JP2006254340A - Ip packet processing apparatus and address searching method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for realizing address searching processable at high speed and needing a small table capacity only by integrating the address searching having been executed by both a transmission side and a reception side in prior arts into only the reception side. <P>SOLUTION: In the case that a succeeding hop destination from its own apparatus is limited to one MAC_DA by each VPN, a VLAN value is extracted from an IP packet, an address searching table is searched by using the VLAN value for a key, a VPN identification ID for identifying a VPN group corresponding to the VLAN value is searched, succeedingly, a MAC_DA determined uniquely corresponding to the VPN identification ID is provided to the IP packet, and a logical path number of the VLAN including the succeeding hop destination is provided to the IP packet to which the VPN identification ID and the MAC_DA are provided on the basis of the VPN identification ID and the MAC_DA. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an address search technique for an IP packet processing apparatus that requires high-speed processing.

  A conventional address search method will be described with reference to FIGS. FIG. 6 is a diagram for explaining a network configuration according to a conventional address search method. 7 is a block diagram of a conventional IP packet processing device. In FIG. 7, 6 is a reception physical layer processing unit, 7 is a reception address search processing unit, 8 is a reception address search table, 9 is an IP packet processing unit, 10 is a transmission address search processing unit, 11 is a transmission address search table, and 12 is a transmission physical layer processing unit. For example, in Patent Document 1, there is a search table for storing flow information on the reception side and the transmission side.

  Next, the operation will be described. As shown in FIG. 6, in the IP packet processing apparatus 101 connected by the Ether link 104, for example, in IP packet processing using a logical path by VLAN, for the IP packet input by the Ether link, the received physical The layer processing unit 6 performs reception physical layer processing.

  The IP value subjected to the reception physical layer process is extracted by the reception side address search processing unit 7 and the VLAN value is output as a key of the reception address search table 8.

  In the reception address search table 8, a search is performed using the VLAN value output by the reception side address search processing unit 7 as a key, and a VPN identification ID for identifying the VPN group corresponding to this VLAN value is received. Output to unit 7.

  The receiving side address search processing unit 7 assigns this VPN identification ID to the IP packet in order to identify the attribute of the IP packet.

  The IP packet processing unit 9 performs IP packet processing for each VPN based on the VPN identification ID. For example, IP_DA (Destination Address) is assigned to the IP packet based on each VPN to which the IP packet belongs.

  The IP packet processed by the IP packet processing unit 9 for each VPN is extracted by the transmission side address search processing unit 10 as the key of the transmission address search table 11 by extracting the VPN identification ID and IP_DA. The value and the MAC_DA (Destination Address) processed by ARP (Address Resolution Protocol) are output to the transmission side address search processing unit 10.

  The transmission side address search processing unit 10 assigns the VLAN value and MAC_DA to the IP packet and transfers the IP packet to the transmission physical layer processing unit 12.

  The transmission physical layer processing unit 12 performs transmission physical layer processing on the transferred IP packet, and outputs the IP packet to the Ether link.

Japanese Patent Laid-Open No. 2002-247086

  The conventional address search method is configured as described above. In order to process an IP packet, it is necessary to perform an address search on both the transmission side and the reception side, and a search process that takes a long time is performed twice. There is a problem that it becomes a bottleneck for performing high-speed processing and a problem that the table capacity increases.

  For example, when a network configuration is adopted in which one MAC_DA is limited for each VLAN, or when one MAC_DA is limited for each VLAN, the MAC address is limited to MAC_DA only by the received address search table. Despite being searchable, conventionally, address search must always be performed on both the sending and receiving sides.

  The present invention has been made to solve such a problem. Conventionally, address search that has been performed on both the transmission side and the reception side is integrated only on the reception side, and high-speed processing is possible. The purpose is to realize an address search with a small capacity.

  A first aspect of the present invention is an IP packet processing device, and the feature of the present invention is that an IP packet processing device is used when the next hop destination from its own device is limited to one MAC_DA for each VPN. On the other hand, the reception physical layer processing means for performing the reception physical layer processing of the Ether link, and the VLAN value is extracted from the IP packet subjected to the reception physical layer processing by the reception physical layer processing means, and the search is performed using the VLAN value as a key. A search for a VPN identification ID for identifying a VPN group corresponding to the VLAN value, and then a receiving address search means for assigning a unique MAC_DA corresponding to the VPN identification ID to the IP packet; Correspondence between VLAN value, VPN identification ID and MAC_DA for receiving address search means to perform the search IP packet processing for assigning the logical path number of the VLAN including the next hop destination to the IP packet to which the address identification table and the VPN identification ID and MAC_DA are assigned, and the VPN identification ID and MAC_DA. And transmission physical layer processing means for performing transmission physical layer processing of the Ether link for the IP packet processed by the IP packet processing means.

  As a result, it is possible to integrate address searches that were conventionally performed on both the transmission side and the reception side only at the reception side, enable high-speed processing, and reduce the table capacity. .

  Alternatively, the IP packet processing apparatus according to the present invention performs a reception physical layer process for performing an Ether link reception physical layer process on an input IP packet when the next hop destination from the own apparatus is limited to one MAC_DA for each VPN. Information identifying the Ether link to which the IP packet has been transferred is extracted from the processing means and the IP packet on which the reception physical layer processing has been performed by the reception physical layer processing means, and a search is performed using the information identifying the Ether link as a key. And then searching for a VPN identification ID for identifying the VPN group corresponding to the information for identifying this Ether link, and subsequently giving the IP packet a unique MAC_DA corresponding to the VPN identification ID Search means and the receiving address search means for performing the search Next, based on the VPN identification ID and MAC_DA, the address search table in which the correspondence between the information identifying the the link, the VPN identification ID and MAC_DA is recorded, and the IP packet to which the VPN identification ID and MAC_DA are assigned. An IP packet processing unit that assigns information for identifying an Ether link including a hop destination, and a transmission physical layer processing unit that performs transmission physical layer processing of the Ether link on the IP packet processed by the IP packet processing unit It is characterized by that.

  The former is a configuration applied to a VLAN, and the latter is a configuration applied to an Ether link.

  Further, a means for detecting whether or not the next hop destination from the own apparatus is limited to one MAC_DA for each VPN, and a detection result of the means for detecting is one next hop destination from the own apparatus for each VPN. And a means for enabling the receiving side address searching means and the IP packet processing means when it is detected that it is limited to MAC_DA.

  That is, the precondition for applying the IP packet processing apparatus of the present invention is that the next hop destination from the own apparatus is limited to one MAC_DA for each VPN. Therefore, it is determined whether or not this condition is satisfied, and when the condition is satisfied, the IP packet processing apparatus of the present invention is applied. If not established, the IP packet processing device having the conventional configuration can be switched and applied.

  A second aspect of the present invention is an address search method, and the feature of the present invention is that this IP packet is used when the next hop destination from the IP packet processing device is limited to one MAC_DA for each VPN. The processing device extracts the VLAN value from the received physical layer processing step for performing the physical link processing of the Ether link for the input IP packet, and the IP packet subjected to the received physical layer processing by the received physical layer processing step. A search is performed using the VLAN value as a key, a VPN identification ID for identifying a VPN group corresponding to the VLAN value is searched, and then a MAC_DA uniquely determined corresponding to the VPN identification ID is assigned to the IP packet. Receiving-side address search step, and I assigned with the VPN identification ID and MAC_DA An IP packet processing step for assigning the logical path number of the VLAN including the next hop destination to the packet based on the VPN identification ID and MAC_DA, and transmission of the Ether link to the IP packet processed by this IP packet processing step A transmission physical layer processing step for performing physical layer processing is executed.

  Alternatively, according to the address search method of the present invention, when the next hop destination from the IP packet processing device is limited to one MAC_DA for each VPN, the IP packet processing device receives the Ether link for the input IP packet. A reception physical layer processing step for performing physical layer processing, and information for identifying an Ether link to which the IP packet has been transferred are extracted from the IP packet on which the reception physical layer processing has been performed by the reception physical layer processing step. A search is performed using the identification information as a key, a VPN identification ID for identifying a VPN group corresponding to the information for identifying the Ether link is retrieved, and subsequently, the MAC_DA uniquely determined corresponding to the VPN identification ID Receiving address search step to be added to the IP packet; An IP packet processing step of assigning information for identifying an Ether link including a next hop destination to the IP packet to which the VPN identification ID and MAC_DA are assigned, based on the VPN identification ID and MAC_DA, and the IP packet processing step A transmission physical layer processing step of performing a transmission physical layer process of an Ether link is executed on the processed IP packet.

  In addition, a step of detecting whether the next hop destination from the own device is limited to one MAC_DA for each VPN, and a detection result of this detecting step is one next hop destination from the own device for each VPN. When it is detected that it is limited to MAC_DA, the receiving side address searching step and the IP packet processing step may be executed.

  A third aspect of the present invention is a program, and the present invention is characterized in that it is installed in an information processing apparatus when the next hop destination from the IP packet processing apparatus is limited to one MAC_DA for each VPN. As a result, the information processing apparatus has a function corresponding to the IP packet processing apparatus, a reception physical layer processing function for performing the reception physical layer processing of the Ether link for the input IP packet, and the reception physical layer processing function. The VLAN value is extracted from the IP packet subjected to the reception physical layer process, and the search is performed using the VLAN value as a key, and the VPN identification ID for identifying the VPN group corresponding to the VLAN value is searched. Subsequently, the VPN Receiving-side address that gives the IP packet a MAC_DA that is uniquely determined corresponding to the identification ID A search function, a function corresponding to an address search table in which a correspondence between a VLAN value for performing the search, a VPN identification ID, and MAC_DA is recorded, and the VPN identification ID and MAC_DA are assigned. The IP packet processing function for assigning the logical path number of the VLAN including the next hop destination to the IP packet processed based on the VPN identification ID and MAC_DA, and the Ether for the IP packet processed by this IP packet processing function A transmission physical layer processing function for performing transmission physical layer processing of a link is realized.

  Alternatively, when the next hop destination from the IP packet processing device is limited to one MAC_DA for each VPN, the program of the present invention installs the information processing device in the IP packet processing. As a function corresponding to the device, a received physical layer processing function for performing an Ether link reception physical layer process on an input IP packet, and an IP packet from the IP packet subjected to the received physical layer process by the received physical layer processing function. The information identifying the Ether link transferred is extracted, the information identifying this Ether link is searched as a key, and the VPN identification ID for identifying the VPN group corresponding to the information identifying this Ether link is retrieved, Subsequently, M uniquely determined corresponding to the VPN identification ID A receiving address search function for assigning C_DA to the IP packet, an address search in which a correspondence relationship between the information identifying the Ether link for performing the search by the receiving address search function, the VPN identification ID, and the MAC_DA is recorded. A function corresponding to the table, and an IP packet processing function for giving information for identifying an Ether link including the next hop destination to the IP packet to which the VPN identification ID and MAC_DA are assigned based on the VPN identification ID and MAC_DA The transmission physical layer processing function for performing the transmission physical layer processing of the Ether link on the IP packet processed by the IP packet processing function is realized.

  In addition, a function for detecting whether the next hop destination from the own device is limited to one MAC_DA for each VPN, and a detection result of the function to be detected is one next hop destination from the own device for each VPN. When it is detected that the MAC address is limited to MAC_DA, the receiving address search function and the IP packet processing function can be realized.

  Thus, using a general-purpose information processing device, address search that has been conventionally performed on both the transmission side and the reception side is integrated only on the reception side, high-speed processing is possible, and the table capacity is small. Address search can be realized.

  According to the present invention, address search that has been conventionally performed on both the transmission side and the reception side is integrated only on the reception side, high-speed processing is possible, and address search that requires less table capacity is realized. Can do.

(Embodiment 1)
Hereinafter, an embodiment of an address search method according to the present invention will be described in detail with reference to the drawings. In addition, this invention is not limited by embodiment described below.

  First, the concept of the address search method according to the embodiment of the present invention will be described. FIG. 6 is a diagram for explaining a network configuration according to the present embodiment. In FIG. 6, 101 is an IP packet processing apparatus having the address search method of the present invention, 102 is a router, 103 is an L2 network, and 104 is a link. The IP packet processing apparatus 101 uses the reference numeral 101 in common with the conventional example, but its internal configuration is different from the conventional example.

  FIG. 1 is a diagram illustrating an internal configuration of an IP packet processing apparatus 101 having the address search method according to the first embodiment. In FIG. 1, 1 is a reception physical layer processing unit, 2 is a receiving address search processing unit, 3 is an integrated address search table, 4 is an IP packet processing unit, and 5 is a transmission physical layer processing unit.

  Next, the operation will be described. In the IP packet processing apparatus 101 connected to the router 102 via the Ether link 104 via the L2 network 103, for example, in IP packet processing using a logical path by VLAN, for an IP packet input through the Ether link 104, The reception physical layer processing unit 1 performs reception physical layer processing.

  From the IP packet subjected to the reception physical layer process, the reception side address search processing unit 2 extracts the VLAN value and outputs the VLAN value as a key of the integrated address search table 3.

  The integrated address search table 3 performs a search using the VLAN value output by the receiving side address search processing unit 2 as a key, and outputs a VPN identification ID for identifying a VPN group corresponding to the VLAN value, and at the transmission side And the MAC_DA that is processed by the ARP and limited to one for each VLAN on the transmission side is output.

  The receiving side address search processing unit 2 assigns the VPN identification ID, the sending side VLAN value, and the MAC_DA limited to one for each sending side VLAN to identify the attribute of the IP packet.

  The IP packet processing unit 4 performs IP packet processing for each VPN based on the VPN identification ID, and transfers it to the transmission physical layer processing unit 5.

  The transmission physical layer processing unit 5 performs transmission physical layer processing on the transferred IP packet, and outputs the IP packet to the Ether link 104 connected to the router 102 via the L2 network 103.

  Here, in order to limit to one MAC_DA for each VLAN, when adopting a network configuration in which the next hop destination when connected to the router 102 via the L2 network 103 for each VLAN is limited to one MAC_DA? Or, as in the prior art, only when the state where the sending side and the receiving side have address search means and the next hop destination is limited to one MAC_DA is detected, the integrated address search only at the receiving side This is applied to the case where the above IP packet processing is performed using a table (to be described later as a third embodiment).

  According to this embodiment, with regard to address search in the IP packet processing device, high-speed processing is performed by performing address search processing only on the receiving side with the receiving side address searching processing unit 2 and the integrated address searching table 3 as described above. It is possible to reduce the table capacity, and the address search can be easily obtained.

(Embodiment 2)
A second embodiment of the present invention will be described with reference to FIG. FIG. 2 is a diagram showing an internal configuration of the IP packet processing apparatus 101 having the address search method according to the second embodiment. The difference between the second embodiment and the first embodiment is that information for identifying an Ether link (shown as an Ether link ID) is used as a search key in the integrated address search table 13. That is, the first embodiment is an embodiment in which the IP packet processing apparatus of the present invention is applied to a VLAN, while the second embodiment is an embodiment in which the IP packet processing apparatus of the present invention is applied to an Ether link.

  Therefore, in the first embodiment, the IP packet processing unit 4 assigns the logical path number of the VLAN including the next hop destination to the IP packet, whereas in the second embodiment, the IP packet processing unit 14 performs the next to the IP packet. Information for identifying an Ether link including a hop destination is assigned.

(Embodiment 3)
A third embodiment of the present invention will be described with reference to FIG. FIG. 3 is a diagram illustrating an internal configuration of the IP packet processing apparatus 101 having the address search method according to the third embodiment. As shown in FIG. 3, the IP packet processing apparatus according to the third embodiment includes a means for detecting whether or not the next hop destination from the own apparatus is limited to one MAC_DA for each VPN. When the detection result detects that the next hop destination from the own apparatus is limited to one MAC_DA for each VPN, the receiving address search processing unit 22 and the IP packet processing unit 24 will be described in the first or second embodiment. The transmission side address search processing unit 25 includes means for enabling each means having the features of the present invention.

  That is, as shown in FIG. 3, the IP packet processing device of the third embodiment has the configuration of the conventional IP packet processing device shown in FIG. 7 and the configuration of the IP packet processing device of the present invention shown in FIG. It is a configuration that has both. Although the configuration of FIG. 2 and the configuration of FIG. 7 may be combined, the configuration having the configuration of FIG. 1 and the configuration of FIG. 7 is illustrated here.

  Accordingly, whether or not the condition that “the next hop destination from the own device is limited to one MAC_DA for each VPN”, which is a precondition to which the IP packet processing device of the present invention is applied, is established. If the transmission-side address search processing unit 25 determines and holds, the function corresponding to the IP packet processing device of the present invention in the reception-side address search processing unit 22 and the IP packet processing unit 24 (this is the function of the present invention). Enable).

  If the above condition is not satisfied, the function corresponding to the IP packet processing device of the conventional configuration in the receiving side address search processing unit 22 and the IP packet processing unit 24 (hereinafter referred to as the conventional function) is made effective. To do. In this way, the present invention function and the conventional function can be switched and applied.

  FIG. 4 is a diagram for explaining the logic for detecting the establishment of the application condition in the transmission side address search processing unit 25. FIG. 4A shows a state where there are three combinations of output VLAN and MAC_DA for one combination of VPN identification ID and IP_DA in the transmission address search table 11. In the state shown in FIG. 4A, the transmission-side address search processing unit 25 determines that the function of the present invention is not applicable and enables the conventional function.

  On the other hand, FIG. 4B shows a state in which only one VLAN and MAC_DA exist for one combination of VPN identification ID and IP_DA in the transmission address search table 11. In the state shown in FIG. 4B, the transmission side address search processing unit 25 determines that the function of the present invention is applicable, and enables the function of the present invention.

  Referring to FIG. 3, an arrow is shown from the transmission side address search processing unit 25 to the reception side address search processing unit 22, and this arrow indicates that the transmission side address search processing unit 25 functions as the reception side address search processing unit 22. Shows a state in which control is switched between the function of the present invention and the conventional function.

  When the function is switched to the function of the present invention, the receiving side address search processing unit 22 searches the VPN identification ID (data # 1) and MAC_DA (data # 2) in the integrated address search table 23 using the input VLAN as a key. To do. When the function is switched to the conventional function, the receiving side address search processing unit 22 searches only the VPN identification ID (data # 1) in the integrated address search table 23 using the input VLAN as a key.

  Only the VPN identification ID is assigned to the IP packet when the function is switched to the conventional function, and the VPN identification ID and MAC_DA are assigned to the IP packet when the function is switched to the function of the present invention. When only the VPN identification ID is assigned to the IP packet, the IP packet processing unit 24 assigns IP_DA to the IP packet as a conventional function. On the other hand, when the VPN identification ID and MAC_DA are assigned to the IP packet, a logical path number is assigned to the IP packet as a function of the present invention. It should be noted that switching control between the function of the present invention and the conventional function may be performed from the transmission side address search processing unit 25 to the IP packet processing unit 24.

  When only the VPN identification ID is assigned to the IP packet output from the IP packet processing unit 24, the transmission-side address search processing unit 25 performs a search using the transmission address search table 11 as a conventional function. On the other hand, when the VPN identification ID and MAC_DA are assigned to the IP packet, the IP packet is directly transmitted to the transmission physical layer processing unit 5 as a function of the present invention.

  FIG. 5 shows a flowchart of the operation of the transmission side address search processing unit 25. As shown in FIG. 5, referring to a combination of output VLAN and MAC_DA corresponding to a combination of one VPN identification ID and IP_DA in the transmission address search table 11 (S1), when there is a one-to-one correspondence (S2), The receiving side address search processing unit 22 is instructed to enable the function of the present invention (S3). If it is one-to-many correspondence (S2), the conventional function is enabled for the receiving side address search processing unit 22 (S4).

(Embodiment 4)
The present embodiment can be implemented as a program that causes an information processing apparatus to operate as the above-described IP packet processing apparatus by being installed in a general-purpose information processing apparatus. This program is recorded on a recording medium and installed in the information processing apparatus, or installed in the information processing apparatus via a communication line, whereby the information processing apparatus is described in the IP packet described in the first, second, or third embodiment. It can be operated as a processing device.

  According to the present invention, address search that has been conventionally performed on both the transmission side and the reception side is integrated only on the reception side, high-speed processing is possible, and address search that requires less table capacity is realized. Can do.

  Thereby, it is possible to contribute to the configuration of a high-speed network, and both the network administrator and the network user can improve the service quality and convenience.

2 is a diagram showing an internal configuration of an IP packet processing apparatus having the address search method according to Embodiment 1. FIG. FIG. 5 is a diagram showing an internal configuration of an IP packet processing apparatus having the address search method according to the second embodiment. FIG. 10 is a diagram showing an internal configuration of an IP packet processing apparatus having the address search method according to the third embodiment. FIG. 10 is a diagram for explaining logic for detecting establishment of an application condition in a transmission side address search processing unit according to the third embodiment. 10 is a flowchart illustrating the operation of a transmission side address search processing unit according to the third embodiment. The figure for demonstrating the network structure concerning embodiment of this invention and the conventional address search method. The figure which shows the internal structure of the IP packet processing apparatus which has the conventional address search method.

Explanation of symbols

1, 6 Reception physical layer processing unit 2, 7, 22 Reception side address search processing unit 8 Reception address search table 4, 9, 14, 24 IP packet processing unit 5, 12 Transmission physical layer processing unit 10, 25 Transmission side address search Processing Unit 11 Transmission Address Search Table 3, 13, 23 Integrated Address Search Table 101 IP Packet Processing Device 102 Router 103 L2 Network 104 Ether Link

Claims (9)

When the next hop destination from its own device is limited to one MAC_DA for each VPN,
A reception physical layer processing means for performing a reception physical layer process of an Ether link for an input IP packet;
The VLAN value is extracted from the IP packet subjected to the reception physical layer processing by the reception physical layer processing means, and a search is performed using the VLAN value as a key, and a VPN identification ID for identifying the VPN group corresponding to the VLAN value is searched. Subsequently, a receiving-side address search means for giving the IP packet a MAC_DA uniquely determined corresponding to the VPN identification ID,
An address search table in which the correspondence between the VLAN value, the VPN identification ID, and the MAC_DA for the reception side address search means to perform the search is recorded;
IP packet processing means for assigning a logical path number of a VLAN including a next hop destination to the IP packet to which the VPN identification ID and MAC_DA are assigned, based on the VPN identification ID and MAC_DA;
An IP packet processing apparatus comprising: a transmission physical layer processing means for performing a transmission physical layer process of an Ether link for an IP packet processed by the IP packet processing means. When the next hop destination from its own device is limited to one MAC_DA for each VPN,
A reception physical layer processing means for performing a reception physical layer process of an Ether link for an input IP packet;
Information for identifying the Ether link to which the IP packet has been transferred is extracted from the IP packet that has been subjected to the reception physical layer processing by the reception physical layer processing means, and a search is performed using the information for identifying the Ether link as a key. Retrieval address retrieval means for retrieving a VPN identification ID for identifying a VPN group corresponding to information for identifying a link, and subsequently giving a MAC_DA uniquely determined corresponding to the VPN identification ID to the IP packet;
An address search table in which the correspondence between the information for identifying the Ether link for the receiving address search means to perform the search, the VPN identification ID, and the MAC_DA is recorded;
IP packet processing means for giving information for identifying an Ether link including a next hop destination to the IP packet to which the VPN identification ID and MAC_DA are assigned, based on the VPN identification ID and MAC_DA;
An IP packet processing apparatus comprising: a transmission physical layer processing means for performing a transmission physical layer process of an Ether link for an IP packet processed by the IP packet processing means. Means for detecting whether the next hop destination from the own device is limited to one MAC_DA for each VPN;
Means for enabling the receiving address search means and the IP packet processing means when the detection result of the detecting means detects that the next hop destination from the own device is limited to one MAC_DA for each VPN. The IP packet processing device according to claim 1, further comprising: When the next hop destination from the IP packet processing device is limited to one MAC_DA for each VPN, the IP packet processing device
A reception physical layer processing step of performing an Ether link reception physical layer processing on an input IP packet;
The VLAN value is extracted from the IP packet that has been subjected to the reception physical layer processing in this reception physical layer processing step, and a search is performed using this VLAN value as a key, and a VPN identification ID that identifies the VPN group corresponding to this VLAN value is searched Subsequently, a receiving address search step for assigning to the IP packet a MAC_DA uniquely determined corresponding to the VPN identification ID,
An IP packet processing step of assigning a logical path number of a VLAN including a next hop destination to the IP packet to which the VPN identification ID and MAC_DA are assigned, based on the VPN identification ID and MAC_DA;
An address search method for executing a transmission physical layer processing step of performing a transmission physical layer processing of an Ether link on the IP packet processed by the IP packet processing step. When the next hop destination from the IP packet processing device is limited to one MAC_DA for each VPN, the IP packet processing device
A reception physical layer processing step of performing an Ether link reception physical layer processing on an input IP packet;
Information for identifying the Ether link to which the IP packet has been transferred is extracted from the IP packet that has undergone the reception physical layer processing in the reception physical layer processing step, and a search is performed using the information for identifying the Ether link as a key. A search for a VPN identification ID for identifying a VPN group corresponding to the information for identifying the link, and subsequently, a receiving address search step for assigning a MAC_DA uniquely determined corresponding to the VPN identification ID to the IP packet;
An IP packet processing step of giving information for identifying an Ether link including a next hop destination to the IP packet to which the VPN identification ID and MAC_DA are assigned, based on the VPN identification ID and MAC_DA;
An address search method for executing a transmission physical layer processing step of performing a transmission physical layer processing of an Ether link on the IP packet processed by the IP packet processing step. Detecting whether the next hop destination from the own device is limited to one MAC_DA for each VPN;
A step of performing the receiving address search step and the IP packet processing step when the detection result of the detecting step detects that the next hop destination from the own device is limited to one MAC_DA for each VPN; The IP packet processing apparatus according to claim 4 or 5, comprising: When the next hop destination from the IP packet processing device is limited to one MAC_DA for each VPN,
By installing in the information processing apparatus, the information processing apparatus has a function corresponding to the IP packet processing apparatus,
A reception physical layer processing function for performing an Ether link reception physical layer processing on an input IP packet;
The VLAN value is extracted from the IP packet subjected to the reception physical layer processing by the reception physical layer processing function, and the search is performed using the VLAN value as a key, and the VPN identification ID for identifying the VPN group corresponding to the VLAN value is searched. Subsequently, a receiving-side address search function for giving a MAC_DA uniquely determined corresponding to the VPN identification ID to the IP packet;
A function corresponding to an address search table in which a correspondence relationship between a VLAN value, a VPN identification ID, and MAC_DA for performing the search by the receiving address search function is recorded;
An IP packet processing function for assigning a logical path number of a VLAN including a next hop destination to the IP packet to which the VPN identification ID and MAC_DA are assigned, based on the VPN identification ID and MAC_DA;
A program for realizing a transmission physical layer processing function for performing transmission physical layer processing of an Ether link on an IP packet processed by this IP packet processing function. When the next hop destination from the IP packet processing device is limited to one MAC_DA for each VPN,
By installing in the information processing apparatus, the information processing apparatus has a function corresponding to the IP packet processing apparatus,
A reception physical layer processing function for performing an Ether link reception physical layer processing on an input IP packet;
Information for identifying the Ether link to which the IP packet has been transferred is extracted from the IP packet that has been subjected to the reception physical layer processing by the reception physical layer processing function, and a search is performed using the information for identifying the Ether link as a key. A search for a VPN identification ID for identifying a VPN group corresponding to information for identifying a link, and subsequently a receiving address search function for giving a MAC_DA uniquely determined corresponding to the VPN identification ID to the IP packet;
A function corresponding to an address search table in which a correspondence relationship between the information for identifying the Ether link for performing the search, the VPN identification ID, and the MAC_DA is recorded by the receiving address search function;
An IP packet processing function for giving information for identifying an Ether link including a next hop destination based on the VPN identification ID and MAC_DA to the IP packet to which the VPN identification ID and MAC_DA are assigned;
A program for realizing a transmission physical layer processing function for performing transmission physical layer processing of an Ether link on an IP packet processed by this IP packet processing function. A function for detecting whether the next hop destination from the own device is limited to one MAC_DA for each VPN;
A function for enabling the receiving address search function and the IP packet processing function when the detection result of the function to be detected detects that the next hop destination from the own device is limited to one MAC_DA for each VPN. The program according to claim 7 or 8, which realizes and.

Images