request message 407A and the operating conditions of the WEB servers 402A to 402C.
Distribute the TTP request message. In this example, the HTTP request message 407A is 40
8A is transmitted to the WEB server 402A.

HTTP request message 407A
If you are using SSL as shown in Figure 2,
The layer 4-7 switch 406A decodes the encrypted contents to obtain the HTTP request message 40.
In 8A, it may be decrypted. WEB server 402A
Sends the HTTP response message 409A to the terminal 4
Send 01A. At that time, as described above, the layer 4-
In some cases, the 7 switch 406A encrypts an unencrypted HTTP response message 409A and transmits it as an HTTP response message 410A. When the terminal 401B accesses the WEB server 402G and when the terminal 401C accesses the FTP server 403G, the same message exchange as described above is performed. However, the message from the server side to the client side may not pass through the layer 4-7 switches 406A and 406B like 409B and 409C.

FIG. 5 is a diagram showing an example of a network configuration using the packet relay device 100 to which this embodiment is applied. The packet relay device 100, the terminal 501, the WEB server 502, the FTP server 503, and the DNS 304 are connected via networks 610 to 670. The packet relay device 100 performs the routing processing of layer 2 and layer 3, and also performs the layer 4-processing shown in FIG.
7 Appropriate WEB server or FTP as well as switch 406
Distribute HTTP messages to the server. The difference from the layer 4-7 switch is that the WEB servers 502A to 502C not on the same network can be accessed by the packet relay device 100A by the virtual host name 502G, and the FTP servers 503A to 5C.
03C can be accessed by the packet relay device 100B with the virtual host name 503G.

FIG. 6 is a diagram showing an example of IP addresses assigned to the network, packet relay device, terminal, etc. shown in FIG. FIG. 7A is a diagram showing an example of the routing table 700A stored in the table memory “L” 125 of the packet relay device 100A,
FIG. 7B shows the table memory “L” of the relay device 100B.
FIG. 8 is a diagram showing an example of a routing table 700B stored in 125. The routing table 700 has a network address 701 and a next hop address 7
02, and the entry 7 with the output port 703 as a set
It is configured to store a plurality of 04.

FIG. 8 is a diagram showing an example of the filtering table “L” 800 stored in the table memory “L” 125 of the packet relay device 100. The filtering table “L” 800 includes a plurality of entries each including a matching condition 801 of layers 2 to 4, a process 802 when matched, and a process ID 803 used when transferred to the packet control unit “H” 132. Store (80
4, 805, 806, etc.). FIG. 9 is a diagram showing an example of the filtering table “H” 900 stored in the table memory “H” 134 of the packet relay device 100. Filtering table “H” 900
Stores a plurality of entries including a process ID 901 for searching with the process ID 803 shown in FIG. 8 as a key, a match condition 902 of layers 5 to 7, and a process 903 when matched (904 and 905). , 906
Etc.) is configured.

FIG. 10 is a diagram showing an example of a processing procedure from the reception of the packet by the routing processing unit 102 to the transmission of the packet to the internal communication line 103 or the port control unit 113. In FIG. 5, the terminal 501
When A and 501B access the WEB server 502G, when the packet relay apparatus 100A receives the packet from the terminal 501A (step 1011), first, the packet processing “L” 1010 is performed. Packet processing "L"
In 1010, packet reception (step 101
2) At the same time, the header analysis of the layers 2, 3 and 4 of the packet is performed (step 1013), and the routing table 7
00A is searched (step 1014).

The destination address of the received packet is 192.16
Since it is 8.30.30, it can be seen that the entry 705 matches, the network address is 192.168.30.0, the next hop address is 192.168.30.1, and the output port is PA2. Furthermore, the filtering table “L” 800
, The entry 804 is matched, and the packet is transferred to the packet control unit “H”, a transfer packet is created (step 1015), and the process ID 803 is “0”.
Packet processing “H” by passing the information “01”
Perform 1020.

For other received packets, if there is no destination in the routing table 700 or if the filtering table 800 matches the condition and discards it, the packet is discarded (step 101).
5). The destination exists in the routing table 700,
If there is no matching condition in the filtering table 800, the packet is subjected to packet transmission processing (step 1030). The layer 2, 3 and 4 headers are analyzed (step 1013), and if an optional header is set in the IP header or TCP header, software processing is performed (step 1040).

In the packet processing "H" 1020,
Simultaneously with packet reception (step 1021), header analysis of layer 5 or higher of the packet is performed (step 102
2) The filtering table "H" 900 is searched (step 1023). Packet processing "L" 1010
From the process ID 901 of the filtering table "H" 900 based on the process ID passed from
If entry 904 matches, DA of IP header
Since it is set to 192.168.30.10, the routing table 700A is searched again, a transfer packet is created without changing the next hop address and the output port (step 1024), and packet transmission processing is performed (step 1030). ). WE from terminal 501A at this time
The packet flow to the B server 502G is 504 in FIG.
It becomes like A. In step 1023, the received packet is from the terminal 501B, and the processing ID 901 of the filtering table “H” 900 is “0”.
01 ”, if the entry 905 matches, I
The DA of the P header will be set to 192.168.40.10, and the routing table 700A will be searched again.
The next hop address and output port are found in entry 70.
6, the transfer packet is created (step 1024) and the packet transmission process is performed (step 1).
030).

At this time, the terminal 501B to the WEB server 5
The packet flow to 02G is as shown by 504B in FIG. When the terminal 501C accesses the FTP server 503G, the packet relay device 100 performs the same process as described above. In this case, the filtering table “L” 80
At 0, the entry 806 matches, at the filtering table “H”, the entry 906 matches, and the layer 5
The above contents are not questionable, and among the actual FTP servers 503A to 503C of the FTP server 503G, the address 192.168.50.10 of the FTP server 503B with the lowest load at this time is set as the DA of the IP header, and the routing is performed again. The table 700A is searched, the transfer packet is created without changing the next hop address and the output port (step 1024), and the packet transfer process is executed (step 1030). The packet flow from the terminal 501C to the FTP server 503G at this time is as shown by 504C in FIG.

In the first embodiment, an example of server selection is shown when the packet relay device accesses the server based on the information of layer 4-7. 4 to 4 and the packet control unit “H” 132 performs layer 5 to 7 packet processing, such as a firewall function and a QoS (Quality of Service) function.

Next, a second embodiment of the present invention will be described with reference to FIGS. In the second embodiment, an outline of processing when the processing of the packet control unit “H” 132 described in the first embodiment is performed by the input-side routing processing unit 132 and when it is performed by the output-side routing processing unit 132 Will be described.

FIG. 11 shows a packet control unit "H" 132A of the routing processing unit 102A on the input side when accessing the servers 1102A to 1102C from the network 1101A in the packet relay device 100.
6 is a diagram showing a packet flow when a server is selected as described in the first embodiment. FIG.

Usually, assuming that the packet flow is 1103, the packet control unit "H" 132A is
With the above information, the servers 1102A to 1102C
In the case of the process of selecting, the packet flow is 1104 up to the middle and 1105A to 1105C from the packet control unit “H” 132A. In this case, any of the routing processing units on the output side can be selected, which is suitable for arranging the server group in a wide area, but the processing load of the packet control unit “H” 132A on the input side becomes large. there is a possibility.

In FIG. 12, in the packet relay device 100, when the servers 1202A to 1202C are accessed from the network 1201A, the packet control unit "H" 132B of the output side routing processing unit 132B.
6 is a diagram showing a packet flow when a server is selected as described in the first embodiment. FIG. Assuming that the packet flow is normally 1203, the packet control unit “H” 132B uses the information of layer 5 and above.
In the case of processing for selecting the servers 1202A to 1202C, the flow of packets is 1204 up to the middle, and 1205A to 1 from the packet control unit “H” 132B.
It looks like 205C. In this case, there is a possibility that only one routing processor on the output side can be selected, which is suitable for arranging the server group under the routing processor. Layer 2 by the packet control unit “L” 122A
If the plurality of output side routing processing units 102 can be selected by the information of 4 to 4, the routing processing unit 1 of FIG.
The packet flow of 02B is also implemented in other routing processing units.

Next, a third embodiment of the present invention will be described with reference to FIGS. 13 and 14. In the third embodiment, in the processing of the packet control unit described in the first embodiment, when the destination of the packet is addressed to the routing management unit, a DoS attack or a DDoS (DDoS = Distributed
A malicious packet such as a nial of service attack is discarded by the packet control unit in the routing processing unit and the packet control unit “H” is set in the routing management unit.
An outline of processing when the information is discarded by having the above will be described.

13 and 14 show the packet relay device 100.
2 is a diagram showing an example of the configuration of a packet relay device 100 and a packet flow when a packet whose destination is the routing management unit 101 of FIG. Routing management unit 10
Most of the packets addressed to 1 are control packets such as a route control protocol, but in some cases, they may cause a problem in the operation of the packet relay device. Such a packet is shown in FIG. 13 as a packet control unit “L” 122A and a packet control unit “H” 13
2A, the packet control unit 122A and the routing management unit 101 in FIG. 14 have a packet control unit “H” 1401 that performs filtering of layers 5 to 7, so that they can be discarded.

A typical DoS attack is the mass transmission of an unrequested Ping response message or a message with an illegal IP address. These are the filtering table 80 of the packet control unit “L” 122.
It is possible to specify the discard with 0. That is, an illegal packet or a DoS attack packet can be discarded by the discard specification of the filtering table 800 based on the information of layers 2 to 4.

However, a packet which cannot be filtered only by this discard designation, that is, a malicious packet which can be regarded as a normal packet only by the information of layers 2 to 4 is packet control unit "H" 132 in FIG. 13 and packet control in FIG. The discarding is designated by the discarding designation of the filtering table 900 of the part “H” 1401. Thereby, for example, a large number of requests for pages that do not exist in the WEB server are transmitted by HTTP, and Not Found is sent.
Packets that generate a large number of response messages can be discarded.

Further, by applying the above-described embodiment, it is possible to realize a router, a layer 2-3 switch, an application switch, switching according to contents, load balancing, and the like.

[0040]

According to the present invention, high-speed packet processing in multiple layers can be realized.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration example of a packet relay device.

FIG. 2 is a diagram showing a configuration example of an HTTP packet.

FIG. 3 is a diagram showing an example of accessing a server.

FIG. 4 is a diagram showing an example of accessing a server using a layer 4-7 switch.

FIG. 5 is a diagram showing an example of accessing a server using a packet relay device.

FIG. 6 is a diagram showing an example of IP addresses of a network and a device.

FIG. 7 is a diagram showing a configuration example of a routing table.

FIG. 8 is a diagram showing a configuration example of a filtering table “L”.

FIG. 9 is a diagram showing a configuration example of a filtering table “H”.

FIG. 10 is a diagram showing a processing outline of packet transmission / reception processing.

FIG. 11 is a diagram showing an example in which a packet control unit on the input side performs server selection.

FIG. 12 is a diagram showing an example in which a packet control unit on the output side performs server selection.

FIG. 13 is a diagram showing an example in which a packet addressed to the routing management unit is discarded by the packet control unit in the routing processing unit.

FIG. 14 is a diagram showing an example of discarding a packet addressed to a routing management unit by a packet control unit in the routing management unit.

[Explanation of symbols]

100 ... Packet relay device 112, 122, 132, 1401 ... Packet control unit 220, 230 ... HTTP packet 800 ... Filtering table “L” 900 ... Filtering table “H”

Claims (7)

[Claims] 1. A packet relay device, comprising: first relay means for relaying a layer 2 and layer 3 packet and determining whether to relay or discard the packet based on information of layers from layer 2 to layer 3 or 4. One filtering means and the destination of the packet to be relayed or to be judged and to be relayed based on the information of the arbitrary range of the layers from layer 4 or layer 5 to layer 7 of the packet determined to be relayed by the first filtering means. A second filtering means for determining
A packet relay device comprising a second relay means for relaying a packet. 2. The packet relay device according to claim 1, wherein routing information is collected by a routing control protocol of Layer 2 and Layer 3, a routing table is created and updated, and Layer 2 to Layer 3 or 4 The first filtering table for filtering packets based on the information up to, and the first filtering table for determining the destination information of packets based on the information from layer 4 or 5 to layer 7 A routing management unit that creates a second filtering table; a first packet relay processing unit that relays a packet according to the contents of the routing table distributed from the routing management unit; Depending on the contents of the first filtering table, A first filtering processing unit that performs filtering of a packet and a destination determined by the contents of the second filtering table distributed from the routing management unit with respect to a packet determined to be relayed by the first filtering processing unit. A second filtering processing unit that determines information or performs filtering, and relay is determined by the second filtering processing unit, and at the same time, packet conversion is performed based on the information in the second filtering table. A packet relay device, wherein a plurality of routing processing units having a plurality of second packet relay processing units for relaying packets are connected via an internal communication line. 3. The packet relay device according to claim 1, wherein when the server device group is made virtually visible to an end user as one server device, the packet relay device is the server. A packet relay device comprising means for relaying a packet to the server device group in the routing processing unit on the input side when the device group is an entrance. 4. The packet relay device according to claim 1, wherein when the server device group is made virtually visible to an end user as one server device, the packet relay device is the server. A packet relay device comprising means for relaying a packet to the server device group at the routing processing unit on the output side when the device group is an entrance. 5. The packet relay device according to claim 1, wherein the packet is the destination of the packet relay device,
And a means for discarding the predetermined packet by the first filtering processing unit or the second filtering processing unit in the routing processing unit when the routing processing unit determines that the packet is to the routing management unit. A packet relay device characterized by the above. 6. The packet relay device according to claim 1, wherein when the packet whose destination is the packet relay device is relayed to the routing management unit by the routing processing unit, the routing management unit A packet relay device, wherein a unit has the first filtering means and the second filtering means, and is provided with means for discarding a predetermined packet. 7. The packet relay device according to claim 1 or 2, wherein the first or second filtering table includes a condition field for setting header information or information section information for each layer of a packet. If the condition is matched, the first instruction field for instructing whether to relay the corresponding packet without converting, converting and relaying, discarding, etc., and instructing to convert and relay in the first instruction field A packet relay device having a second instruction field for instructing a conversion method when the packet relay device is turned off.