JP2005051650A - Table search instrument - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem wherein search of the routing table of a VPN is slow, update is slow, and economical and large-scale entry is unrealizable, in a packet transfer instrument such as an IP router. <P>SOLUTION: This table search instrument is provided with a means which forms a VPN table search tree which has a VPN identifier for identifying a VPN to which an input IP packet belongs, and a tree for routing table search which has a following hop identifier for determining a following hop of this input IP packet for every VPN, respectively. In the VPN table search tree, the VPN identifier for identifying a VPN to which the input IP packet belongs and a pointer to the tree for routing table search which corresponds to the VPN are stored. In the tree for routing table search, an identifier for determining the following hop of the input IP packet is stored corresponding to following hop information. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention is used for a packet transfer apparatus such as an IP router. More particularly, the present invention relates to a table search device used when determining the next hop of a packet from the header information of the packet input from an input line when performing packet transfer processing.

  Conventionally, in a packet transfer device such as an IP router, a routing table is searched based on a destination address mounted in a packet header to determine a next hop. The routing table holds the relationship between the destination address and the next hop. As described above, the conventional Internet only performs a simple transfer process using only the destination address.

  In recent years, with the spread of the Internet, conventional simple transfer processing has become insufficient. In particular, VPN services have recently expanded. VPN is a service in which a carrier provides a virtual network to carrier customers. From the customer's perspective, the virtual network appears as a dedicated private network. By making it appear as a dedicated network, the carrier can provide security, secure IP address assignment, and services that meet customer needs.

  FIG. 9 shows an implementation example of the VPN service. A plurality of VPNs are connected to the packet transfer apparatus. An identifier for identifying a VPN and a routing table of the VPN are set for each VPN so that the different VPNs can be handled as independent. For this reason, transfer within the same VPN can be performed in a closed form within the VPN. FIG. 9 shows an example in which the input line and the source address of the IP packet are used as the VPN identifier. As a VPN identifier, it is conceivable to use not only this but also an L2 address (a MAC address in the case of Ethernet (registered trademark)).

  A rule for searching for a destination address in the packet transfer apparatus will be described. In the packet transfer apparatus, the routing table is searched based on the destination address mounted in the packet header, and the next hop is determined. The routing table holds the relationship between the destination address and the next hop. In the Internet, a CIDR (Classless Inter Domain Routing) mechanism is introduced, and the destination address of the routing table is expressed by a combination of a 32-bit IP address and a prefix length corresponding thereto. The destination address of the routing table is expressed in the format of “IP address / prefix length”.

  Of the destination address, the bit after the length specified by the prefix length is Don't Care. For example, 129.131.175.129/32 is a destination address in which all 32 bits are not Don't Care, and 129.60.83 / 24 is a valid destination address of the first 24 bits. The destination addresses of the packet headers 129.60.83.1 and 129.60.83.111 match the same destination address 129.60.83 / 24.

  The routing table is searched using the destination address of the packet header as a key. When searching the routing table, CIDR is based on a routing table search rule called longest match. The longest match is a correct answer when the destination address used for the key is the longest match. For example, when there are two destination addresses of destination address 129.38.11 / 24 and destination address 129.38 / 16 in the routing table, a packet having a destination address of 129.38.111.2 arrives Since the destination address 129.38.111 / 24 matches in a longer range, it is determined as the correct answer.

As a conventional example of searching for a destination address, a tree-based method and TCAM (Ternary
Introducing a method using Content Addressable Memory. FIG. 10 shows an example of searching for a destination address using a Patricia tree among the trees. Circles in the figure indicate tree nodes. A node stores a destination address, a pointer to the next node, and a rule number. In the drawing, the destination address is expressed by a binary number for the sake of simple notation, and * indicates that the value of the subsequent bits is ignored during the search. For example, the IPv4 destination address is originally 32 bits, but if the destination address is written as 10 *, the 3rd to 32nd bits are ignored during the search (the effective bit length is called the prefix length). Accordingly, when a packet such as an IPv4 destination address 10000101... (32 bits in total) in the packet header arrives at the packet transfer device, if there is 10 * in the destination address item on the routing table, that item. And the destination address of the packet header match. Conversely, if there is a 101 * on the routing table, it will not match.

  In the search using the Patricia tree, the tree is branched downward while comparing the destination address to be searched with the destination address stored in the node. When the IP address to be searched reaches a certain node, the search is performed from the higher order of the destination address indicated by the node and the destination IP address to be searched (bits immediately before *) to 100 *. Compare the upper 3 bits. If they do not match, the search ends. If there is a match, the process in the matched node is recorded.

  At the destination IP address to be searched next, pay attention to the last bit of the compared bits, and if there is a node lower than itself (hereinafter referred to as a child node), move to the child node and search If no child node exists, the search is terminated and the process in the policy table is executed from the recorded rule number. Hereinafter, a specific example in the case of searching for a destination address of 10000101... Will be described with reference to FIG.

First, the first bit of the destination address is checked to determine whether it is “0” or “1”. In this example, since it is “1”, it moves to the node 100 * and compares the upper 3 bits. Since they match, the fourth bit of the IP address which is the next check bit is checked. Since the check bit is 0, the process moves to the node 10001 *. However, since the check bits do not match, the search is terminated, and the two nodes * and 100 * match (for example, refer to Patent Document 1).
JP 2000-358064 A

  Since such a tree-based method can be realized by using a general-purpose memory such as SRAM or DRAM, it is possible to construct an economical device and support a large-scale entry. However, since there are VPN identifiers that include Don't Care like the source address, VPN routing table search is realized simply by increasing the search bit width of the Patricia tree. There is a problem that can not be done.

  There is a method of using TCAM (Ternary-Content-Addressable-Memory) for routing table search. A TCAM is a storage element that can be accessed using a value recorded at each address as a key, rather than using an address as a key. Not only binary values “0” and “1” but also “Don't Care” can be stored in each address of the TCAM. By using such a TCAM, a high-speed routing table can be searched. In the case of TCAM, when a plurality of items coincide with the ones input as keys at the same time, the one at the youngest address is selected. When the longest match search is performed using TCAM, it is necessary to store the prefix lengths in the order of increasing prefix length in the young address of TCAM.

  The minimum condition is that paths that share the same prefix part need to be stored in a younger address than those having a longer prefix length. It is a simple way to divide the TCAM storage area for each prefix length. FIG. 11 shows how to divide such areas. 129.60.83.121/31 is stored in the area where the prefix length is 31, and 129.60.83.121/30 is stored in the area of 30. When TCAM is used, rearrangement is necessary in this way, and there is a problem that it takes time to update. Many commercial TCAMs can have “0”, “1”, and “Don't Care” placed at any position. Searching by simply arranging the VPN identifier and routing table entries is not possible. Although it is possible, the capacity of TCAM is limited and the structure of TCAM itself is complicated and cannot be made on a large scale. In principle, since many addresses are searched simultaneously, very large power consumption is required and the cost is not economical.

  The present invention has been made against this background, and in a packet transfer device such as an IP router, the VPN routing table search is slow, the update is slow, and an economical and large-scale entry is realized. The purpose is to solve the problem of not being able to.

  The present invention is a table search apparatus that uses a tree to identify an IP packet input from an input line and determine the next hop of this packet. The present invention is characterized in that an input IP packet belongs to Means for holding a VPN table search tree having a VPN identifier for identifying a VPN and a pointer to a routing table search tree corresponding to this VPN, and a next hop for determining the next hop of this input IP packet And a means for holding a routing table search tree having an identifier for each VPN.

  As described above, in order to execute the search individually for each VPN, it is possible to increase the search speed as compared with the case where a single large tree that is not divided for each VPN is collectively searched as in the past. it can.

  Furthermore, by separately having a VPN table search tree and a routing table search tree, the identifier is updated individually when the VPN identifier is updated and when the next hop identifier is updated. Therefore, the update speed can be increased.

  As described above, in the configuration in which the VPN table search tree and the routing table search tree are connected using the pointer, these two trees can be implemented by being stored in physically or logically separate memory areas.

  Further, when an IP packet is input, means for extracting information used for identifying the VPN of the IP packet and information used for searching the routing table, information used for identifying the extracted VPN, and searching the VPN table Means for comparing VPN identifiers stored in the tree, means for selecting the routing table search tree corresponding to a pointer to the routing table search tree obtained as a comparison result of the comparing means, and extraction And means for searching for the next hop by comparing the information used for the routing table search with the next hop identifier stored in the routing table search tree selected by the selecting means.

  On the other hand, if these two trees are not stored in physically or logically separate memory areas, there is no need to connect these two trees using a pointer, and the end node of the VPN table search tree is directly used. In addition, a routing table search tree may be connected for each VPN.

  That is, the table search apparatus of the present invention determines a VPN table search tree having a VPN identifier for identifying the VPN to which the input IP packet belongs, and the next hop of this input IP packet respectively connected to the end node of this tree. And a means for holding a routing table search tree having a next hop identifier.

  Further, when an IP packet is input, means for extracting information used for identifying the VPN of the IP packet and information used for searching the routing table, information used for identifying the extracted VPN, and searching the VPN table Information used for the routing table search extracted using the means for comparing the VPN identifier stored in the tree and the routing table search tree connected to the terminal node reached as a comparison result of the comparing means And a means for searching for a next hop by comparing the next hop identifier stored in the routing table search tree connected to the terminal node.

  Another aspect of the present invention is a program characterized in that, when installed in an information processing apparatus, the information processing apparatus realizes functions corresponding to each means or each tree of the table search apparatus of the present invention. .

  Still another aspect of the present invention is the information processing apparatus-readable recording medium on which the program of the present invention is recorded. By recording the program of the present invention on the recording medium of the present invention, the information processing apparatus can install the program of the present invention using this recording medium. Alternatively, the program of the present invention can be directly installed in the information processing apparatus via a network from a server holding the program of the present invention.

  As a result, a general-purpose information processing device can be used to realize a high-speed and fast update of a VPN routing table using a tree in a packet transfer device such as an IP router, and an economical and large-scale entry. It is possible to realize a table search apparatus that can

  The present invention can realize an economical and large-scale entry at a high speed, a high-speed update of a VPN routing table using a tree in a packet transfer apparatus such as an IP router.

  Two embodiments of the present invention will be described below.

  FIG. 1 is a block diagram of the table search apparatus of the first embodiment. As shown in FIG. 1, a processing unit 1 that performs search processing and update processing of each tree, a RAM 2-1 that stores a VPN table search tree for identifying a VPN, and a RAM 2 that stores a routing table search tree for each VPN It consists of two. When a packet is input to the processing unit 1, information (for example, an input line number and a source address) for identifying a VPN and a destination packet are extracted from the packet header.

  First, using the VPN table search tree in the RAM 2-1 as a search key, information for identifying the VPN is used as a search key. As a search result, a routing table search tree pointer for each VPN is obtained.

  Next, a routing table search tree for each VPN is identified by this pointer, and a search is performed using the routing table search tree for each VPN in the RAM 2-2 using the extracted destination address as a key. The next hop is obtained as a search result. A packet is transmitted toward the obtained next hop. FIG. 2 shows information to be put in the RAM 2-1 that stores the VPN table search tree. In this example, an example in which a Patricia tree is adopted as a tree is shown.

  In this example, the input line number and the source address are used as information for identifying the VPN. 0E and 1E are bits indicating whether or not there is a child node whose next bit is 0 or 1. For example, since a node with the next bit of 0 exists in the node of 100 * in FIG. 9, a bit indicating that 0E exists is set. Similarly, since a node with the next bit of 1 exists, 1E exists. A bit stands.

  0-Address and 1-Address indicate the physical address of the RAM in which the child node is stored. VPNE indicates whether or not the pointer of the routing table search tree for each VPN exists in the node. Pointer of VPN is a pointer to a routing table search tree for each VPN, specifically, a physical address of the RAM 2-2 in which a routing table search tree for each VPN is stored. The Patricia tree is searched using this information.

  The search is performed at each node using the line number and the transmission source address as a search key, and the physical address of the RAM in which the child node is stored is used using 0-Address and 1-Address to further search to the child node. obtain. The search is advanced to the child node based on the physical address, and finally a pointer can be obtained as a search result.

  FIG. 3 shows information to be put in the RAM 2-2 for storing a routing table search tree for each VPN. In this example, an example in which a Patricia tree is adopted as a tree is shown. OUTE indicates whether or not a next hop exists at the node. The search method is not different from the description of FIG. The final result is the next hop.

  FIG. 4 is a diagram showing a logical image of the search in this embodiment. After searching the VPN table search tree, the routing table search tree of each VPN is searched using the pointer for each VPN. Since the RAM 2-1 for storing the VPN table search tree for identifying the VPN and the RAM 2-2 for storing the routing table search tree for each VPN are separated, the routing table in the VPN is updated by closing the VPN. Can be updated at high speed. In addition, since a tree is used, it is possible to construct an economical device and to support a large-scale entry.

  FIG. 5 is a block diagram of the table search apparatus of the second embodiment. As shown in FIG. 5, it includes a processing unit 1 that performs search processing and update processing of each tree, and a RAM 3 that stores a VPN routing table batch search tree. When a packet is input to the processing unit 1, information (for example, an input line number and a source address) for identifying a VPN and a destination address are extracted from the packet header. The information for identifying the VPN and the destination address are connected, and a search is performed using the VPN routing table batch search tree as one search key. FIG. 6 is a diagram illustrating an example of a VPN routing table batch search tree. As shown in FIG. 6, the VPN routing table batch search tree is directly connected to the end node of the VPN table search tree shown in FIG. 4, and the routing table search tree shown in FIG. 4 is directly connected to each VPN. It is a configuration.

  There are two types of information for identifying the VPN. The first is information that is a unique value such as an input line number. The second is information in which the Don't Care portion exists and the value is not unique, such as the source address. In the second embodiment, since the VPN search and the next hop search are performed with a single tree, if there is a Don't Care part, the connection of the tree is interrupted at that part. Therefore, in the second embodiment, a measure for avoiding this Don't Care portion is required. In the first embodiment, if the tree for VPN search is interrupted at the Don't Care portion, the VPN search is terminated at that point, and a pointer for next hop search can be acquired. A t Care portion may be present.

  Here, in order to avoid the Don't Care portion, a method of converting information having a Don't Care portion and having a non-unique value into unique information will be described. For example, with a 3-bit value, 10 * is equivalent to two of 100 and 101. FIG. 7 shows an example in which a non-unique source address is increased to make unique information and a VPN routing table is constructed.

  That is, in the example of FIG. 7, the source address is originally 192.168.1.180/30, and the 30th to 32nd bits are Don't Care portions. In order to avoid this, a plurality of 192.168.1.180/32, 192.168.1.181/32, 192.168.1.182/32, 192.168.1.183/32 Generate a source address and respond. In other words, the Don't Care part is an "anything" part. Therefore, it is possible to cope with the occurrence of inconvenience in the tree search by appropriately generating a plurality of transmission source addresses.

  Even if non-unique information is included as a type of information for identifying the VPN as in this example, it is possible to make a set of unique information. FIG. 8 shows information to be stored in the RAM 3 that stores the VPN routing table batch search tree. By using this VPN routing table to construct a VPN routing table batch search tree, it is possible to search information used for VPN identification and information used for routing table search at a time. Since a search can be performed at a time, a high-speed search is possible. Since a tree is used, it is possible to construct an economical device and to support a large-scale entry.

  The present invention can be implemented as a program that, when installed in a general-purpose information processing apparatus, causes the information processing apparatus to realize a function corresponding to the table search apparatus of the present invention. The program is recorded on a recording medium and installed in the information processing apparatus, or installed in the information processing apparatus via a communication line, thereby causing the information processing apparatus to realize a function corresponding to the processing unit 1. it can.

  The present invention can realize an economical and large-scale entry at a high speed, a high-speed update of a VPN routing table using a tree in a packet transfer apparatus such as an IP router. As a result, the convenience of the user or the administrator can be improved in the operation of a VPN that is expected to be highly demanded in the future.

The figure which shows the apparatus structural example of a 1st Example. The figure which shows the information which should be put in RAM which stores a VPN table search tree. The figure which shows the information which should be put in RAM which stores the routing table search tree for every VPN. The figure which shows the logical image of the search of a 1st Example. The figure which shows the structural example of the table search device of 2nd Example. The figure which shows an example of the tree for VPN routing table batch search. The figure for demonstrating making it into unique information by increasing the non-unique transmission source address, and building the routing table for VPN. The figure which shows the information which should be put in RAM which stores the tree for VPN routing table batch search. The figure for demonstrating the implementation example of a VPN service. The figure for demonstrating a Patricia tree. The figure for demonstrating dividing an entry into prefix length when performing the longest match search using TCAM.

Explanation of symbols

1 Processing unit 2-1, 2-2, 3 RAM

Claims (6)

In a table search apparatus that uses a tree to identify an IP (Internet Protocol) packet input from an input line and determine the next hop of this packet (the address of the router that forwards the packet next),
Means for holding a VPN table search tree having a VPN identifier for identifying a VPN (Virtual Private Network) to which the input IP packet belongs, and a pointer to a routing table search tree corresponding to the VPN;
A table search apparatus comprising: a means for holding a routing table search tree having a next hop identifier for determining a next hop of the input IP packet for each VPN. Means for extracting information used for identifying the VPN of the IP packet and information used for searching the routing table when the IP packet is input;
Means for comparing the extracted information used for identifying the VPN with a VPN identifier stored in the VPN table search tree;
Means for selecting the routing table search tree corresponding to the pointer to the routing table search tree obtained as a comparison result of the means for comparing;
2. A means for searching for a next hop by comparing the extracted information used for the routing table search with a next hop identifier stored in the routing table search tree selected by the selecting means. Table search device. In a table search apparatus that uses a tree to identify an IP packet input from an input line and determine the next hop of this packet,
A VPN table search tree having a VPN identifier for identifying the VPN to which the input IP packet belongs, and a routing table having a next hop identifier for determining the next hop of this input IP packet respectively connected to the end node of this tree A table search device comprising means for holding a search tree. Means for extracting information used for identifying the VPN of the IP packet and information used for searching the routing table when the IP packet is input;
Means for comparing the extracted information used for identifying the VPN with a VPN identifier stored in the VPN table search tree;
Using the routing table search tree connected to the terminal node reached as a comparison result of the comparing means, the information used for the routing table search extracted and the routing table search tree connected to the terminal node The table search device according to claim 3, further comprising means for searching for a next hop by comparing with a next hop identifier stored in.   A program that, when installed in an information processing apparatus, causes the information processing apparatus to realize a function corresponding to each means or each tree of the table search apparatus according to any one of claims 1 to 4.   6. A recording medium readable by the information processing apparatus on which the program according to claim 5 is recorded.

Images