JP2012034192A - Packet transfer device, packet transfer device management system, and packet transfer device management method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform a power-saving flow search for dynamically controlling triggering of flow search of CAM according to traffic amount.SOLUTION: A packet transfer device measures a traffic amount for each interface (for each flow list), and registers the flow entry for a flow monitor only for the interface whose traffic amount is excessive, for triggering CAM search. It includes a search triggering flag table 612 for each flow list, and sets presence of registration of flow entry for each flow list according to the traffic amount. Upon receiving a packet, it refers to the search triggering flag table 612, and triggers a CAM 614 only for the packet corresponding to the flow list in which the flow entry is registered. At the interface whose traffic amount has been reduced, the flow entry is deleted to stop triggering of CAM search.

Description

  The present invention relates to a packet transfer device, a packet transfer device management system, and a packet transfer device management method, and more particularly to a packet transfer device that controls packet search activation based on statistics of packets flowing on a network, and The present invention relates to a packet transfer device management system and a packet transfer device management method to be managed.

  Reduction of the power consumption accompanying the search of the packet transfer apparatus has become an essential issue. Examples of power-saving techniques for flow search using CAM (Content Addressable Memory) are disclosed in, for example, Japanese Patent Application Laid-Open No. 2009-239401 (Patent Document 1) and Japanese Patent Application Laid-Open No. 2006-165603 (Patent Document 2). Yes.

  The technique of Patent Document 1 designates a search means corresponding to the number of search key items. The search is activated regardless of the traffic volume. In the technique of Patent Document 2, only a block designated by Hash generated from a search key is searched and activated. The search is activated regardless of the traffic volume.

JP 2009-239401 A "Packet Transfer Device" JP 2006-165603 A "Data Transfer Device" JP 2008-92520 A “Packet Quality Evaluation System and Method”

  Among the flow search applications in the packet transfer device, the flow monitor function (for example, NetFlow / selective sFlow / flow mirror) and the QoS function are particularly effective functions when the traffic volume is excessive, and the traffic volume is small. If it is, it does not necessarily have to function. However, in the techniques of Patent Documents 1 and 2, since the flow entry is set regardless of the traffic volume and the CAM search is started, even if the traffic is small and the function is not required, the CAM power consumption and the flow entry are excessive. To consume.

  In view of the above, the present invention provides a packet transfer apparatus, a packet transfer apparatus management system, and a packet transfer apparatus management method for performing a power-saving flow search that dynamically controls activation of a CAM flow search according to the traffic volume. The purpose is to do.

In the present invention, a flow entry is set according to the traffic volume, and a flow list with entry setting is searched and activated.
In the present invention, first, the traffic volume is measured with a rough granularity at the interface level. Only for the interface where the traffic is excessive, various flow entries are set and the CAM search is started. In the interface where traffic has decreased, the flow entry is deleted, and the CAM search activation is stopped again to save power and reduce the number of flow entries.

  In order to realize this, a search activation flag table for managing the presence / absence of entry setting for each interface is possessed. In the initial state, all search activation flags are set to off. Only the interface for which the traffic is determined to be excessive turns on the search activation flag and starts setting the flow entry for the interface. When a packet is received, the search activation flag table is referred to in advance before the flow search is activated, and only the interface to which the search activation flag is on (= flow entry set) and the block to which the table belongs are activated. The search activation flag of the interface determined to have decreased traffic is turned off, and the flow entry is deleted. Further, step-by-step search activation such as “when abnormal flow is identified with NetFlow, detailed analysis with flow mirror” is also conceivable.

According to the first solution of the present invention,
A packet transfer apparatus that is connected to a plurality of input lines and a plurality of output lines, and that transmits a packet received from the input line to an output line specified based on header information,
A flow search memory having a plurality of blocks;
A flow search control unit that searches a predetermined block of the flow search memory using one or more pieces of information of received header information of a packet as a search key and identifies a flow to which the packet belongs;
A flow processing unit that executes a predetermined process for each flow according to the identified flow;
A search start table in which a plurality of search start information corresponding to a plurality of blocks of the flow search memory and corresponding to a plurality of search start information for specifying a search target block among the plurality of blocks are stored correspondingly.
A search activation determination unit that refers to the search activation table based on a flow list to which the received packet belongs, and specifies a block of the flow search memory to be searched according to corresponding search activation information;
The flow search control unit
A packet transfer apparatus is provided that performs the flow search on the block of the flow search memory identified by the search activation determination unit.
According to the packet transfer apparatus described above, it is only necessary to activate a block that needs to be searched, and a power saving flow search can be performed.

According to the second solution of the present invention,
A packet transfer apparatus that is connected to a plurality of input lines and a plurality of output lines, and that transmits a packet received from the input line to an output line specified based on header information,
A flow search memory for identifying the flow to which the packet belongs based on the header information of the packet;
A flow search control unit that searches the flow search memory using one or more pieces of information of received packet header information as a search key and executes a flow search for identifying a flow to which the packet belongs;
A flow processing unit that executes a predetermined process for each flow according to the identified flow;
A search activation table storing a flow list identifier and search activation information indicating whether to execute the flow search;
A statistics collection unit that obtains the statistics of received packets or transmitted packets for each flow list; and
Management in which search activation information corresponding to a corresponding flow list in the search activation table is set to execute the flow search when the statistic obtained by the statistics collection unit exceeds a predetermined registration threshold And
A search activation determination unit that refers to the search activation table based on a flow list to which the received packet belongs, and determines whether to execute a flow search according to corresponding search activation information;
The flow search control unit executes the flow search for the flow search memory when it is determined to execute a flow search according to the determination result of the search activation determination unit, and when it is determined not to execute the flow search, The packet transfer apparatus that does not perform flow search is provided.
According to the packet transfer apparatus described above, it is possible to perform a power-saving flow search that dynamically controls activation of a CAM flow search according to the traffic volume.

According to the third solution of the present invention,
It has a search start table in which a flag indicating whether a flow entry is registered or not registered is set. When the flag indicates that there is registration, a flow search is executed for the input packet. A packet transfer device that does not execute
A packet transfer device management system comprising an external management device for managing the packet transfer device,
The packet transfer device obtains the statistics of the packet to be received or the statistics of the packet to be transmitted and transmits it to the external management device,
The external management device determines whether the statistic of the packet transmitted from the packet transfer device exceeds a predetermined registration threshold or the statistical value of the packet falls below a predetermined deletion threshold. Determine whether registration or deletion is necessary,
The external management device transmits setting control information indicating whether registration or deletion of a flow entry is necessary to the packet transfer device,
The packet transfer device registers a flow entry for a flow search when the setting control information transmitted from the external management device indicates that a flow entry needs to be registered, and sets a flag in the search activation flag table. If it is registered and the setting control information transmitted from the external management device indicates that the flow entry needs to be registered, the flow entry for the flow search is deleted and the flag of the search activation flag table is not registered A packet transfer device management system is provided.
According to the packet transfer device management system described above, search activation can be managed by a device external to the packet transfer device.

According to the fourth solution of the present invention,
The packet transfer device obtains the statistics of the received packet or the statistics of the packet to be transmitted and sends it to the external management device.
The external management device can register a flow entry when the statistic of the packet transmitted from the packet transfer device exceeds a predetermined registration threshold value or the statistic of the packet falls below a predetermined deletion threshold value. Determine whether it needs to be deleted,
The external management device transmits setting control information indicating whether registration or deletion of the flow entry is necessary to the packet transfer device,
When the setting control information transmitted from the external management device indicates that the flow entry needs to be registered, the packet transfer device registers the flow entry for the flow search and registers the flag of the search activation flag table When the setting control information transmitted from the external management device indicates that registration of the flow entry is necessary, the flow entry for the flow search is deleted, and the flag of the search activation flag table is not registered.
The packet transfer apparatus refers to the flag of the search start table, and executes a flow search for an input packet when the flag indicates that there is registration, and does not execute a flow search when the flag indicates that there is no registration Is provided.
According to the packet transfer device management method described above, search activation can be managed by a device external to the packet transfer device.

  According to the present invention, it is possible to perform a power saving flow search that dynamically controls activation of a CAM flow search according to the traffic volume.

The block diagram of the packet transfer apparatus of this invention. The block diagram of the flow search part of this invention. The search start flag table of this invention when a flow list is comprised for every input physical line. The search start flag table of this invention when a flow list is comprised for every input logical line. The search start flag table of this invention when a flow list is comprised for every output physical line. The search start flag table of this invention when a flow list is comprised for every output logical line. 6 is a configuration example of distributing the flow search CAM 614 to various table uses of filters / QoS / NetFlow / flow mirrors, and a configuration diagram of the flow search CAM 614 and the corresponding flow processing RAM 616. FIG. An example of an entry stored in one block of the flow search CAM 614. An example of a flow processing entry set in the filter area of the flow processing RAM 616. An example of a flow process entry set in the NetFlow area of the flow process RAM 616. An example of a flow process entry set in the QoS area of the flow process RAM 616. An example of a flow process entry set in the flow mirror area of the flow process RAM 616. The block diagram of the statistics collection part 62 in the case of collecting a packet rate as a statistics. The block diagram of the statistics collection part 62 in the case of collecting a bit rate as a statistics. The flowchart which shows the flow which sets a search starting flag table based on the statistics for every input physical line. The flowchart which shows the flow of search starting control based on a search starting flag table in the case of providing a flow list for every input physical line. The flowchart which shows the flow which sets a search starting flag table based on the packet rate for every input physical line. The flowchart which shows the flow which sets a search starting flag table based on the bit rate for every input physical line. The flowchart which shows the flow of search starting control based on a search starting flag table in the case of providing a flow list for every input logical line. The flowchart which shows the flow of search starting control based on a search starting flag table in the case of providing a flow list for every output physical line. The flowchart which shows the flow of search starting control based on a search starting flag table in the case of providing a flow list for every output logical line. The flowchart which shows the flow of search starting control of NetFlow based on the bit rate for every input physical line in the case of providing a flow list for every input physical line. The flowchart which shows the flow of search starting control of the flow mirror based on the bit rate for every flow by NetFlow. An example of a flow processing entry for collecting statistics of the bit rate for each flow in the NetFlow area of the flow processing RAM. An example of setting a user interface that enables a function of registering a NetFlow flow entry based on a packet statistic of the present invention for all flow lists (all physical lines or logical lines). A setting example of a user interface that enables a function of registering a flow entry of a flow mirror based on a packet statistic of the present invention for an input physical line 0, an input physical line 3, and an output physical line 1. The block diagram of the packet transfer apparatus of this invention and the external management apparatus which were connected by the network. The block diagram of a search starting block table.

1. First Embodiment First, a packet transfer apparatus that controls search activation based on a search activation flag table for each flow list will be described.

(Hardware configuration)
FIG. 1 is a block diagram of a packet transfer apparatus.
The packet transfer apparatus 1 includes, for example, a management software loaded CPU (processing unit) 3, a register 4, a packet receiving circuit 5, a receiving side packet search unit 6, a packet relay processing unit (switch unit) 7, and a transmission Side packet search unit 8 and packet transmission circuit 9 are provided. The packet search unit 6 includes, for example, a route search unit 60, a flow search unit 61, and a statistics collection unit 62.
The packet transfer apparatus 1 is connected to a plurality of input lines and a plurality of output lines, and transmits a packet received from the input line to an output line specified based on the header information.

  When receiving the packet from the input line, the packet receiving circuit 5 stores the packet and outputs the header information of the packet to the packet search unit 6. Further, the packet receiving circuit 5 may output an internal header used in the apparatus to the packet search unit 6 including an input line number (or identifier) for identifying an input line to which a packet is input. For example, the packet receiving circuit 5 can perform processing according to the result of the flow search in the flow search unit 61. For example, in the case where the flow search is used for the filter function and the flow process for the flow specified by the flow search indicates the discard of the packet, the packet receiving circuit 5 discards the stored packet. On the other hand, when the flow process for the flow specified by the flow search indicates the passage of the packet, the stored packet is output to the packet relay processing unit 7 according to the output destination specified by the route search unit 60. Note that the flow process for the flow specified by the flow search is predetermined for each flow and can be appropriately executed by the packet receiving circuit 5 or the packet search unit 6. In addition, what performs a flow process is called a flow process part here. An example of the flow process will be described later.

  The packet search unit 8 on the transmission side can have the same configuration as the packet search unit 6 on the reception side. This embodiment can be applied to both the packet search units 6 and 8 on the reception side and the transmission side. The packet transmission circuit 9 receives the packet transferred by the packet relay processing means 7, performs the same processing as the packet reception circuit 5 and the packet search unit 6, and transmits the packet to the output line.

The route search unit 60 of the packet search unit 6 specifies the output destination of the packet based on the header information of the packet. The flow search unit 61 searches for a flow based on the header information of the packet, and determines a flow process for the searched flow. The statistics collection unit 62 obtains the statistics of received packets or transmitted packets for each flow list.
The register 4 stores setting information and the like. The management software loading CPU 3 inputs setting information from the management terminal 2, for example, and sets the setting information in each unit of the packet search unit 6.

FIG. 2 is a block diagram of the flow search unit 61.
The flow search unit 61 includes, for example, a search start determination unit 610, a search start flag table control unit 611, a search start flag table 612, a flow search CAM control unit 613, a flow search CAM 614, and a flow processing RAM (Random Access). Memory) control unit 615, flow processing RAM 616, and flow processing determination unit.

  The flow search CAM (flow search memory) 614 is a memory for identifying a flow to which a packet belongs based on, for example, packet header information. The flow search CAM 614 may have a plurality of blocks as shown. For example, in the case where the flow process for the identified flow is, for example, a filter function, a QoS function, a NetFlow function, or a flow mirror function, a block corresponding to each function is included. A physically separate CAM may correspond to each block, or one CAM may be divided into a plurality of blocks. In addition, you may have a block of appropriate functions other than the above-mentioned function, and you may have a one part block of the above-mentioned function.

  The search activation flag table 612 includes a flow list identifier and a plurality of search activation flags (search activation information) that respectively correspond to a plurality of blocks of the flow search CAM 614 and identify a block to be searched among the plurality of blocks. Stored correspondingly. For example, the flow search CAM 614 stores the flow entry of the corresponding flow list in the block corresponding to the function whose search activation flag is “1”. Note that the search activation information may be stored in an appropriate form other than using the flag.

  The flow list is a unit / group in which a user defines a flow policy. The flow list is a list configured as a set of flow entries in which an input line or an output line, or a logical input interface, for example, an input VLAN, or a logical output interface, for example, an output VLAN is common. For example, a common input line number can be regarded as one flow list. As the identifier of the flow list, as will be described later, for example, any one of an input physical line, an input logical line, an output physical line, and an output logical line can be used.

  The search activation determination unit 610 refers to the search activation flag table 612 based on the flow list (for example, input line number) to which the received packet belongs, and determines whether there is a corresponding flow entry. If there is a flow entry, the search activation is performed. The block of the flow search CAM 614 to be searched is specified according to the flag. The search activation flag table control unit 611 controls search of the search activation flag table 612 and setting of the search activation flag table 612.

  The flow search CAM control unit 613 searches for a predetermined block of the flow search CAM 614 using one or more pieces of information in the received packet header information as a search key, and executes a flow search for identifying the flow to which the packet belongs. For example, the flow search CAM control unit 613 performs a flow search on the block of the flow search CAM 614 specified with reference to the search activation flag table 612.

  The flow processing RAM control unit 615 searches the flow processing RAM 616 based on the hit address obtained as a result of the flow search by the flow search CAM control unit 613. The flow processing RAM 616 stores information related to the flow processing at a corresponding address of the flow search CAM 614. Details will be described later. The flow processing determination unit determines the flow processing from the search results obtained by the flow search CAM control unit 613 and the flow processing RAM control unit 615.

  FIG. 3 is a search activation flag table when a flow list is configured for each input physical line. A flow list is configured for each input physical line, and the search activation flag table 612 stores a search activation flag corresponding to the identifier of the input physical line.

  FIG. 4 is a search activation flag table when the flow list is configured for each input logical line. A flow list is configured for each input logical line, and the search activation flag table 612 stores a search activation flag corresponding to the identifier of the input logical line.

  FIG. 5 is a search activation flag table when a flow list is configured for each output physical line. A flow list is configured for each output physical line, and the search activation flag table 612 stores a search activation flag corresponding to the identifier of the output physical line.

  FIG. 6 is a search activation flag table when a flow list is configured for each output logical line. A flow list is configured for each output logical line, and the search activation flag table 612 stores a search activation flag corresponding to the identifier of the output logical line.

FIG. 7 is a configuration diagram of the flow search CAM 614 and the corresponding flow processing RAM 616.
FIG. 7A shows a configuration example in which the flow search CAM 614 is distributed to various table uses of filter / QoS / NetFlow / flow mirror. The flow search CAM 614 has a plurality of blocks. For example, a filter block, a QoS block, a NetFlow block, and a flow mirror block are included. For example, the physical blocks 6140 to 6147 of the flow search CAM 614 may be assigned to blocks for each function as illustrated. In the example shown in the figure, each block is equally divided, but can be appropriately divided. For example, the blocks may be divided according to the storage amount, the entry amount, or the like.

  FIG. 7B shows a configuration of the flow processing RAM 616 corresponding to the flow search CAM 614 in FIG. The flow processing RAM 616 has a plurality of areas. For example, it has a filter area 6160, a QoS area 6162, a NetFlow area 6161, and a flow mirror area 6163.

FIG. 8 shows an example of entries stored in the block of the flow search CAM 614.
An entry (flow entry) of the flow search CAM 614 includes, for example, an identifier of a flow list (for example, an identifier of an input physical line), a source MAC address (SMAC), a destination MAC address (DMAC), and a source IP address (SIP ), A destination IP address (DIP), a TOS (Type of Service), a source port number (SPORT) that is a TCP port number, and a destination port number (DPORT). The address of each entry is output as a hit address. In addition, the information item of each entry can be determined as appropriate according to the specified flow.

  FIG. 9 is an example of a flow process entry set in the filter area of the flow process RAM 616. Filter information indicating either discard or passage is stored in the filter area 6160 of the flow processing RAM 616 corresponding to the address searched by the flow search CAM 614.

FIG. 10 is an example of a flow process entry set in the NetFlow area of the flow process RAM 616.
The NetFlow area 6161 of the flow processing RAM 616 stores the number of packets, the number of bytes, the accumulated TCP flag, and the destination analyzer port information corresponding to the address searched by the flow search CAM 614. The number of packets is incremented every time the corresponding entry is searched. For example, the number of packets for each flow specified by the flow search CAM 614 is shown. The number of bytes is added to the number of bytes of the packet every time the corresponding entry is searched. When a packet with TCP flag information (for example, SYN / FIN) included in the packet arrives, the value of the cumulative TCP flag information corresponding to each TCP flag is updated from 0 to 1, whereby the cumulative TCP flag is Indicates the state of the cumulative TCP flag of the flow. The destination analyzer port indicates the destination of the analyzer (external device) in NetFlow. If the destination analyzer port is uniquely determined regardless of the flow entry, it may be omitted.

  FIG. 11 is an example of a flow process entry set in the QoS area of the flow process RAM 616. In the QoS area 6162 of the flow processing RAM 616, priority information is stored corresponding to the address searched by the flow search CAM 614.

FIG. 12 is an example of a flow process entry set in the flow mirror area of the flow process RAM 616. In the flow mirror area 6163 of the flow processing RAM 616, mirror port information is stored corresponding to the address searched by the flow search CAM 614.
The flow mirror is the same as the selective mirror. As disclosed in Patent Document 3, for the selective mirror, in addition to certain specific conditions (source IP address, destination IP address, source port number, destination port number, etc.) This is a function that sends only the matching items to the mirror port.

(Operation)
FIG. 16 is a flowchart showing the flow of search activation control based on the search activation flag table when a flow list is provided for each input physical line.
When the packet receiving circuit 5 inputs a packet from the line, the search activation determination unit 610 inputs the header information of the packet from the packet receiving circuit 5 (process 1100). At this time, the packet receiving circuit 5 further inputs the line number (input physical line number) of the input physical line that received the packet. For example, an internal header including an input physical line number may be input.

  The search activation flag table control unit 611 reads the search activation flag table 612 with the input physical line number of the packet (processing 1101). For example, the search activation flag table control unit 611 refers to the search activation flag table 612 based on the input physical line number acquired by the search activation determination unit 610, and reads the search activation flag with the matching input line number. The search activation determination unit 610 determines whether the search activation flag of the flow list to which the packet belongs is 1 (processing 1102). For example, the search activation determination unit 610 determines whether at least one of the plurality of search activation flags read by the search activation flag table control unit 611 is 1.

  When at least one of the search activation flags is 1 (process 1102: Yes), the flow search CAM control unit 613 determines a CAM block to be searched (process 1103). For example, the flow search CAM control unit 613 receives a search start flag from the search start flag table control unit 611 and determines a block corresponding to the search start flag whose flag is 1 as a search target block. The relationship between the search activation flag and the corresponding block is held in the flow search CAM control unit 613 as the search activation block table 6130 and can be determined by referring to this. A configuration example of the search activation block table 6130 is shown in FIG. In the search start block table 6130, 1 is set for a block to be searched corresponding to the search start flag, and 0 is set for a block not to be searched. In addition to determining the search target by the flow search CAM control unit 613, the search start determination unit 610 has the search start block table 6130 to determine the search target block, and the search target block is determined by the flow search CAM control. You may notify to the part 613.

  The flow search CAM control unit 613 activates a CAM search (process 1104). For example, the flow search CAM control unit 613 searches for a block to be searched for the flow search CAM 614 based on the header information of the packet input from the search activation determination unit 610, and acquires a hit address. Note that hit addresses are acquired for the number of blocks to be searched. The flow processing RAM control unit 615 searches the flow processing RAM 616 based on the hit address acquired by the flow search CAM control unit 613, and acquires information related to the corresponding flow processing. For example, information indicating pass / discard is acquired for the filter area 6160, and priority information is acquired for the QoS area 6162.

The packet transfer apparatus 1 executes a process according to the search result (process 1105). Taking a filter process as an example, the packet receiving circuit 5 executes a packet transfer / discard process according to information indicating the passage / discard of the packet.
On the other hand, if at least one of the search activation flags is not 1 (all 0) (process 1102: No), the CAM search is not activated and a predetermined process is executed when the search is not activated (process 1106). .

FIG. 19 is a flowchart showing the flow of search activation control based on the search activation flag table when a flow list is provided for each input logical line.
The processing 1101 in the flowchart of FIG. 16 is an example that changes to the processing (processing 1108) of reading the search activation flag table 612 with the input logical line number of the packet. The input logical line number of a packet is a logical line number that can be specified from header information or the like, such as VLAN or link aggregation. The other processes are the same as those in FIG.

FIG. 20 is a flowchart showing the flow of search activation control based on the search activation flag table when a flow list is provided for each output physical line.
Processing 1101 in the flowchart of FIG. 16 is an example in which processing 1101 is read (processing 1109) for reading the search activation flag table 612 with the output physical line number of the packet. The output physical line number of the packet can be searched by the route search unit 60 and notified to the flow search unit 61, for example. It can be specified from header information. The other processes are the same as those in FIG.

FIG. 21 is a flowchart showing the flow of search activation control based on the search activation flag table when a flow list is provided for each output logical line.
The processing 1101 in the flowchart of FIG. 16 is an example of changing to processing (processing 1110) for reading the search activation flag table 612 with the output logical line number of the packet. The output logical line number of the packet may be specified from, for example, header information, or may be searched by the route search unit 60 and notified to the flow search unit 61. The other processes are the same as those in FIG.

2. Second Embodiment Next, a packet transfer apparatus that sets a search activation flag table based on, for example, statistics for each input physical line will be described. The configuration and processing of the first embodiment can be used as they are.

FIG. 13 is a configuration diagram of the statistics collection unit 62 in the case of collecting packet rates as statistics.
The statistics collection unit 62 includes, for example, a packet counter calculation unit 620, a statistics RAM control unit 621, a statistics RAM 622, a timer 623, and a rate determination unit 624.

  When the packet reception circuit 5 receives a packet, the packet counter calculation unit 620 counts the number of packets for each predetermined statistics collection unit. The statistics collection unit is, for example, for each input physical line, and may correspond to the flow list. For example, the packet counter calculation unit 620 further inputs an internal header or the like used in the apparatus from the packet receiving circuit 5 to obtain an input physical line identifier (for example, a number), and counts the number of packets for each input physical line number. . In addition to the input physical line, counting may be performed for each input logical line, or for each output physical line and for each output logical line.

  The statistical RAM 622 stores the number of packets (cumulative packet number) counted by the packet counter calculation unit 620 for each statistical collection unit. The statistical RAM control unit 621 controls writing and reading of the number of packets with respect to the statistical RAM 622. The timer 623 outputs a trigger to the rate determination unit 624 every predetermined time.

  The rate determination unit 624 acquires the cumulative number of packets for each statistical collection unit from the statistical RAM 622, for example, triggered by a trigger from the timer 623, and the traffic volume of each statistical collection unit from the acquired cumulative number of packets and the trigger interval of the timer 623. (Statistics, here packet rate) is obtained. Further, the rate determination unit 624 compares the obtained traffic amount with predetermined threshold values (registration threshold value, deletion threshold value), and writes the comparison result in the register 4. For example, when the traffic amount of a certain statistics collection unit exceeds the registration threshold, the rate determination unit 624 writes information indicating that the threshold is exceeded in the register 4 in an area corresponding to the statistics collection unit. In addition, when the traffic amount of a certain statistics collection unit falls below the deletion threshold, the rate determination unit 624 writes information indicating the threshold breakage in the register 4 in an area corresponding to the statistics collection unit. When the rate determination unit 624 acquires the cumulative number of packets from the statistical RAM 622, the rate determination unit 624 resets the information in the statistical RAM 622. When the rate determination process is completed, the number of packets (cumulative packet number) is reset to 0 to prepare for the rate determination process triggered by the next trigger from the timer 623. Note that the traffic amount calculation method described above is an example, and can be obtained by an appropriate method other than the above configuration and processing.

  The management software-equipped CPU 3 periodically refers to the register 4 and, when information indicating that the threshold is exceeded is registered, the search start flag in the search start flag table 612 is searched for the flow list to which the corresponding statistics collection unit belongs. Is set to execute (for example, 1). Which function and block the flow search is to be executed can be determined in advance. When information indicating threshold breakage is registered, the search activation flag of the search activation flag table 612 is set so as not to execute the flow search (for example, 0) for the flow list to which the corresponding statistics collection unit belongs.

FIG. 14 is a configuration diagram of the statistic collecting unit 62 in the case of collecting a bit rate as a statistic.
A configuration for setting the search activation flag table based on the bit rate for each input physical line will be described. The statistics collection unit 62 illustrated in FIG. 14 includes, for example, a byte counter calculation unit 625, a statistics RAM control unit 621, a statistics RAM 622, a timer 623, and a rate determination unit 624. In the configuration of FIG. 13, the packet counter calculation unit 620 counts the number of packets, and the rate determination unit 624 obtains the packet rate, whereas in the configuration of FIG. 14, the byte counter calculation unit 625 includes the packet reception circuit 5. The number of bytes of the packet is acquired from the header information of the packet received in step S1, the cumulative number of bytes is counted, and the rate determination unit 624 obtains the bit rate. Other configurations are the same as those in FIG.

(Operation)
FIG. 15 is a flowchart showing the flow of setting the search activation flag table based on the statistics for each input physical line.
The statistics collection unit 62 collects statistics for each input physical line and periodically checks the statistics (processing 1001). The statistics collection unit 62 determines whether the statistic exceeds the registration threshold (process 1002). If the statistic exceeds the registration threshold (process 1002: Yes), for example, the management software-equipped CPU 3 sets the search activation flag for the corresponding flow list in the search activation flag table 612 to 1 (process 1003). Which flag to set to 1 among the plurality of search activation flags is predetermined for each flow list and can be held in the register 4 or the like.

  On the other hand, when the statistic does not exceed the registration threshold (process 1002: No), the statistic collection unit 62 determines whether the statistic is below the deletion threshold (process 1004). If the statistic is below the deletion threshold (process 1004: Yes), for example, the management software-equipped CPU 3 sets the search activation flag for the corresponding flow list in the search activation flag table 612 to 0 (process 1005).

  FIG. 17 is a flowchart showing a flow of setting the search activation flag table based on the packet rate for each input physical line. In the flowchart of FIG. 15, it is an example in case a statistic is a packet rate. As the configuration of the statistics collection unit 62, the configuration shown in FIG. 13 can be used. Details of the processing are the same as those in FIGS.

  FIG. 18 is a flowchart showing the flow of setting the search activation flag table based on the bit rate for each input physical line. In the flowchart of FIG. 15, it is an example in case a statistic is a bit rate. The configuration shown in FIG. 14 can be used as the configuration of the statistics collection unit 62. Details of the processing are the same as those in FIGS.

FIG. 22 is a flowchart showing the flow of NetFlow search activation control based on the bit rate for each input physical line when a flow list is provided for each input physical line.
For example, NetFlow can be activated for an interface having an excessive amount of traffic at the interface level (coarse level). For example, in the flowchart of FIG. 15, this corresponds to the case where the statistic is the bit rate and the search activation flag to be set is predetermined as a flag corresponding to NetFlow.

  The statistics collection unit 62 collects a bit rate for each input physical line and periodically checks the bit rate (processing 1201). The statistics collection unit 62 determines, for example, whether the bit rate exceeds the registration threshold at the rate determination unit 624 (process 1202). When the bit rate exceeds the registration threshold (processing 1202: Yes), for example, the management software-equipped CPU 3 sets the NetFlow search activation flag for the corresponding flow list in the search activation flag table 612 to 1 (processing 1203).

On the other hand, when the bit rate does not exceed the registration threshold (step 1202: No), the statistics collection unit 62 determines, for example, at the rate determination unit 624 whether the bit rate is below the deletion threshold (step 1204). If the bit rate is below the deletion threshold (step 1204: Yes), for example, the management software-equipped CPU 3 sets the NetFlow search activation flag for the corresponding flow list in the search activation flag table 612 to 0 (processing 1205).
Note that a search activation flag other than NetFlow may be set in advance. In the above example, the case where the statistic is the bit rate has been described, but the packet rate may be used as described above.

FIG. 23 is a flowchart showing the flow of flow mirror search activation control based on the bit rate for each flow by NetFlow.
As a statistic, information collected by NetFlow may be used in addition to the packet rate obtained by the statistic collecting unit 62 as described above. For example, a flow mirror search activation flag is set based on the bit rate for each flow collected by NetFlow. In this example, the NetFlow function is operating in the packet transfer apparatus 1. NetFlow may operate for all interfaces regardless of the search activation flag, or the search activation flag may be set based on the packet rate or the like by the statistics collection unit 62 as described above.

First, for example, the flow processing RAM control unit 615 statistically collects the bit rate for each flow using NetFlow, and periodically checks the bit rate (processing 1301).
The flow processing RAM control unit 615 includes, for example, a rate determination unit and a timer similar to the rate determination unit 624 and the timer 623 in FIG. In response to a trigger periodically output from the timer, the rate determination unit refers to the NetFlow area 6160 of the flow processing RAM 616 to acquire the number of bytes for rate calculation and obtain the bit rate.

  FIG. 24 shows an example of a flow processing entry for collecting statistics of the bit rate for each flow in the NetFlow area 6161 of the flow processing RAM 616. The NetFlow area 6161 of the flow processing RAM 616 includes, for example, a rate calculation byte number, a cumulative byte number, a cumulative TCP flag, and a destination analyzer port. The packet length (number of bytes) is added to the rate calculation byte count and the cumulative byte count when a corresponding flow is searched. The number of bytes for rate calculation is reset every time it is read by the flow processing RAM control unit 615. The cumulative TCP flag and the destination analyzer port are the same as described above.

  Returning to FIG. 23, the description of the flowchart will be continued. The flow processing RAM control unit 615 determines whether the bit rate exceeds the registration threshold (processing 1302). When the bit rate exceeds the registration threshold (processing 1302: Yes), for example, the management software CPU 3 sets the flow mirror search activation flag for the corresponding flow list in the search activation flag table 612 to 1 (processing 1303). For example, similar to the rate determination unit 624 illustrated in FIG. 13, the flow processing RAM control unit 615 writes information indicating that the threshold is exceeded in the register 4 when the bit rate exceeds the registration threshold. The management software CPU 3 periodically refers to the register 4 and sets the flow mirror search activation flag to 1 for the corresponding flow list in the search activation flag table 612 when information indicating that the threshold is exceeded is registered.

On the other hand, when the bit rate does not exceed the registration threshold (processing 1302: No), the flow processing RAM control unit 615 determines whether the bit rate is below the deletion threshold (processing 1304). When the bit rate is below the deletion threshold (processing 1304: Yes), for example, the management software-equipped CPU 3 sets the flow mirror search activation flag for the corresponding flow list in the search activation flag table 612 to 0 (processing 1305).
Note that the processing of the flow processing RAM control unit 615 described above may be executed by another appropriate processing unit or control unit.

  FIG. 25 shows a user interface setting example for enabling the function of registering a NetFlow flow entry based on the packet statistics of this embodiment for all flow lists (all physical lines or logical lines). is there.

  FIG. 26 shows a user interface that enables the function of registering the flow mirror flow entry for the input physical line 0, the input physical line 3, and the output physical line 1 based on the packet statistics of the present embodiment. It is an example of setting.

3. Third Embodiment In the above-described embodiment, the search activation flag table 612 has a search activation flag for each of a plurality of functions such as a filter function, but one search activation flag may be used. When the search activation flag is 1, the flow search may be executed for all of the plurality of functions, or the search activation flag may be set only for a specific function.

  In this case, the search activation flag table 612 may store a flow list identifier and a search activation flag indicating whether or not to execute a flow search. For example, if the packet statistics for each input physical line exceeds the registration threshold, the search activation flag is set to 1 and the flow search of the flow search CAM 614 is executed, while the packet statistics for each input physical line is the deletion threshold. If the value is less than, the search activation flag may be set to 0 and the flow search of the flow search CAM 614 may not be executed.

  The operation of the flow search unit 61 is the same as described above. However, the search start determination unit 610 receives the request via the search start flag table control unit 611. Based on the flow list to which the received packet belongs, the search activation flag table 612 is referred to, and it is determined whether to execute the flow search according to the corresponding search activation flag.

The flow search unit 61 executes the flow search for the flow search CAM 614 when it is determined to execute the flow search according to the determination result of the search activation determination unit 610. For example, the flow search CAM control unit 613 searches the flow search CAM 614 using one or more pieces of information in the received packet header information as a search key, and executes a flow search for identifying the flow to which the packet belongs. On the other hand, if it is determined not to execute the flow search, the flow search for the flow search CAM 614 is not executed.
In addition, when RAM is used instead of using the flow search CAM 614 and a RAM tree search or the like is performed, an unnecessary search is turned off (search start flag is set to 0) to stop the CAM search. Reduction can be realized.

4). Fourth Embodiment FIG. 27 is a configuration diagram of a packet transfer apparatus and an external management apparatus of the present invention connected by a network.
A packet transfer apparatus management method for controlling the setting of the search activation flag table by the external management apparatus 10 connected via the network will be described.

  In the above-described embodiments, the functions of the rate determination unit 624 and the timer 623 of the statistics collection unit 62 may be provided outside the packet transfer apparatus 1. For example, the external management apparatus 10 has functions of a rate determination unit 624 and a timer 623 of the statistics collection unit 62.

  The packet transfer device 1 obtains the statistics of the received packet or the statistics of the packet to be transmitted, and transmits it to the external management device 10. The external management device 10 determines whether the statistics of the packet transmitted from the packet transfer device 1 exceeds a predetermined registration threshold or the statistics of the packet falls below a predetermined deletion threshold. Determine whether registration or deletion is necessary. The external management device 10 transmits to the packet transfer device 1 setting control information indicating whether flow entry registration or deletion is necessary.

  When the setting control information transmitted from the external management apparatus 10 indicates that registration of a flow entry is necessary, the packet transfer apparatus 1 registers a flow entry for a flow search and sets a flag in the search activation flag table. Registered. Further, when the setting control information transmitted from the external management device 10 indicates that registration of the flow entry is necessary, the packet transfer apparatus 1 deletes the flow entry for the flow search, and stores the search start flag table. No flag is registered. The packet transfer apparatus 1 refers to the flag of the search activation table and executes the flow search for the input packet when the flag indicates that there is registration, and does not execute the flow search when the flag indicates that there is no registration.

5. Configuration Example of Packet Transfer Device A packet transfer device is a packet transfer device that is connected to a plurality of input lines and output lines and transfers packets received from the input lines to one of the output lines specified by the header information. And
When a packet is received, a flow search unit that performs a flow search that identifies a flow to which the packet belongs using at least one piece of information of header information as a search key;
A flow processing unit that performs a process specified in advance for each flow specified by the flow search on the packet;
In the flow search unit, a flow list that can set multiple flow entries that define a flow,
It has a search activation flag table that describes whether or not a flow entry is registered for each flow list.
When a packet is received, the search activation flag table is referenced to determine whether there is a flow entry in the flow list to which the packet belongs. When it is determined that there is a flow entry, flow search is activated and it is determined that there is no flow entry. In this case, the flow search is stopped.

Further, the packet transfer apparatus may use CAM (Content Addressable Memory) as a search device used for flow search.
The packet transfer apparatus may include a flow list for each input physical line, for each input logical line, for each output physical line, or for each output logical line.

  The packet transfer apparatus further includes a statistics collection unit that collects statistics of received packets or statistics of packets to be transmitted, and the statistics of packets for each input physical line are provided for each flow list provided for each input physical line. When the pre-specified registration threshold is exceeded, or when the packet statistics for each input logical line exceeds the pre-registered registration threshold for each flow list provided for each input logical line, or for each output physical line When the packet statistic exceeds the registration threshold specified in advance for each flow list provided for each output physical line, or the packet statistic for each output logical line is set in advance for each flow list provided for each output logical line. If the specified registration threshold is exceeded, the flow entry may be registered in the flow list and the flag in the search activation flag table may be registered.

  The packet transfer apparatus further includes a statistics collection unit that measures a received packet statistic or a transmitted packet statistic, and a packet statistic for each input physical line is provided for each flow list provided for each input physical line. When the deletion threshold value is lower than a predetermined threshold value, or when the statistics of the packet for each input logical line is lower than the deletion threshold value specified for each flow list provided for each input logical line, or for each output physical line If the statistics of the packet are below the deletion threshold specified in advance for each flow list provided for each output physical line, or if the statistics of the packet for each output logical line are provided in advance for each flow list provided for each output logical line If it falls below the specified deletion threshold, the flow entry may be deleted from the flow list and the search activation flag table flag may not be registered.

The packet statistics described above may be a packet rate or a bit rate.
In the above-described packet transfer apparatus, the processing performed by the flow processing unit may be a flow monitoring function of collecting statistics for each flow or mirroring packets for each flow.
Further, the above-described packet transfer apparatus may be provided with a user interface for setting the validity / invalidity of the function of registering / deleting a flow entry based on the packet statistics.

In this packet transfer device management method, the packet transfer device transmits the statistics of the received packet or the statistics of the packet to be transmitted to the external management device,
The external management device determines whether it is necessary to register or delete the flow entry based on information including the statistics of the packet transmitted from the packet transfer device,
The external management device transmits setting control information indicating whether registration or deletion of the flow entry is necessary to the packet transfer device,
The packet transfer device registers the flow entry in the flow list when the setting control information transmitted from the external management device indicates that the flow entry needs to be registered, and sets the flag of the search activation flag table as registered,
When the setting control information transmitted from the external management apparatus indicates that the flow entry needs to be registered, the flow entry is deleted from the flow list, and the flag in the search activation flag table is not registered.

  The present invention can be used, for example, in a packet transfer device that searches for a flow.

DESCRIPTION OF SYMBOLS 1 ... Packet transfer apparatus 2 ... Management terminal 3 ... CPU with management software
4... Register 5... Packet reception circuit 6... Reception side packet search unit 7... Switch 8. Device 11 ... Network 60 ... Route search unit 61 ... Flow search unit 62 ... Statistic collection unit 610 ... Search activation determination unit 611 ... Search activation flag table control unit 612 ... Search Activation flag table 613 ... Flow search CAM control unit 614 ... Flow search CAM
615: Flow processing RAM control unit 616: Flow processing RAM
6140 Block 0 of flow search CAM
6141: Block 1 of flow search CAM
6142 ... Block 2 of the flow search CAM
6143: Flow search CAM block 3
6144: Flow search CAM block 4
6145: Block 5 of the flow search CAM
6146: Block 6 of the flow search CAM
6147: Block 7 of the flow search CAM
6140-1 ... Flow entry 6140-2 registered in block 0 of flow search CAM ... Flow entry 6140-3 registered in block 0 of flow search CAM ... Registered in block 0 of flow search CAM Flow entry 6140-4 ... Flow entry 6140-5 registered in block 0 of flow search CAM ... Flow entry 6140-6 registered in block 0 of flow search CAM ... Flow entry 6160 registered in block 0... Area 0 (filter area) of flow processing RAM 616
6160-1... Filter processing entry (discard) registered in area 0 of the flow processing RAM 616
6160-2... Flow process entry for filter (pass) registered in area 0 of the flow process RAM 616
6160-n... Flow processing entry for filter registered in area 0 of flow processing RAM 616 (discard)
6161: Area 1 of the flow processing RAM 616 (NetFlow area)
6161-1... NetFlow flow processing entry 6161-2 registered in area 1 of flow processing RAM 616. NetFlow flow processing entry 6161-n registered in area 1 of flow processing RAM 616. NetFlow flow processing entry 6162 registered in area 1 of RAM 616... Area 2 (QoS area) of flow processing RAM 616
6162-1 ... QoS flow process entry registered in area 2 of the flow process RAM 616 (priority level 1)
6162-2 ... QoS flow process entry registered in area 2 of flow process RAM 616 (priority level 2)
6162-n ... QoS flow processing entry (priority n) registered in area 2 of the flow processing RAM 616.
6163: Area 3 (flow mirror area) of the flow processing RAM 616
6163-1 Flow process entry for flow mirror registered in area 3 of flow process RAM 616 6163-2 Flow process entry for flow mirror 6163-n registered in area 3 of flow process RAM 616 Flow processing entry 620 for the flow mirror registered in the area 3 of the flow processing RAM 616... Packet counter calculation unit 621... Statistical RAM control unit 622.
623 ... Timer 624 ... Rate determination unit 625 ... Byte counter calculation unit

Claims (14)

A packet transfer apparatus that is connected to a plurality of input lines and a plurality of output lines, and that transmits a packet received from the input line to an output line specified based on header information,
A flow search memory having a plurality of blocks;
A flow search control unit that searches a predetermined block of the flow search memory using one or more pieces of information of received header information of a packet as a search key and identifies a flow to which the packet belongs;
A flow processing unit that executes a predetermined process for each flow according to the identified flow;
A search start table in which a plurality of search start information corresponding to a plurality of blocks of the flow search memory and corresponding to a plurality of search start information for specifying a search target block among the plurality of blocks are stored correspondingly.
A search activation determination unit that refers to the search activation table based on a flow list to which the received packet belongs, and specifies a block of the flow search memory to be searched according to corresponding search activation information;
The flow search control unit
A packet transfer device that executes the flow search on the block of the flow search memory specified by the search activation determination unit.   The packet transfer device according to claim 1, wherein when the search activation information indicates that there is no block to be searched, the flow search is not performed on the flow search memory. A statistics collection unit that obtains the statistics of received packets or transmitted packets for each flow list; and
When the statistic obtained by the statistic collecting unit exceeds a predetermined registration threshold, a predetermined search activation information among a plurality of search activation information corresponding to the corresponding flow list in the search activation table, The packet transfer apparatus according to claim 1, further comprising a management unit configured to set a search target. A packet transfer apparatus that is connected to a plurality of input lines and a plurality of output lines, and that transmits a packet received from the input line to an output line specified based on header information,
A flow search memory for identifying the flow to which the packet belongs based on the header information of the packet;
A flow search control unit that searches the flow search memory using one or more pieces of information of received packet header information as a search key and executes a flow search for identifying a flow to which the packet belongs;
A flow processing unit that executes a predetermined process for each flow according to the identified flow;
A search activation table storing a flow list identifier and search activation information indicating whether to execute the flow search;
A statistics collection unit that obtains the statistics of received packets or transmitted packets for each flow list; and
Management in which search activation information corresponding to a corresponding flow list in the search activation table is set to execute the flow search when the statistic obtained by the statistics collection unit exceeds a predetermined registration threshold And
A search activation determination unit that refers to the search activation table based on a flow list to which the received packet belongs, and determines whether to execute a flow search according to corresponding search activation information;
The flow search control unit executes the flow search for the flow search memory when it is determined to execute a flow search according to the determination result of the search activation determination unit, and when it is determined not to execute the flow search, The packet transfer apparatus that does not perform flow search.   The management unit sets the search activation information of the search activation table not to execute the flow search when the statistic obtained by the statistics collection unit is lower than a predetermined deletion threshold. The packet transfer apparatus described.   5. The packet transfer apparatus according to claim 4, wherein a CAM (Content Addressable Memory) is used as the flow search memory.   The packet transfer apparatus according to claim 4, wherein the flow list corresponds to any one of an input physical line, an input logical line, an output physical line, and an output logical line. The statistics collection unit, for received packets or transmitted packets, packet statistics for each input physical line, packet statistics for each input logical line, packets statistics for each output line, and each output logical line Find one of the packet statistics for
The management unit
If the statistics of the packets for each input physical line exceed the registration threshold specified in advance for each flow list corresponding to the input physical line, or (* Threshold specification description supported)
When the statistics of the packet for each input logical line exceeds the registration threshold specified in advance for each flow list corresponding to the input logical line, or
When the statistics of the packet for each output physical line exceeds the registration threshold specified in advance for each flow list corresponding to the output physical line, or
If the statistics of the packet for each output logical line exceeds the registration threshold specified in advance for each flow list corresponding to the output logical line,
The packet transfer apparatus according to claim 4, wherein search activation information corresponding to a corresponding flow list in the search activation table is set. The statistics collection unit, for received packets or transmitted packets, packet statistics for each input physical line, packet statistics for each input logical line, packets statistics for each output line, and each output logical line Find one of the packet statistics for
The management unit
When the statistics of the packet for each input physical line is below the deletion threshold specified in advance for each flow list corresponding to the input physical line, or
If the statistics of the packet for each input logical line is below the deletion threshold specified in advance for each flow list corresponding to the input logical line, or
When the statistics of the packet for each output physical line is lower than the deletion threshold specified in advance for each flow list corresponding to the output physical line, or
If the statistics of the packet for each output logical line is below the deletion threshold specified in advance for each flow list corresponding to the output logical line,
The packet transfer apparatus according to claim 4, wherein search activation information corresponding to a corresponding flow list is deleted from the search activation table.   The packet transfer apparatus according to claim 4, wherein the statistical amount of the packet is a packet rate or a bit rate.   The packet transfer apparatus according to claim 4, wherein the process executed by the flow processing unit is a flow monitor function including collecting statistics for each flow or mirroring a packet for each flow. 5. The packet transfer apparatus according to claim 4, further comprising a user interface for setting whether to enable or disable a flow entry registration or deletion function based on packet statistics. It has a search start table in which a flag indicating whether a flow entry is registered or not registered is set. When the flag indicates that there is a registration, a flow search is performed for the input packet. When the flag indicates that there is no registration, a flow search is performed. A packet transfer device that does not execute
A packet transfer device management system comprising an external management device for managing the packet transfer device,
The packet transfer device obtains the statistics of the packet to be received or the statistics of the packet to be transmitted and transmits it to the external management device,
The external management device determines whether the statistic of the packet transmitted from the packet transfer device exceeds a predetermined registration threshold or the statistical value of the packet falls below a predetermined deletion threshold. Determine whether registration or deletion is necessary,
The external management device transmits setting control information indicating whether registration or deletion of a flow entry is necessary to the packet transfer device,
The packet transfer device registers a flow entry for a flow search when the setting control information transmitted from the external management device indicates that a flow entry needs to be registered, and sets a flag in the search activation flag table. If it is registered and the setting control information transmitted from the external management device indicates that the flow entry needs to be registered, the flow entry for the flow search is deleted and the flag of the search activation flag table is not registered Packet transfer device management system. The packet transfer device obtains the statistics of the received packet or the statistics of the packet to be transmitted and sends it to the external management device.
The external management device can register a flow entry when the statistic of the packet transmitted from the packet transfer device exceeds a predetermined registration threshold value or the statistic of the packet falls below a predetermined deletion threshold value. Determine whether it needs to be deleted,
The external management device transmits setting control information indicating whether registration or deletion of the flow entry is necessary to the packet transfer device,
When the setting control information transmitted from the external management device indicates that the flow entry needs to be registered, the packet transfer device registers the flow entry for the flow search and registers the flag of the search activation flag table When the setting control information transmitted from the external management device indicates that registration of the flow entry is necessary, the flow entry for the flow search is deleted, and the flag of the search activation flag table is not registered.
The packet transfer apparatus refers to the flag of the search start table, and executes a flow search for an input packet when the flag indicates that there is registration, and does not execute a flow search when the flag indicates that there is no registration .

Images