JP2005079717A - Device and method for transferring packet - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide packet transfer device and method for performing a NAT processing by high throughput. <P>SOLUTION: A classification device 101 performs selection to give a received packet to a CPU 106 or a routing NAT processing part 102 in accordance with a procedure written in a classification rule table 103. The CPU 106 performs the NAT processing on the packet received from the classification device 101 by using a NAT module and a routing table so as to output it. The CPU writes information (IP address and port number) on a network used in the NAT processing in a NAT table 105. The routing NAT processing part 102 performs the NAT processing on the packet received from the classification device 101 based on the routing table 104 and the NAT table 105. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a packet transfer apparatus and a packet transfer method.

  As a conventional packet transfer apparatus, there is one described in Patent Document 1. This conventional packet transfer apparatus realizes NAT passage of applications that could not pass NAT (Network Address Translation) such as FTP (File Transfer Protocol), H.323, and SIP (Session Initiation Protocol). An example of a conventional packet transfer apparatus will be described with reference to FIG. In the conventional packet transfer apparatus, a means is adopted in which only a specific packet is selected and its content is changed based on a procedure programmed in advance or set by a user. The router 802 has a rule in which a packet having a destination port number of 21 is selected in advance and the contents of the port command included therein are rewritten.

Here, when a TCP (Transmission Control Protocol) session is established between a PC (Personal Computer) 801 and an FTP server 803 and a port command is transmitted, the router 802 performs the same process as the normal NAT processing as shown in FIG. In addition to rewriting the source IP (Internet Protocol) address and port number, the IP address and port number in the port command are also changed to appropriate values. However, the value changed here and the original value are stored in association with each other. As a result, the FTP server 803 returns a port command response to the PC 801 and then tries to establish a TCP session for data connection to the IP address and port number rewritten by the router 802. Since the router 802 associates and holds this destination and the IP address and port number originally designated by the port command by the PC 801, the router 802 can correctly transmit a SYN (Synchronize Flag) packet to the PC 801. Then, subsequent data transfer by FTP becomes possible.
Japanese National Patent Publication No. 10-504168

  However, in the conventional packet transfer apparatus, it is necessary to frequently upgrade in order to cope with processing of new applications, and FTP, H.264, and so on. The NAT processing is performed by software for the reason that it is difficult to realize various processes of the upper layer such as H.323 and RTSP by hardware such as ASIC (Application Specific Integrated Circuit). When processing is performed, there is a problem that an inexpensive CPU used for a home router cannot obtain high throughput. In addition, since packet filtering is fixedly set, detailed packet filtering such as packet filtering after confirming the port number and message content cannot be performed, so there is a security problem.

  The present invention has been made in view of this point, and an object of the present invention is to provide a packet transfer apparatus and a packet transfer method that perform NAT processing with high throughput, and to provide a dynamic packet filtering apparatus.

  The packet transfer apparatus according to the first aspect of the present invention includes a first communication processing system and a second communication processing system, and the first communication processing system includes a classification device, a class file table, and a routing NAT process. A class table, a routing table, and a NAT table, wherein the classifying device is a destination of a packet to be received based on rule information of the class file table, whichever one of the first communication processing system and the second communication processing system Alternatively, packet discard is selected, and the second communication processing system performs NAT processing using a NAT module and the routing table or the second communication processing system holds the packet received from the classification device. Routing of the packet based on the routing table information of Other routing NAT processing means for processing, writing means for writing information used in the NAT processing to the NAT table, and other writing means for writing the rule information to the class file table. The routing NAT processing means of the first communication processing system adopts a configuration in which the NAT processing and the routing processing are performed on the packet received from the classification device based on information in the NAT table and the routing table.

  According to this configuration, high-speed packet routing processing and NAT processing by the first communication processing system hardware, dynamic packet filtering processing, and packet routing processing and NAT processing by the second communication processing system software are performed. By using them properly, high-throughput packet transfer can be realized even for streams that require complex NAT processing.

  An integrated circuit according to a second aspect of the invention employs a configuration including the first communication system in the packet transfer apparatus according to the first aspect.

  According to this configuration, in addition to the effect of the first aspect, the packet transfer device can be reduced in size and weight.

  According to a third aspect of the present invention, there is provided a method for controlling a packet transfer apparatus, wherein a first communication processing system or a second communication processing system is used as a destination of a packet received by a classification device based on rule information of a class file table. A step of selecting or discarding the packet, and a NAT process using a NAT module for the packet received by the second communication processing system from the classification device and other routings held by the routing table or the second communication processing system. A step of routing the packet based on information in the table, a step of writing information used by the second communication processing system to the NAT table in the NAT table, and the second communication processing system The rule information is written to the file table. And flop, the first communication processing system is so equipped, and performing the NAT processing and the routing processing based on the information of the said packet NAT table and the routing table received from the classifier device.

  According to this method, high-speed packet routing processing and NAT processing and packet filtering processing by the first communication processing system hardware and packet routing processing and NAT processing and dynamic packet by the second communication processing software By properly using the filtering process, it is possible to realize a high-throughput packet transfer even for a stream that requires a complicated NAT process.

  A control program for a packet transfer apparatus according to a fourth aspect of the invention employs a configuration for causing a computer to execute the control method for the packet transfer apparatus according to the third aspect.

  According to this configuration, the high-speed routing processing and NAT processing of packets by the hardware of the first communication processing system and the packet routing processing and NAT processing of software of the second communication processing system are properly used, thereby making it complicated. High throughput packet transfer can be realized even for a stream that requires NAT processing.

  As described above, according to the present invention, high-speed packet routing processing and NAT processing by hardware of the first communication processing system, packet filtering processing and packet routing processing by software of the second communication processing system, and By properly using NAT processing, packet transfer and dynamic packet filtering can be performed with high throughput.

  The essence of the present invention is that the classification device provided in the first communication processing system performs high-speed routing processing and NAT processing of packets by hardware based on the information in the class file table written by the second communication processing system. One of a first communication processing system that performs packet filtering processing and a second communication processing system that performs packet routing processing and NAT processing by software is selected.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of a packet transfer apparatus according to an embodiment of the present invention.

  The packet transfer apparatus 100 according to an embodiment of the present invention includes a classification apparatus 101, a routing NAT processing unit 102, a class file table 103, a routing table 104, a NAT table 105, and a CPU 106.

  The classifying apparatus 101 selects, according to the procedure written in the class file table 103, whether to give the received packet to the CPU 106 or the routing NAT processing unit 102 or to discard the packet. The CPU 106 performs NAT processing on a packet received from the classification device 101 using a routing table held by the NAT module and an OS executed on the CPU, outputs the packet, and information on the network (IP address and port) used in the NAT processing. Number) is written in the NAT table 105 and the class file table 103. The routing NAT processing unit 102 performs NAT processing on a packet received from the classification device 101 based on the routing table 104 and the NAT table 105 and outputs the packet. Note that the CPU 106 performs processing to periodically match the routing table information held in the routing table 104.

  The packet transfer apparatus 100 has two functional blocks. That is, the packet transfer apparatus 100 includes a routing circuit unit 107 and a CPU 106. The routing circuit unit 107 includes a classification device 101, a class file table 103, a routing table 104, a NAT table 105, and a routing NAT processing unit 102. The CPU 106 forwards the IP packet by software. The routing circuit unit 107 is realized by an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA), and enables high-speed forwarding.

  Here, the routing circuit unit 107 is an integrated circuit including the classification device 101, the class file table 103, the routing table 104, the NAT table 105, and the routing NAT processing unit 102. The routing table 104, the NAT table 105, and the routing NAT processing unit 102 may be arranged separately.

  Further, in the packet transfer apparatus 100 according to the embodiment of the present invention, the CPU 106 periodically includes the routing table information held therein in the routing circuit unit 107 as the first communication processing system. However, the second communication processing system includes another routing table, and periodically performs processing for matching the routing table information held by the CPU 106 with the other routing table. It is good also as a structure.

  FIG. 2 is a diagram for explaining software used in NAT processing performed by the CPU 106 of the packet transfer apparatus 100 according to the embodiment of the present invention. FIG. 3 is a diagram for explaining the configuration of the class file table of the packet transfer apparatus 100 according to the embodiment of the present invention. FIG. 4 is a diagram for explaining an outline of a packet configuration when the packet transfer apparatus 100 according to an embodiment of the present invention processes a packet inside the apparatus. FIG. 5 is a diagram for explaining the configuration of another class file table of the packet transfer apparatus 100 according to an embodiment of the present invention. FIG. 6 is a diagram for explaining the configuration of the NAT table of the packet transfer apparatus 100 according to the embodiment of the present invention. FIG. 7 is a diagram for explaining a series of processing until the LAN side PC and the WAN side FTP server establish a TCP session via the packet transfer device in the embodiment of the present invention.

  In FIG. 2, the monitoring control unit 201 periodically monitors the device status and accepts a command input from the user, and sets the routing table held by the OS and various tables of the routing circuit unit 107. The FTP-compatible NAT module 202 is dynamically loaded or unloaded on the TCP / IP protocol stack, and rewrites the contents of the port command.

  Next, the operation of the packet transfer apparatus 100 will be described along the flow shown in FIG. 7 with reference to FIGS. Here, in the packet transfer apparatus 100, the setting shown in FIG. 3 is set in the class file table 103 so that the monitoring control unit 201 can perform the NAT of FTP, and the FTP-compatible NAT module 202 is set by the OS from the TCP / IP protocol. Assume that it is loaded on the stack.

  In FIG. 1 and no. The entry of 2 is a setting necessary for passing through the NAT of FTP. Specifically, the classification device 101 receives a destination port number (meaning a direction from the PC 701 on the LAN side to the FTP server 702) or a source port number (from the FTP server 702 to the LAN) stored in the port command of the received packet. Is set to transfer to the CPU 106 a packet whose value is 21). Here, “-” in each item indicates that the item is Do n’t Care. In addition, No. The entries 3 and 4 are settings that do not allow passage of SYN packets (that is, Ack bit (Positive Acknowledgment Bit) is OFF) that is a TCP session establishment request from the WAN, that is, an external network. This setting is registered on the router.

  In this state, when the classification device 101 receives the packet of the transmission destination port number 21 from the PC 701 existing on the LAN side, the classification device 101 transfers the packet to the CPU 106. At this time, as shown in FIG. 4, the classification device 101 further adds unique information to the end of the standard frame format from the Ethernet (R) header to the trailer and transfers it to the CPU 106. This unique information can be used for various purposes. Here, the unique information is used as an area for identifying that the NAT module should be activated. When the predetermined bit of the area is ON, the NAT module is activated. In the present embodiment, it is assumed that the classifying apparatus 101 turns on this bit when a specific port number is specified in the class file (for example, No. 1 and No. 2 in FIG. 3).

  Next, the classification apparatus 101 receives a response packet transmitted from the FTP server 702 in response to a packet for establishing a TCP session sent from the PC 701 on the LAN side. At this time, since the packet with the port number 21 is set in the class file table 103 so as to be passed to the CPU 106, the classifier 101 passes the packet to the CPU 106. As a result, an FTP control connection session is established, a packet including a PORT command is transmitted from the PC 701, the routing circuit unit 107 receives it, and the classifier 101 refers to the class file table 103.

  The packet including the PORT command transferred to the CPU 106 in this manner is subjected to processing for each layer by the TCP / IP protocol stack (specifically, Ethernet (R) driver, IP, TCP) shown in FIG. After the packet is processed up to the TCP layer, the CPU 106 refers to the unique information area shown in FIG. 4 and checks whether a bit is set. Here, since the bit is ON, the FTP-compatible NAT module 202 is further activated. The packet content rewriting process of the FTP-compatible NAT module 202 is performed by changing the source IP address and port number (change from 192.168.0.10 to 202.19.176.120 and 5038 to 8279, respectively), and the IP address and port in the PORT command. Number change (change from 192.168.0.10 to 202.19.176.120 and 2000 to 3083, respectively).

  Next, the CPU 106 sets the contents of the class file table 103 and the NAT table 105 so that the routing NAT processing unit 102 can perform subsequent packet forwarding at high speed. Specifically, the CPU 106 changes the entry number of the class file table shown in FIG. 3, it is set so that packets whose destination IP address and destination port are 202.19.176.120 and 3083, respectively, are passed to the routing NAT processing unit 102 by the classifier 101. With this classifier setting, packets whose transmission destination IP addresses and transmission destination ports are 202.19.176.120 and 3083 that could not pass in the setting of FIG. 3 can be passed, thereby realizing dynamic packet filtering. Further, the CPU 106 sets the entry number of the NAT table 105 shown in FIG. The old transmission source IP address, the old transmission source port, the new transmission source IP address, and the new transmission source port are set to 192.168.0.10, 2000, 202.19.176.120, and 3083, respectively.

  Next, the classification device 101 receives a PORT response packet transmitted from the FTP server 702. At this time, since the packet with the port number 21 is set in the class file table 103 so as to be passed to the CPU 106, the classifier 101 passes the packet to the CPU 106. Here, in FIG. 7, for the sake of convenience, it is expressed that the packet is directly passed to the CPU 106 without passing through the classification device 101 of the routing circuit unit 107.

  The CPU 106 rewrites the packet information and transfers it to the LAN-side PC 701 with reference to the NAT table 105. Further, in order to enable subsequent packet forwarding at high speed in the routing NAT processing unit 102, the NAT table shown in FIG. 6 is based on the address and port number included in the port command of the response packet from the FTP server 702. No. 105 entry No. Complete the second setting. Here, in the NAT table 105, “transmission source” and “transmission destination” mean “transmission source” and “transmission destination” for uplink packets from the LAN to the WAN, respectively. The old transmission source means the PC 701 on the LAN side, and the new transmission source means the router itself.

  The NAT table 105 is completed by the above processing, so that the file data packet transferred from the FTP server 702 is not processed by software in the CPU 106, and the routing NAT processing unit 102 performs the routing table 104 and the NAT table. Based on 105, routing processing and NAT processing are performed at high speed.

  According to an embodiment of the present invention, high throughput packet transfer is realized by reducing NAT processing by software of the second communication processing system and performing high-speed forwarding by hardware by the first communication processing system. it can.

  Note that the above description has been described assuming FTP as an application. In the case of H.323, the source IP address in the SETUP message is rewritten, in the case of SIP, the source IP address in the INVITE message, and even in the case of RTSP, the destination IP address and port in the SETUP message You only have to rewrite the number. Therefore, by changing or adding the setting contents of the class file table to be initially set and the contents of the NAT module, the packet transfer apparatus 100 can perform the NAT passage of packets and the dynamic packet in substantially the same manner as described above. Filtering can be easily realized.

  In the embodiment of the present invention, after the information is written in the NAT table by the second communication processing system, the first communication processing system performs the routing process and the NAT process based on the NAT table and the routing table. The second communication processing system rewrites the class file table so that the second communication processing system can select the destination of the packet according to the contents of the packet. It is good also as a structure which rewrites as needed.

  The packet transfer apparatus and the packet transfer method according to the present invention are useful as those capable of performing packet transfer and dynamic packet filtering with high throughput.

The block diagram which shows the structure of the packet transfer apparatus which concerns on one embodiment of this invention The figure for demonstrating the software used in the NAT process which CPU of the packet transfer apparatus concerning one embodiment of this invention performs The figure for demonstrating the structure of the class file table in one embodiment of this invention The figure for demonstrating the outline of a structure of the packet in one embodiment of this invention The figure for demonstrating the structure of the other class file table in one embodiment of this invention The figure for demonstrating the structure of the NAT table in one embodiment of this invention The figure for demonstrating a series of processes until a TCP session is established via the packet transfer apparatus in one embodiment of this invention The figure which showed an example of the conventional packet transfer apparatus

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Classifier 102 Routing NAT processing part 103 Class file table 104 Routing table 105 NAT table 106 CPU
107 Routing Circuit Unit 201 Monitoring Control Unit 202 FTP Compatible NAT Module 701 PC
702 FTP server

Claims (4)

A first communication processing system and a second communication processing system;
The first communication processing system includes a classification device, a class file table, a routing NAT processing means, a routing table, and a NAT table,
The classification device selects either the first communication processing system or the second communication processing system or packet discard based on the rule information of the class file table as a destination of the received packet,
The second communication processing system is configured to perform NAT processing using a NAT module on the packet received from the classification device and information on the routing table or another routing table held by the second communication processing system. Other routing NAT processing means for routing the packet, writing means for writing information used in the NAT processing to the NAT table, and other writing means for writing the rule information to the class file table , And
The routing NAT processing means of the first communication processing system performs the NAT processing and the routing processing on the packet received from the classification device based on information of the NAT table and the routing table. Packet transfer device.   2. An integrated circuit comprising the first communication processing system in the packet transfer apparatus according to claim 1. Selecting one of the first communication processing system and the second communication processing system or discarding the packet based on the rule information of the class file table as the destination of the packet received by the classification device;
The packet received by the second communication processing system from the classification device based on NAT processing using a NAT module and information on the routing table or other routing table held by the second communication processing system A routing process, a step in which the second communication processing system writes information used in the NAT process to the NAT table, and a second communication processing system writes the rule information in the class file table. Steps,
Performing the NAT process and the routing process on the basis of information of the NAT table and the routing table for the packet received by the first communication processing system from the classification device. Control method of the device.   A control program for a packet transfer apparatus that causes a computer to execute the control method for the packet transfer apparatus according to claim 3.

Images