JP2009071423A - Network adapter - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce burdens on a host computer when setting filtering for packet reception. <P>SOLUTION: An address recognition part 12 provided in the network adapter 1 recognizes a sender address of a packet transmitted from a host computer 2. The recognized address is registered in a reception packet filtering part 14 as a passing address. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a network adapter connected to a computer, and more particularly to packet filtering in a network adapter.

  In a network employing a broadcast communication model such as Ethernet (registered trademark), when a computer transmits a packet, the packet is basically transmitted to all other computers in the network. Therefore, not all packets received by the network adapter of a certain host computer are destined for that host computer. When the host computer receives an unnecessary packet, it discards the packet.

  However, when a large number of unnecessary packets are received in a high-speed network, the load on the host computer that checks and discards the packets is large. Therefore, in general, the network adapter has a filtering mechanism for selecting received packets, as shown in FIG. As an example, filtering is performed as follows using the destination hardware address included in the packet.

(1) The host computer registers an address assumed to be attached to a packet to be received by the host computer, such as a hardware address of the network adapter itself, in the network adapter.
(2) The filtering mechanism recognizes the destination hardware address of the packet received from the network. In the case of Ethernet, the MAC address is recognized.
(3) When the recognized destination address is an already registered address or a broadcast address such as a broadcast address or a multicast address, the received packet is transferred to the host computer. Packets that are not subject to transfer are discarded by the network adapter.

That is, address registration to the filtering mechanism of the network adapter is controlled by the host computer.
A technique using registration of a MAC address to a network adapter by a host computer is also described in Patent Document 1. In connection with address registration, Patent Document 2 discloses a wireless LAN slave station that makes an authentication request to an access point using a MAC address of a packet transmission source terminal and registers the address when the authentication is successful. It is disclosed. Patent Document 3 discloses a bridge device having a learning table for storing addresses.
JP 2001-510947 A Japanese Patent Laid-Open No. 2005-192059 Japanese Patent Publication No. 6-24368

  Conventionally, a configuration in which one hardware address is assigned to a host computer has been common. Therefore, even if the host computer controls the address registration to the filtering mechanism of the network adapter as described above, the burden on the packet processing of the host computer can be reduced without any problem.

  However, in recent years, a virtual environment has become widespread, so that a plurality of virtual hardware addresses may be assigned to a host computer. That is, by using a virtualization technique, a virtual computer can be operated on a host computer, a virtual network adapter can be set in the virtual computer, and a virtual hardware address can be assigned. Furthermore, a virtual network including a virtual computer may be constructed.

  When a virtual environment is realized in a conventional system, a physical host computer registers a virtual hardware address as a packet destination in the filtering mechanism of the physical network adapter. Therefore, the physical host computer needs to recognize and register the virtual hardware address. When there is only one physical network adapter in the physical host computer, the virtual hardware address may be recognized and the recognized address may be registered together with the physical hardware address. On the other hand, when a plurality of physical network adapters exist in the physical host computer, not all virtual network adapters are connected to individual physical network adapters. Therefore, the physical host computer needs to register the hardware address in the physical network adapter connected to the virtual network adapter to which the address to be registered is assigned. If set correctly, the physical network adapter transfers the packet to the registered address without discarding it, and the virtual computer or virtual network can receive the packet transmitted from the network outside the physical host computer.

  As described above, in order to register the virtual hardware address in the filtering mechanism, the physical host computer needs to recognize the virtual hardware address and the virtual network configuration. In addition, because the virtual computer often stops and restarts while the physical host computer is operating, the physical host computer always recognizes the virtual network configuration, etc., not only at initialization. There is a need. Specifically, this recognition is performed by virtualization software running on the physical host computer, and the virtualization software also manages registration in the filtering mechanism. For this reason, the virtualization software itself has become more complicated as the number of virtual addresses increases and the network configuration becomes more complicated. As virtualization software becomes more complex, its design, implementation, and verification become complex and difficult. Furthermore, if it is difficult to find a problem because it is difficult to verify the virtualization software, the risk of malfunction of the host computer, virtual computer, etc. may increase. Also, operating complex virtualization software can result in the risk of increasing the load on the host computer.

  For example, if a learning function similar to the learning bridge described in Patent Document 3 is provided in the network adapter, it may be necessary to register almost all hardware addresses on the network. Therefore, several thousands to several tens of thousands of entries are required, the mounting cost is high, and it is not practical.

  An object of the present invention is to reduce a burden on a host computer due to a filtering setting for packet reception.

  The network adapter according to the present invention is a network adapter that is connected to a host computer that provides a virtual computer and transmits / receives a packet to / from the network. Recognizing means for recognizing a source address of a packet transmitted from a virtual computer, a filtering section for filtering a packet received from the network, and a control for setting an address recognized by the recognizing means as a passing address in the filtering section Have means.

  In the network adapter, the recognition unit recognizes a transmission source address of a packet transmitted from the host computer. The recognizing unit also recognizes the transmission source address of the packet transmitted from the virtual computer provided by the host computer. The control means sets the recognized address as an address to be passed through the filtering unit. That is, when the network adapter receives the transmission packet, the passing address setting of the filtering unit is performed autonomously by the network adapter. Therefore, it is not necessary for the host computer to set the filtering unit of the network adapter.

  Another embodiment of the network adapter according to the present invention is a network adapter that is connected to a host computer and transmits / receives a packet to / from the network. The multicast is transmitted from the host computer or received by the host computer. Calculated by a calculation means for calculating a hardware multicast address for identifying a multicast group to which the host computer belongs from a multicast address included in a control packet, a filtering unit for filtering packets received from the network, and the calculation means. Control means for setting a hardware multicast address as a passing address in the filtering unit.

  In the network adapter, the calculating means calculates a hardware multicast address for identifying a multicast group to which the host computer belongs from a multicast address included in a multicast control packet transmitted from the host computer. The control unit sets the calculated hardware multicast address in the filtering unit. Therefore, according to this embodiment, the setting of the filtering unit for multicast communication is performed autonomously by the network adapter. Therefore, the host computer does not need to set filtering conditions for the multicast address.

  According to the present invention, the network adapter autonomously performs the filtering condition setting of the network adapter. Therefore, it is not necessary for the host computer to set filtering conditions, and the load on the host computer can be reduced.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
<Overview of network adapter>
FIG. 1 is a diagram showing an outline of an example of a network adapter according to the present invention. The network adapter 1 is connected to the host computer 2 and transmits / receives packets to / from the network. Here, as will be described in detail later, the host computer 2 can provide one or a plurality of virtual computers. The network adapter 1 includes a ROM 11, an address recognition unit 12, a control unit 13, and a received packet filtering unit 14. The received packet filtering unit 14 includes a filter table 141 as shown in FIG.

  The ROM 11 records the hardware address of the network adapter 1. When the host computer 2 is initialized, the host computer 2 reads the hardware address stored in the ROM 11 and records it on the memory for use as its own unique hardware address.

The address recognition unit 12 recognizes an address included in the transmission packet transmitted from the host computer side, and notifies the control unit 13 of the recognized address.
The control unit 13 determines whether it is necessary to register the notified address, and sets filtering conditions as necessary. In addition, even if the address is registered, if there is an address that has not been used for a certain period of time, the control unit 13 sets or changes the filtering condition, such as deleting the registration. Setting or changing the filtering condition is performed by changing the contents of the filter table 141 included in the received packet filtering unit 14.

  When receiving a packet from the network side, the received packet filtering unit 14 determines whether to pass the packet. First, the received packet filtering unit 14 compares the contents of the filter table 141 with the destination address of the received packet. A packet having an address registered in the filter table 141 as a “destination address” is a packet that needs to be received by a computer existing on the host computer side. Therefore, when the destination address of a packet received from the network is registered in the filter table 141, the packet is passed. However, the received packet filtering unit 14 passes all broadcast packets without filtering. In this specification, “destination address” and “destination address” are synonymous. Similarly, “destination MAC address” and “destination MAC address” are also synonymous.

  In this way, the network adapter 1 extracts an address included in a packet transmitted from the host computer 2 (or a virtual computer provided by the host computer 2), and uses the extracted address to receive packet filtering unit 14 Set up independently. Therefore, the host computer 2 does not need to set the received packet filtering unit 14 of the network adapter 1.

  The address recognition unit 12, the control unit 13, and the received packet filtering unit 14 are realized by, for example, a hardware circuit. However, some or all of these functions may be realized by software.

  The outline of the operation of the network adapter 1 has been described above, but the configuration and operation of the network adapter 1 are different between the embodiment in which only the unicast address is set independently and the embodiment in which the multicast address can be set. Hereinafter, an embodiment in which a unicast address is set and an embodiment in which a multicast address can be set will be described separately.

<Operation of Network Adapter of Embodiment (1)>
[Overview of operation]
At the time of packet transmission, the host computer 2 creates a packet in which the transmission destination hardware address and the transmission source hardware address are set, and requests the network adapter 1 to transmit the packet. Therefore, the network adapter requested to transmit the packet performs the following processing.

(1) The address recognition unit 12 analyzes the header of the packet to be transmitted, and recognizes the transmission source hardware address.
(2) The address recognition unit 12 notifies the control unit 13 of the recognized transmission source hardware address.
(3) The control unit 13 confirms whether the notified address is registered in the filter table 141 included in the received packet filtering unit 14. When the notified address is not registered in the filter table 141, the control unit 13 registers in the filter table 141.
(4) The received packet filtering unit 14 confirms the transmission destination hardware address of the received packet. When the transmission destination address of the received packet is registered in the filter table 141, the packet is transmitted and transmitted to the host computer side. If the destination hardware address of the received packet is a broadcast address, the received packet filtering unit 14 passes the packet without checking the filter table 141.
(5) Discard packets that are not sent to the host computer.

  With the above processing, packet filtering is performed for an address that has been transmitted once using the network adapter 1 without setting the filtering mechanism of the network adapter 1 from the host computer side. It becomes possible to do.

  By using such a network card, it is not necessary to set a filtering mechanism from the host computer side even when a complex virtual network including a virtual computer is constructed.

  FIG. 3 is a diagram for explaining a virtual environment by the host computer. In the example shown in FIG. 3, the physical host computer accommodates two network adapters 1 (1a, 1b). The physical host computer provides a plurality of virtual computers (30, 40, 50 in the example shown in FIG. 3).

  When using a conventional network adapter in such a virtual environment, the virtualization software 201 is required to perform complicated processing. In the example shown in FIG. 3, each of the three virtual computers provided by the host computer has two virtual network adapters, and a virtual hardware address is assigned to each virtual network adapter. Therefore, the packet that the physical host computer 2 needs to receive has the virtual hardware addresses V11, V12, V21, V22, V31, and V32 as destination addresses in addition to those that are destined for the physical hardware addresses P1 and P2. It is what. The virtualization software 201 needs to grasp all the virtual hardware addresses and set the filtering mechanism.

  In addition, when the physical host computer has a plurality of physical network adapters, the management processing by the virtualization software 201 is further complicated. For example, the physical host computer 2 shown in FIG. 3 has two physical network adapters, and three virtual network adapters are connected to each physical network adapter via virtual switches (SW1, SW2). . Accordingly, each physical network adapter needs to register its own physical hardware address and the virtual hardware address used by the connected virtual network adapter. For example, the physical hardware address P1 and the virtual hardware addresses V11, V21, and V31 must be registered in the physical network adapter 1a.

  Furthermore, the virtual computer may be stopped and restarted while the physical host computer is operating. For example, the virtual hardware address is generated by a random number or the like when the virtual computer is initialized. Therefore, it is expected that the virtual hardware address is changed when the virtual computer is restarted. Accordingly, the virtualization software 201 has been required to be able to cope with such a case.

  In order to cope with these problems, the network adapter of the embodiment autonomously learns the transmission source hardware address of the packet sent to the network and sets the filtering table. This eliminates the need for the physical host computer to set filtering conditions. Therefore, it is not necessary to recognize the virtual hardware address and the virtual network configuration, and the virtualization software 201 can be simplified. Hereinafter, the operation of the network adapter 1 will be described in detail.

[Operation of address recognition unit]
An example of the address recognition unit 12 mounted on the network adapter is shown in FIG. The address recognition unit 12 includes an input controller 121 and a latch circuit 122. When a packet transmitted from the host computer is read into the address recognition unit 12, the input controller 121 divides the data into data having a certain bit width. In FIG. 4, as an example, it is divided by a 64-bit width, but the divided bit width is arbitrary. The data delimited by the input controller 121 is temporarily stored in the latch circuit 122 and then transmitted. At this time, the address recognizing unit 12 recognizes the address by extracting a bit string from an area predetermined by the communication protocol (that is, a source address area).

  For example, when Ethernet is used as the network medium, the packet format is as shown in FIG. An Ethernet header is attached to the beginning of the packet, and the Ethernet header includes a transmission destination MAC address, a transmission source MAC address, and the like. Both the transmission destination MAC address and the transmission source MAC address are composed of 48 bits. Accordingly, when the input controller 121 divides the packet into 64 bits from the beginning, the last 16 bits of the first divided line and the 32 bits from the beginning of the second line are the source MAC addresses. . Therefore, as shown in FIG. 4, L4 on the first line, L1 and L2 on the second line are recognized as the source MAC addresses, and notified to the control unit 13.

Since the format of the packet transmitted from the virtual computer and the packet transmitted from the physical host computer are the same, the source MAC address can be recognized by the same process for the virtual hardware address. As shown in FIG. 3, when a plurality of virtual computers and virtual network adapters exist on the host computer, an address set in advance by an administrator or an address generated by a random number or the like is a virtual network adapter. Assigned to. For example, when the virtual computer 1 is initialized, a virtual MAC address V11 generated by a random number is assigned to the virtual network adapter 31. When the virtual computer 30 transmits a packet via the virtual network adapter 31, the virtual computer 30 generates an Ethernet header with the source MAC address as V11. The generated packet is sent to the physical network adapter 1a via the virtual switch SW1. Even if the packet is transmitted by the virtual computer via the virtual network adapter, the format is the same as the packet transmitted from the physical host computer as described above. Therefore, the address is recognized in the same manner as the packet transmitted from the physical host computer, and is notified to the control unit 13.
As described above, the address recognition unit 12 can recognize a necessary address in the same manner without distinguishing between a physical hardware address and a virtual hardware address.

[Registering addresses in the filter table]
FIG. 5 shows a flowchart of the operation when the control unit 13 performs the registration process to the filter table 141. First, the network adapter is initialized (step S1). In the initialization process, the control unit 13 deletes all entries in the filter table 141. After the filter table 141 is initialized, the process waits until a transmission packet from the host computer is received (step S2). The filter table 141 manages hardware addresses related to filtering and time stamps for individual hardware addresses, as shown in FIG. 2 as an example. Here, the time stamp represents the time when the packet having the corresponding hardware address as the transmission source hardware address was last transmitted.

  When the transmission packet is analyzed by the address recognition unit 12 and the transmission source hardware address of the packet is notified, the control unit 13 confirms whether or not the transmission source address is registered in the filter table 141 (step S3, S4). If it is not registered in the filter table 141, the control unit 13 checks whether there is an empty entry in the filter table 141. If there is an empty entry, the acquired hardware address is registered in the filter table 141 (step S5). , S6). When registration is completed, the time stamp of the filter table 141 is updated to the current time (step S8).

  When there is no empty entry in the filter table 141, the control unit 13 cannot register the hardware address notified from the address recognition unit 12. A packet addressed to an unregistered hardware address is discarded by the network adapter unless it is a broadcast address, and the packet cannot be received on the host computer side. Therefore, if there is no empty entry in the filter table 141, the control unit 13 disables the filtering function of the received packet filtering unit 14 and performs setting to pass all packets (step S7). Then, all the packets arriving from the network are received by the host computer. In this case, the host computer receives all packets arriving from the network side, so that the host computer is loaded, but communication is possible. This is particularly effective when the number of entries is temporarily insufficient, such as when a virtual computer is temporarily added. Even when all packets are set to pass, the controller 13 deletes the low-priority address from the filter table 141 because the non-use time is long as will be described later after the setting is completed. By doing so, if a free entry is made, the filtering function is enabled again.

  If the address notified from the address recognition unit 12 to the control unit 13 has already been registered in the filter table 141, registration in the filter table 141 and confirmation of empty entries in the filter table 141 are not performed, and the time stamp Only updating is performed (step S8).

[Deleting address from the filter table]
The control unit 13 performs an address deletion process registered in the filter table 141 as necessary. This is because the number of entries in the filter table 141 is limited, so that a situation in which a new address cannot be registered by leaving a registration of a hardware address that is not performing communication is avoided. This is also because there is a possibility that the registered hardware address does not already exist when there is no communication for a certain period.

  FIG. 6 is a flowchart for explaining address deletion processing from the filter table 141. The control unit 13 confirms the time stamp of each filter entry (step S11). Next, the control unit 13 compares the current time with the time recorded in each time stamp, and whether or not the time elapsed since the last time stamp update of each entry exceeds the specified time. Is confirmed (step S12). Here, the “specified time” is a predetermined time. The specified time is preferably about several hundred seconds, but can be set arbitrarily and may be longer or shorter than several hundred seconds. When the time stamp has not been updated longer than the specified time, the control unit 13 determines that the address corresponding to the time stamp is a hardware address that is not used. Therefore, the control unit 13 deletes the filter entry that has passed the specified time since the last time stamp update (step S13).

  Such processing is particularly effective when considering a virtual network. The virtual hardware address is an address corresponding to the virtual network adapter. As described above, the virtual hardware address may be generated by a random number when the virtual computer is initialized. In addition, the virtual computer may be stopped and restarted when the physical host computer is operating. Therefore, the virtual computer may be restarted during the operation of the physical host computer, and the virtual hardware address assigned to the virtual network adapter may be changed. In the conventional filtering, since the host computer controls the filtering, when the virtual hardware address used is changed, the host computer needs to recognize the change and control the filtering. there were. However, in the network adapter shown in the present embodiment, the entry of the filter table 141 is controlled using a time stamp, so when the specified time elapses, the virtual hardware address that is no longer needed by the control unit 13 is deleted. To do. For this reason, even if the virtual hardware address is changed, the host computer does not need to perform the deletion process. Therefore, when the virtual hardware address is changed, the virtualization software running on the host computer does not need to change the filtering settings due to the address change, so the virtualization software can be simplified. It becomes.

[Operation of received packet filtering unit]
As shown in FIG. 1, the received packet filtering unit 14 determines whether or not to allow the received packet to pass. When a packet is transmitted from the network side to the network adapter, the received packet filtering unit 14 recognizes the destination hardware address. Also, it is determined whether the address is a unicast address or a broadcast address. As an example of a method for determining whether the address is a unicast address or a broadcast address, a determination method using the head portion of the address can be considered. For example, in the case of Ethernet, if the least significant bit of the first octet is 1, such as “01: 00: 5e” or “33:33”, the hardware address is a multicast address, and “ff: ff: ff: ff” : Ff: ff "is a broadcast address. Any other address is recognized as a unicast address.

  If the destination address is a unicast address, the received packet filtering unit 14 searches the filter table 141 using the destination hardware address of the packet as a key. If any entry in the filter table 141 matches the destination hardware address of the packet, the packet is transmitted to the host computer, and the other packets are discarded.

  When the destination address is a multicast address or a broadcast address, the received packet filtering unit 14 passes the packet without referring to the filter table 141.

[Timing for setting filtering conditions]
As is clear from FIG. 5, the network adapter 1 does not set the filter table 141 until the transmission packet is received from the host computer or the virtual computer provided by the host computer after the initialization. When a plurality of packets are transmitted, after the first transmission packet has been processed such as source address recognition and registration, registration processing in the filter table is performed until the second transmission packet is received. Absent. That is, the network adapter 1 shown in the present embodiment performs the registration process of the filter table 141 by using a host computer or a virtual computer provided by the host computer as a trigger for receiving a transmission packet.

  In this way, the network adapter 1 sets filter conditions for allowing packets addressed to the host computer (or a virtual computer provided by the host computer) to pass through independently without setting by the host computer. However, in order for a packet addressed to the host computer to pass through the received packet filtering unit 14, it is necessary for the host computer to transmit a packet via the network adapter 1 before the packet is transmitted from the counterpart terminal. is there. However, in a normal packet communication system, the host computer transmits a packet for notifying its partner terminal of its hardware address before receiving the packet from the partner terminal. Therefore, the address of the packet to be received by the host computer is registered in the filter table 141 before the packet is transmitted from the partner terminal.

  As an example, a case of a communication system using Ethernet as a network medium and using the Internet protocol (IP) as a network layer protocol will be described. In such a communication system, computers that communicate with each other are specified by IP addresses. However, when actually transmitting a packet, the destination Ethernet address (MAC address) is required as the destination hardware address. In order to know the transmission destination MAC address, the transmission source computer uses ARP (address resolution protocol).

  FIG. 7 is a sequence diagram of address resolution by ARP. In the following description, filtering conditions for the network adapter connected to the computer 2b are set in this sequence.

  As described above, the computer 2a attempting to transmit a packet normally does not know the hardware address even if it knows the IP address of the destination computer 2b. Therefore, before transmitting a packet, an ARP request is transmitted in the subnet in which the computer 2a itself exists. FIG. 7 shows the format of the ARP request packet. Since the ARP request is a broadcast message, the network adapter 1 connected to each computer does not discard the ARP request packet. Therefore, the computer 2b (responding computer) can receive the ARP request. The computer 2b checks whether or not the IP address included in the ARP request matches its own IP address, and if it matches, sends an ARP response to the computer 2a. The format of the ARP response packet is as shown in FIG. A transmission destination MAC address and a transmission source MAC address are described in the Ethernet header portion.

  When the computer 2b transmits an ARP response, the network adapter 1 connected to the computer 2b receives a transmission packet including the ARP response. Here, the Ethernet header portion of the ARP response packet includes a transmission destination MAC address and a transmission source MAC address, as in a normal packet. Therefore, the network adapter 1 recognizes the transmission source MAC address included in the Ethernet header and registers it in the filter table 141 as described above.

  The computer 2a recognizes the MAC address of the computer 2b by receiving the ARP response transmitted via the network adapter 1. Thereafter, the computer 2a can transmit packets to the computer 2b by unicast communication. At this time, the MAC address of the computer 2b is registered in the network adapter 1 connected to the computer 2b when the ARP response packet is returned. Therefore, the computer 2b can receive a packet from the computer 2a. Here, the same processing is performed even if the computers 2a and / or 2b that perform ARP resolution are virtual computers instead of physical host computers.

  As described above, since the network adapter autonomously sets the filtering conditions of the received packet filtering unit 14, filtering is possible without imposing a load on the host computer.

  Further, the control unit 13 registers the transmission source MAC address included in the transmission packet recognized by the address recognition unit 12 according to the present embodiment in the filter table 141. That is, only the hardware address used by the physical host computer and the virtual computer provided by the physical host computer is registered in the filter table 141. That is, since no MAC address is registered for a node connected to the network side, the number of entries required in the filter table 141 may be several tens. For this reason, since a large amount of memory is not required unlike a learning bridge, it can be manufactured at low cost.

<Operation of Network Adapter of Embodiment (2)>
[Overview of operation]
In the case of multicast transmission, a packet destined for the multicast address is transmitted. Therefore, in order to perform filtering of multicast packets, an address for identifying the multicast group to which the computer belongs needs to be set in the filtering mechanism. When a computer joins / leaves a multicast group except for some default multicast groups, a multicast control packet is transmitted prior to joining / leaving. In the control packet, the multicast address of the multicast group to which the computer intends to join or leave is included as the network layer address. However, depending on the multicast control protocol, it is necessary to analyze not only the control packet transmitted by the computer but also the control packet received by the computer. In this case, the address recognition unit 12 recognizes not only the transmission packet but also the reception packet. When setting a multicast address, the network adapter performs the following processing.

(1) The address recognition unit 12 analyzes a multicast control packet transmitted / received via the network adapter 1. At this time, the address recognition unit 12 recognizes a multicast address included in the packet.
(2) The address recognition unit 12 calculates a hardware multicast address from the recognized network layer multicast address. Further, the address recognition unit 12 also recognizes whether the control packet is a packet for joining a multicast group or a packet for leaving.
(3) The address recognition unit 12 notifies the control unit 13 of the recognized multicast address. In addition, the address recognition unit 12 also notifies the control unit 13 whether the packet is a notification of participation in the multicast group (join) or a notification of leave.
(4) If the transmitted / received packet is a join message to the multicast group, the control unit 13 confirms whether the notified address is registered in the filtering table existing in the received packet filtering unit 14. If the notified address is not registered in the filtering table, it is registered in the filter table 141.
(5) If the transmitted packet is a leave message from the multicast group, the control unit 13 ignores the packet. This is because another virtual computer may participate in the multicast group.
(6) When the network adapter 1 receives a packet addressed to the multicast address, the received packet filtering unit 14 confirms the destination multicast address. When the destination multicast address is a multicast address to which all hosts belong by default or is registered in the filter table 141, the packet is transmitted and transmitted to the host computer side. However, the broadcast packet is transferred to the host computer without filtering.
(7) Discard packets that are not sent to the host computer.

  In the network card that performs the above operations, setting / deleting of the multicast address is performed autonomously. Therefore, it is not necessary for the host computer to manage the participation status in the multicast group and to set the filtering of the network adapter 1, so that the burden on the host computer is reduced.

  The fact that the host computer does not set the multicast address has a great significance especially when the virtual computer participates in the multicast. For example, when a part of the virtual network as shown in FIG. 3 joins or leaves the multicast group, the virtualization software 201 needs to grasp the participation status in the multicast group and the configuration of the virtual network. For example, consider the case where virtual computers 30 and 40 participate in the same multicast via virtual network adapters 31 and 41, respectively. At this time, since the virtual network adapters 31 and 41 are connected to the same physical network adapter 1a, the virtualization software 201 only needs to set the packet addressed to the multicast address only to the physical network adapter 1a. However, even if the virtual computers 30 and 40 participate in the same multicast group, the virtual computer 30 may participate through the virtual network adapter 31 and the virtual computer 40 may participate through the virtual network adapter 42. possible. In this case, the virtualization software 201 needs to set both the physical network adapters 1a and 1b to pass packets addressed to the multicast address.

  According to this configuration, since the network adapter analyzes and learns the multicast address, it is not necessary to set the multicast address from the host computer. Therefore, the virtualization software 201 can be simplified. When the virtualization software is simplified, the design, implementation, and verification become easier, and as a result, the reliability of the virtualization software can be improved. Hereinafter, the operation contents will be described for each part of the network adapter 1.

[Address recognition unit corresponding to IPv4]
{Configuration and operation}
As an example, a case of a communication system using Ethernet as a network medium and using IPv4 as a network layer protocol will be described. In such a communication system, joining / leaving to / from a multicast group is performed by, for example, an IGMP packet. This IGMP packet describes an IPv4 multicast address. However, since the IPv4 multicast address is a network layer address as described above, the address recognition unit 12 performs mapping to the hardware multicast address. In this example, since the network medium is Ethernet, “hardware multicast address” may be described as “Ethernet multicast address”.

  In the IGMP protocol, the router transmits a Query message for inquiring about the participation state in the multicast group at regular intervals (usually 60 seconds). In this case, 224.0.0.1 which is a multicast address representing all hosts is used as the destination address. The host that has received the Query message waits for a time determined by a random number, and then responds to the multicast group to which it belongs. However, if another host responds that it belongs to the same multicast group during that time, it refrains from responding itself. This is to prevent duplicate response packets from many hosts. For this reason, in this embodiment, it is necessary to analyze not only the IGMP packet transmitted by the host but also the IGMP packet transmitted by another host.

  An example of the address recognition unit 12 of the network adapter 1 that can support multicast address transmission / reception in a communication system using IPv4 is shown in FIG. The address recognition unit 12 includes an input controller 121, an Ethernet header analysis unit 123, an IPv4 header analysis unit 124, and an IGMP header analysis unit 125. The operation of each part will be described below with reference to the IGMP packet format diagram shown in FIG.

(1) When a packet transmitted from a host computer or a received packet is read into the address recognition unit 12, the input controller 121 divides it into data having a certain bit width. Data divided into a certain width is sent to the Ethernet header analysis unit 123, the IPv4 header analysis unit 124, and the IGMP header analysis unit 125, respectively.
(2) The Ethernet header analysis unit 123 determines whether the value of the type field of the Ethernet header of the IGMP packet (FIG. 9) is 0x0800. If the type field is 0x0800, it means that the IPv4 protocol is used. Since the position of the IPv4 header differs depending on whether or not the VLAN tag is included in the packet, the Ethernet header analysis unit 123 notifies the IPv4 header analysis unit 124 of the start position of the IPv4 header after confirming that the packet is the IPv4 protocol.
(3) The IPv4 header analysis unit 124 extracts the IPv4 header portion of the data received from the input controller 121 according to the start position of the IPv4 header notified by the Ethernet header analysis unit 123. Next, after confirming the validity of the IPv4 header, the IPv4 header analysis unit 124 determines whether the protocol field of the IPv4 header is 2. A protocol field value of 2 indicates an IGMP packet. Since the start position of the IGMP header differs depending on the IP option, if the protocol field is 2, the IPv4 header analysis unit 124 notifies the IGMP header analysis unit 125 of the start position of the IGMP header.
(4) The IGMP header analysis unit 125 extracts the IGMP header portion from the data sent from the input controller 121 according to the notification content from the IPv4 header analysis unit 124. The IGMP header analysis unit 125 confirms the validity of the IGMP header. Thereafter, the IGMP header analysis unit 125 checks the Type field of the IGMP header and determines whether the packet is a join message for joining the multicast group or a leave message for leaving. When the value of the Type field is 0x12 (IGMP v1 Report) or 0x16 (IGMP v2 Report), it indicates participation in the multicast group. When the value of the Type field is 0x17 (IGMP v2 Leave), it indicates a departure from the multicast group. The IGMP header analysis unit 125 notifies the control unit 13 of the determination result.
(5) The IGMP header analysis unit 125 confirms the Group Address field included in the IGMP header. The IPv4 multicast address recorded in the Group Address field is taken out and mapped to the Ethernet multicast address. The IGMP header analysis unit 125 notifies the control unit 13 of the Ethernet multicast address obtained by the mapping. A specific method of mapping will be described later.

  In (4), the value of the leave message is only shown for IGMP v2 because there is no explicit leave message in IGMP v1. In IGMP v1, when the router does not respond to the query, distribution of the multicast group corresponding to the query is stopped.

{Calculation of Ethernet multicast address}
FIG. 10 is a diagram for explaining a method of converting from an IPv4 multicast address to an Ethernet multicast address. Of the 32-bit IPv4 multicast address, the upper 4 bits of the first octet are values fixed at 1110. Therefore, a multicast group is designated by the lower 28 bits. On the other hand, the upper 25 bits of the Ethernet multicast address are fixed, and the multicast group is designated by the lower 23 bits. Therefore, when obtaining the Ethernet multicast address from the IPv4 multicast address, the lower 5 bits are mapped ignoring the upper 5 bits out of the 28 bits designated by the IPv4 multicast address.

  The IGMP header analysis unit 125 obtains an Ethernet multicast address by mapping the lower 23 bits of the IPv4 multicast address, and notifies the control unit 13 of it.

  In IPv4, 256 multicast addresses from 224.0.0.0 to 224.0.0.255 are reserved as representing a predetermined (well-known) multicast group. For example, 224.0.0.1 is the multicast address for all devices in the subnet. For these multicast groups, explicit participation or withdrawal by IGMP or the like is not notified. Therefore, for the packets addressed to Ethernet addresses 01: 00: 5e: 00: 00 to 01: 00: 5e: 00: 00: ff corresponding to these, the received packet filtering unit 14 is similar to the broadcast address. The packet is allowed to pass regardless of the contents of the filter table 141.

[Address recognition unit corresponding to IPv6]
{Configuration and operation}
As another form, a case of a communication system using IPv6 as a network layer protocol will be described. Also in this form, the network medium uses Ethernet. In a communication system using IPv6, joining / leaving to / from a multicast group is performed by, for example, MLD packets. The address recognizing unit 12 performs the determination of whether the MLD packet is a message for joining or leaving and the mapping of the Ethernet multicast address, as in IPv4. Since the mechanism for refraining a response by a response from another host to the Query message is the same, it is necessary to analyze not only the packet transmitted by the host but also the received packet in this form. An example of the address recognition unit 12 that can cope with multicast transmission in IPv6 is shown in FIG. The address recognition unit 12 includes an input controller 121, an Ethernet header analysis unit 123, an IPv6 header analysis unit 126, and an MLD header analysis unit 127. The operation of each part will be described below with reference to the MLD packet format diagram shown in FIG.

(1) When a packet transmitted from a host computer or received is read into the address recognition unit 12, the input controller 121 divides the packet into data having a certain bit width. Data divided into a certain width is sent to the Ethernet header analysis unit 123, the IPv6 header analysis unit 126, and the MLD header analysis unit 127, respectively.
(2) The Ethernet header analysis unit 123 determines whether the value of the type field of the Ethernet header of the MLD packet (FIG. 12) is 0x86dd. If the type field is 0x86dd, the Ethernet header analysis unit 123 recognizes that the IPv6 protocol is used. Since the position of the IPv6 header differs depending on whether the VLAN tag is included in the packet, the Ethernet header analysis unit 123 notifies the IPv6 header analysis unit 126 of the start position of the IPv6 header.
(3) The IPv6 header analysis unit 126 extracts the IPv6 header from the data sent from the input controller 121 based on the notification content from the Ethernet header analysis unit 123. After confirming the validity of the IPv6 header, the IPv6 header analysis unit 126 traces the IPv6 extension header chain and determines the value of the Next Header field. If the value of the Next Header field is 58, it indicates ICMPv6. Since the start position of the MLD header differs depending on the IPv6 extension header, after confirming that it is ICMPv6, the IPv6 header analysis unit 126 notifies the MLD header analysis unit 127 of the start position of the MLD header.
(4) The MLD header analysis unit 127 extracts the MLD header portion from the data from the input controller 121 according to the notified start position of the MLD header. The MLD header analysis unit 127 confirms the validity of the MLD header. Thereafter, the MLD header analysis unit 127 checks the Type field of the MLD header and determines whether the packet is a join message for joining the multicast group or a leave message for leaving. If the value of the Type field is 131 (Multicast Listener Report), it indicates participation in the multicast group. On the other hand, if the value of the Type field is 132 (Multicast Listener Done), it indicates a departure from the multicast group. The MLD header analysis unit 127 notifies the control unit 13 of the determination result.
(5) The MLD header analysis unit 127 extracts the IPv6 multicast address recorded in the Multicast Address field included in the MLD header, and performs mapping to the Ethernet multicast address. The MLD header analysis unit 127 notifies the control unit 13 of the Ethernet multicast address obtained by mapping. A specific method of mapping will be described later.

{Calculation of Ethernet multicast address}
FIG. 13 is a diagram illustrating a method for converting an IPv6 multicast address to an Ethernet multicast address. In the IPv6 multicast address, the upper 8 bits are all fixed at 1, the subsequent 4 bits are a flag, the next 4 bits are a scope, and the lower 112 bits represent a multicast group.

  In the Ethernet multicast address for the IPv6 multicast address, the upper 16 bits are fixed to “33:33”, and the multicast group is represented by the lower 32 bits. Therefore, when obtaining the Ethernet multicast address from the IPv6 multicast address, the lower 32 bits of the 112 bits representing the group by the IPv6 multicast address are mapped.

The MLD header analysis unit 127 notifies the control unit 13 of the Ethernet multicast address obtained by mapping the lower 32 bits of the IPv6 multicast address.
In IPv6, the multicast address ff02 :: 01 is reserved for all hosts, and the multicast address ff02 :: 02 is reserved for all routers. These multicast groups are not notified of explicit participation or withdrawal by MLD or the like. Therefore, for the packets addressed to the Ethernet addresses 33: 33: 00: 00: 00: 01 and 33: 33: 00: 00: 00: 02 corresponding to these, the received packet filtering unit 14 is similar to the broadcast address. The packet is allowed to pass regardless of the contents of the filter table 141.

  In IPv6, a multicast address called a solicited-node address is also used. This is calculated from the unicast address, and is a multicast address ranging from ff02: 0: 0: 0: 0: 1: ff00: 0000 to ff02: 0: 0: 0: 0: 1: ffff: ffff. is there. The lower 24 bits of the unicast address are mapped. For example, the Solicited-Node address corresponding to the unicast address 4037 :: 01: 800: 200e: 8c6c is ff02 :: 1: ff0e: 8c6c. If this is further mapped to the Ethernet address, 33: 33: ff: 0e: 8c: 6c is obtained. The address recognizing unit 12 needs to recognize the source IPv6 address of the IPv6 packet transmitted by the host, calculate the Ethernet multicast address of the solicited-node address corresponding thereto, and notify the control unit 13 of the same. .

(Control part)
{Multicast address registration process}
When the control packet is a join message, the control unit 13 sets a multicast address in the filter table 141. The setting of the filter table 141 performed by the control unit 13 is the same for both IPv4 and IPv6.

  As described above, the control unit 13 receives the notification of the Ethernet multicast address and the type of control packet from the address recognition unit 12. When the control packet is a join message, the control unit 13 performs a registration process similar to the procedure shown in FIG. That is, the control unit 13 registers an address to be processed if the address to be processed is not registered in the filter table 141 and there is an empty entry. The processing when the processing target address has already been registered in the filter table 141 and when there is no empty entry is the same as that shown in FIG.

{Deleting multicast address}
The control unit 13 performs a multicast address deletion process when it is recognized that the time stamp has not been used for a certain period of time. If the control packet is a leave message, the deletion process is not performed because there is a possibility that another virtual computer or the like may participate in the multicast group.

When the address recognized as unused for a specified time is deleted by the time stamp, the control unit 13 performs processing as shown in FIG.
This process is considered to be particularly meaningful when the virtual computer is participating in a multicast group. As described above, the virtual computer may be stopped or restarted while the physical host computer is operating, or may be moved to another physical host computer. For this reason, conventionally, it has been necessary for the host computer to grasp the participation status of the multicast and the virtual network configuration in real time to set the filtering condition. Moreover, in order for the host computer to grasp the participation status of the multicast and the virtual network configuration, the virtualization software has to be complicated. As in this embodiment, the network adapter autonomously deletes addresses that have not been used for a specified time, thereby reducing the burden on the host computer. Further, since the host computer does not need to grasp the multicast participation status and the network configuration, the virtualization software can be simplified.

[Operation of received packet filtering unit]
The operation of the received packet filtering unit 14 is basically the same as that in the above-described embodiment. That is, the received packet filtering unit 14 recognizes the destination Ethernet multicast address for the packet received from the network side. Next, the received packet filtering unit 14 searches the filter table 141 using the destination Ethernet multicast address of the packet as a key. If any entry in the filter table 141 matches the destination Ethernet multicast address of the packet, the packet is transmitted to the host computer side, and the other packets are discarded. Even in this case, the received packet filtering unit 14 allows the packet to pass without referring to the filter table 141 for the packet addressed to the predetermined multicast address or the broadcast packet.

  As described above, since the network adapter itself sets the hardware multicast address, filtering is possible without the host computer knowing the multicast group participation status and the network configuration. Therefore, the burden on the host computer for the filtering setting is eliminated. It also leads to simplification of virtualization software that runs on the host computer.

<Other embodiments>
The present invention is not limited to the above-described embodiment, and can be variously modified. Some examples are described below.

  In the network adapter capable of learning the multicast address, as described above, the Ethernet header analysis unit 123 checks the type field, notifies the IP header analysis unit of the start part of the IGMP header or the MLD header, and the like. However, at the same time, the Ethernet header analysis unit 123 can also extract the source MAC address portion of the Ethernet header portion from the data received from the input controller 121. When the source MAC address is also recognized by the Ethernet header analysis unit 123, the recognized source MAC address is also notified to the control unit 13, and the control unit 13 processes the notified MAC address. In such a case, the network adapter can autonomously set both the unicast address and the multicast address.

  In the embodiment described for the address recognition unit 12 that recognizes a multicast address using an IGMP packet, the input controller 121 divides the Ethernet header analysis unit 123, the IPv4 header analysis unit 124, and the IGMP header analysis unit 125 in parallel. Data is being sent. However, this is described only for the sake of explanation, and is not limited to the form shown in FIG. Depending on the implementation, it can take various forms.

  The same applies to the address recognition unit 12 that recognizes a multicast address using an MLD packet. As shown in FIG. 11, it is not necessary to send the data divided in parallel from the input controller 121 to the Ethernet header analysis unit 123, the IPv6 header analysis unit 126, and the MLD header analysis unit 127. Can take various forms.

(Appendix 1) A network adapter that connects to a host computer that provides a virtual computer and transmits / receives a packet to / from a network.
Recognizing means for recognizing a source address of a packet transmitted from the host computer and a packet transmitted from a virtual computer provided by the host computer;
A filtering unit for filtering packets received from the network;
Control means for setting an address recognized by the recognition means as a passing address in the filtering unit;
A network adapter characterized by comprising:
(Appendix 2) The network is a network based on the Ethernet standard,
The network adapter according to appendix 1, wherein the recognizing unit extracts the transmission source address from a transmission source MAC address area of an Ether header of a packet transmitted from the host computer or the virtual computer.
(Supplementary Note 3) The passing address is set in the filtering unit by receiving a packet transmitted from the host computer or a packet transmitted from a virtual computer provided by the host computer as a trigger. The network adapter according to appendix 1.
(Additional remark 4) The said recognition means recognizes a transmission source address by extracting the fixed part of the packet transmitted from the packet transmitted from the said host computer, and the virtual computer provided by the said host computer, It is characterized by the above-mentioned. The network adapter according to appendix 1.
(Additional remark 5) The said recognition means, The input controller for dividing | segmenting the packet transmitted from the said host computer into fixed bit width,
A storage circuit for storing the packet divided into the constant bit width output from the input controller;
The network adapter according to appendix 1, further comprising: an address acquisition unit that extracts a part of the stored packet as an address.
(Appendix 6) A network adapter that connects to a host computer and transmits / receives a packet to / from a network.
Calculating means for calculating a hardware multicast address for identifying a multicast group to which the host computer belongs, from a multicast address included in a multicast control packet transmitted from the host computer or received by the host computer;
A filtering unit for filtering packets received from the network;
Control means for setting the hardware multicast address calculated by the calculation means as a passing address in the filtering unit;
A network adapter characterized by comprising:
(Additional remark 7) It further has an analysis means which analyzes the control message set to the said multicast control packet,
The supplementary note 6 is characterized in that the control means sets the hardware multicast address as a passing address in the filtering unit when a control message indicating participation in the multicast group is detected by the analyzing means. The described network adapter.
(Appendix 8) The multicast control packet is an IGMP packet,
The network adapter according to appendix 6, wherein the calculating means calculates a hardware multicast address corresponding to an IPv4 multicast address written in an IGMP packet.
(Supplementary note 9) The multicast control packet is an MLD packet,
The network adapter according to appendix 6, wherein the calculating means calculates a hardware multicast address corresponding to an IPv6 multicast address written in an MLD packet.
(Additional remark 10) The said host computer is provided with the virtualization means which provides a virtual computer,
The network adapter according to appendix 6, wherein the calculating means calculates a hardware multicast address from a multicast address included in a packet transmitted from a virtual computer provided by the host computer.
(Appendix 11) A method of setting a filtering condition of a network adapter that connects to a host computer that provides a virtual computer and transmits / receives a packet to / from a network,
Recognizing the source address of the packet transmitted from the host computer and the packet transmitted from the virtual computer provided by the host computer in the network adapter;
A method for setting filtering conditions, wherein the recognized address is set as a passing address in a filtering unit for filtering packets received from the network.
(Supplementary Note 12) A method of setting filtering conditions for a network adapter that connects to a host computer and transmits / receives a packet to / from a network,
In the network adapter, a hardware multicast address for identifying a multicast group to which the host computer belongs is calculated from a multicast address included in a multicast control packet transmitted from the host computer.
A filtering condition setting method, characterized in that the calculated hardware multicast address is set as a passing address in a filtering unit for filtering packets received from the network.

It is a figure explaining the concept of this invention. It is the figure which showed the structure of the filter table with which a received packet filtering part is provided. It is a figure which shows an example of a virtual environment. It is a figure which shows an example of the address recognition part corresponding to a unicast packet. It is a flowchart which shows the registration process to a filter table. It is a flowchart which shows the deletion process from a filter table. It is a figure which shows the sequence of address resolution. It is a figure which shows the example of mounting of the address recognition part which processes an IGMP control packet. It is a figure which shows the format of an IGMP control packet. It is a figure explaining the mapping from an IPv4 multicast address to an Ethernet multicast address. It is a figure which shows the example of mounting of the address recognition part which processes an MLD control packet. It is a figure which shows the format of an MLD control packet. It is a figure explaining the mapping from an IPv6 multicast address to an Ethernet multicast address. It is a conceptual diagram which shows operation | movement of the existing network adapter.

Explanation of symbols

1 Network adapter 11 ROM
DESCRIPTION OF SYMBOLS 12 Address recognition part 121 Input controller 122 Latch circuit 123 Ethernet analysis part 124 IPv4 header analysis part 125 IGMP header analysis part 126 IPv6 header analysis part 127 MLD header analysis part 13 Control part 14 Received packet filtering part 141 Filter table 2 Host computer 201 Virtual Software 30, 40, 50 Virtual computer 31, 32, 41, 42, 51, 52 Virtual network adapter

Claims (4)

A network adapter that connects to a host computer that provides a virtual computer and transmits and receives packets to and from the network.
Recognizing means for recognizing a source address of a packet transmitted from the host computer and a packet transmitted from a virtual computer provided by the host computer;
A filtering unit for filtering packets received from the network;
Control means for setting an address recognized by the recognition means as a passing address in the filtering unit;
A network adapter characterized by comprising: The passage address is set in the filtering unit by receiving a packet transmitted from the host computer or a packet transmitted from a virtual computer provided by the host computer as a trigger. The network adapter according to 1. A network adapter that connects to a host computer and sends and receives packets to and from the network.
Calculating means for calculating a hardware multicast address for identifying a multicast group to which the host computer belongs, from a multicast address included in a multicast control packet transmitted from the host computer or received by the host computer;
A filtering unit for filtering packets received from the network;
Control means for setting the hardware multicast address calculated by the calculation means as a passing address in the filtering unit;
A network adapter characterized by comprising: Further comprising analysis means for analyzing a control message set in the multicast control packet;
The control means sets the hardware multicast address as a passing address in the filtering unit when a control message indicating participation in a multicast group is detected by the analysis means. The described network adapter.

Images