JP3711895B2 - Search system, search condition CAM registration method used therefor, and program thereof - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a search system, a search condition CAM registration method used therefor, and a program therefor, and more particularly, to a search condition registration method in a CAM (Content-Addressable Memory) used in a router apparatus.
[0002]
[Prior art]
In recent years, in a router device, in order to improve transfer processing performance, the number of cases in which a CAM is used in a search system is increasing, and some entries in a transfer table managed by a CPU (central processing unit) are cached in the CAM. Thus, processing for improving the overall processing performance is performed.
[0003]
When filtering processing is performed with such a router device, it is considered that the use of CAM reduces the load on the entire device and improves the performance. Here, filtering is a process for determining whether a received packet is allowed to pass or discarded based on a preset condition (filtering condition).
[0004]
As filtering conditions, IP (Internet Protocol) addresses and TCP / UDP (Transmission Control Protocol / User Datagram Protocol) port number range designation (lower limit and upper limit) may be set.
[0005]
[Problems to be solved by the invention]
In the conventional search system described above, in order to register the filtering condition as a cache in the CAM, individual elements included in the range are registered in the CAM as separate entries.
[0006]
However, when the range of filtering conditions is widened, the number of entries to be registered increases. As a result, the search hit rate decreases, and the number of transfer table searches by the CPU and the number of registrations to the CAM increase. There is a problem of lowering.
[0007]
Accordingly, an object of the present invention is to solve the above problems, register a search hit condition with a small number of entries, and improve a search performance, a search condition CAM registration method used therefor, and a program therefor Is to provide.
[0008]
[Means for Solving the Problems]
The search system according to the present invention is a search system in which a search hit condition specified as a range is registered as an entry in a CAM (Content-Addressable Memory), and a flow identifier corresponding to packet header information is searched using the CAM entry. The search hit condition specified by the range is divided into two or more and less than the number of ports, and is registered in the CAM .
[0009]
The search condition CAM registration method according to the present invention uses a search hit condition specified as a range as an entry for a search system that uses a CAM (Content-Addressable Memory) entry to search for a flow identifier corresponding to packet header information. The search condition CAM registration method for registering to the registration method includes the step of dividing the search hit condition specified in the range into two or more and less than the number of ports and registering it in the CAM.
[0010]
The search condition CAM registration method program according to the present invention includes a search system that searches for a flow identifier corresponding to packet header information using a CAM (Content-Addressable Memory) entry, and enters a search hit condition specified as a range. A search condition CAM registration method program for registering in the CAM as follows: A computer causes a computer to execute a step of dividing the search hit condition specified in the range into two or more and less than the number of ports and registering the entry in the CAM. It is the program for this.
[0011]
That is, according to the search condition CAM registration method of the present invention, when registering a range designation entry in the search hit condition to the CAM (Content-Addressable Memory), the CAM mask function (Don't Care function) [search hit information information] Is a function for performing a search after masking with mask information, and any value can be used for the masked part (Don't Care)], so that the range can be reduced at a time with a small number of entries. It becomes possible to register all the search conditions including.
[0012]
Therefore, by using the mask function of the CAM, it is possible to register the search hit conditions of all elements belonging to the range with a small number of entries, so that the performance of the search system can be improved.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
Next, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a search system according to an embodiment of the present invention. In FIG. 1, a search system according to an embodiment of the present invention shows a configuration example of a search system in a router device, and is a system that receives packet header information and outputs a flow identifier to which the packet belongs.
[0014]
Here, the header information is a combination of a MAC (Media Access Control) address, an IP (Internet Protocol) address, an L4 (Layer 4) port number, and the like included in the header of the received packet. The flow identifier is an identifier for specifying a forwarding process to be performed by the router device for a packet having the header information.
[0015]
The search system includes a search engine 1, a CAM (Content-Addressable Memory) 2, a small-capacity high-speed memory 3, a CPU (central processing unit) 4, a large-capacity low-speed memory 5, and a recording medium 6. The programs executed by the search engine 1 and the CPU 4 are stored in the recording medium 6.
[0016]
When the header information of the packet is input, the search engine 1 searches for a flow identifier corresponding to the header information using the CAM 2 and the small-capacity high-speed memory 3, and if the search is successful, the flow identifier obtained as a search result Is output. When the search fails, the search engine 1 performs a re-search using the CPU 4 and the large-capacity low-speed memory 5 and outputs a flow identifier obtained as a result of the search.
[0017]
The CAM 2 and the small-capacity high-speed memory 3 are high-speed and instantaneously output the search result for the search key. The CAM 2 has a mask function (Don't Care function) for performing search after masking search hit information information with mask information. In this case, the masking portion may have any value (Don 't Care).
[0018]
On the other hand, since the CPU 4 is a software process, it takes a longer time to search than the CAM 2. The large-capacity low-speed memory 5 stores correspondences between all header information handled by a router device (not shown) and flow identifiers as search entries.
[0019]
FIG. 2 is a diagram showing a specific example of a search entry stored in the large-capacity low-speed memory 5 of FIG. In FIG. 2, each entry # 21 to # 24 of the large-capacity low-speed memory 5 has a source address [“SA (Source Address) # 1”, “SA # 2”, “SA # 3”, “SA” as header information. # 4 "], destination addresses [" DA (Destination Address) # 1 "," DA # 2 "," DA # 3 "," DA # 4 "]] and destination ports (" 20 to 150 "," 5000 " ˜6000 ”,“ 100 to 200 ”,“ 10000 to 20000 ”), and corresponding flow identifiers (“ 3 ”,“ 1 ”,“ 5 ”,“ 8 ”) are stored. Note that the destination ports of the entries # 21 to # 24 are given in a range designation format such as “lower limit to upper limit”.
[0020]
FIG. 3 is a diagram showing a specific example of search entries stored in the CAM 2 and the small-capacity high-speed memory 3 shown in FIG. 3, each entry # 31 to # 36 of CAM2 includes data “SA # 3” of the source address (32 bits), mask information “1111... 1”, and data “32” of the destination address (32 bits). DA # 3 and mask information “1111... 1” and destination port (16 bit) data “00000000 01100100”, “00000000 01101000”, “00000000 01110000”, “00000000 10000000”, “00000000 11001000”, “ 00000000 11000000 ”and mask information“ 11111111 11111100 ”,“ 11111111 11111000 ”,“ 11111111 11110000 ”,“ 11111111 10000000 ”,“ 111111 11 11111111 ”and“ 11111111 11111000 ”are stored, and the flow identifier“ 5 ”is stored in each entry of the small-capacity high-speed memory 3 correspondingly.
[0021]
FIGS. 4A and 4B are diagrams showing an example of a packet configuration used in an embodiment of the present invention, and FIG. 5 is a flowchart showing an algorithm of a search system according to an embodiment of the present invention. The operation of the search system according to one embodiment of the present invention will be described with reference to FIGS. The algorithm shown in FIG. 5 is realized by the CPU 4 executing the program of the recording medium 6.
[0022]
When the header information is given from the search engine 1, the CPU 4 searches the large-capacity low-speed memory 5 for a search entry having the header information, and outputs a corresponding flow identifier to the search engine 1. For example, when the header information of the packet # 41 shown in FIG. 4A is given to the CPU 4, the large-capacity low-speed memory 5 searches for the entry # 23 shown in FIG. Output to.
[0023]
After searching the large-capacity low-speed memory 5, the CPU 4 registers the header information of the obtained search entry in the CAM 2 and registers the flow identifier in the small-capacity high-speed memory 3. At this time, if the range specification such as the destination port of the entry shown in FIG. 2 is included in the search hit condition, the entry divided into a plurality of entries using the algorithm shown in FIG. 5 is registered in the CAM 2. For example, when the entry # 23 shown in FIG. 2 is searched from the large-capacity low-speed memory 5, the search entry as shown in FIG. 3 is additionally registered in the CAM 2 and the small-capacity high-speed memory 3.
[0024]
CAM2 is a ternary CAM in which each entry is composed of a data entry and a mask entry. For each bit, a value of “0”, “1”, or “Don't Care” is designated as a search condition. Can do. When header information is input as a search key from the search engine 1, the CAM 2 instantly finds an entry that matches the header information and passes the address to the small-capacity high-speed memory 3.
[0025]
When the entry address is input from the CAM 2, the small-capacity high-speed memory 3 outputs the flow identifier stored at the address to the search engine 1. For example, when an entry as shown in FIG. 3 is stored in the CAM 2 and the small-capacity high-speed memory 3, and the header information of the packet # 41 shown in FIG. 33 is instantly found, and the flow identifier = 5 stored in the small-capacity high-speed memory 3 is output to the search engine 1. It is assumed that entries registered in the CAM 2 and the small-capacity high-speed memory 3 are periodically deleted from those not recently searched by the CPU 4.
[0026]
In the flowchart shown in FIG. 5, when range conditions A to B are given as search hit conditions, a plurality of data entries D [0], D [1],. . . , D [n−1], mask entries M [0], M [1],. . . , M [n−1] and the number of entries n. In the flowchart shown in FIG. 5, A, B, D [i], M [i], A ′ and B ′ are variables of fixed-length bit width, and OR, XOR, and NOT in the calculation formula are respectively for each bit. Means OR, Exclusive OR, NOT logical operation.
[0027]
In the initial state of the search system shown in FIG. 1, the large-capacity low-speed memory 5 stores the search entry shown in FIG. 2, and the CAM 2 and the small-capacity high-speed memory 3 do not store any valid entries. And
[0028]
When the router apparatus receives the packet # 41 shown in FIG. 4A and inputs the source address = SA3, the destination IP address = DA3, and the destination port = 121 as the header information to the search engine 1, the search engine 1 Inputs these header information to the CAM 2 as a search key. Since there is no corresponding entry in CAM 2 at this time, the search for CAM 2 fails, and search engine 1 inputs header information to CPU 4.
[0029]
The CPU 4 searches the large-capacity low-speed memory 5 using this header information as a search key, and obtains entry # 23 shown in FIG. The flow identifier = 5 included in the entry # 23 is transferred to the search engine 1, and the search engine 1 outputs this as the output of the search system.
[0030]
At this time, the CPU 4 registers the obtained search entry # 23 in the CAM 2 and the small-capacity high-speed memory 3, but uses the algorithm shown in FIG. 5 because the destination port is given in the range condition of [lower limit to upper limit]. Then, the range from [lower limit to upper limit] of the destination port is divided so as to be easily masked by the mask information, and a plurality of entries to be registered in the CAM 2 are obtained. Hereinafter, processing for obtaining a plurality of entries will be described.
[0031]
As the initial values, the lower limit A = 100 and the upper limit B = 200 of the range condition of entry # 23 are set. For the entry to be registered first, the lower limit is A = 100, and the upper limit A ′ = 103 is obtained by the calculation formula # a1 [A ′ ← A OR (A−1)].
[0032]
It is confirmed by conditional expression # a2 (A ′> B) that the upper limit A ′ = 103 is not more than the final upper limit B = 200, and the calculation formula # a3 [D [n] ← A, M [n] ← NOT (A XOR A ′)] determines data entry D [0] = 100 = 00000000,01100100 (binary) and mask entry M [0] = 11111111,11111100 (binary) (entries shown in FIG. 3) # 31). This entry hits a search key whose destination port is 100 to 103.
[0033]
In the second entry, the lower limit A = 104 is obtained from the calculation formula # a4 (n ← n + 1, A ← A ′ + 1), and the upper limit A ′ = 111 is obtained from the calculation formula # a1. It is confirmed by conditional expression # a2 that the upper limit A ′ = 111 is the final upper limit B = 200 or less, and the data entry D [1] = 104 = 00000000,01101000 (binary) and mask by the calculation expression # a3 Entries M [1] = 11111111 and 11111000 (binary) are obtained (entry # 32 shown in FIG. 3). This entry hits a search key whose destination port is 104-111.
[0034]
For the third entry, the lower limit A = 112 is obtained from the calculation formula # a4, and the upper limit A ′ = 127 is obtained from the calculation formula # a1. The conditional expression # a2 confirms that the upper limit A ′ = 127 is equal to or less than the final upper limit B = 200, and the data entry D [2] = 112 = 00000000,01110000 (binary) and the mask by the calculation formula # a3 Entry M [2] = 11111111, 11110000 (binary) is obtained (entry # 33 shown in FIG. 3). This entry hits a search key whose destination port is 112-127.
[0035]
For the fourth entry, the lower limit A = 128 is obtained from the calculation formula # a4, and the upper limit A ′ = 191 is obtained from the calculation formula # a1. It is confirmed by conditional expression # a2 that upper limit A ′ = 191 is final upper limit B = 200 or less, and data entry D [3] = 128 = 00000000,10000000 (binary) and mask by calculation expression # a3 Entry M [3] = 11111111,10000000 (binary) is obtained (entry # 34 shown in FIG. 3). This entry hits a search key whose destination port is 128-191.
[0036]
For the fifth entry, the lower limit A = 192 is obtained from the calculation formula # a4, and the upper limit A ′ = 255 is obtained from the calculation formula # a1. However, since the conditional expression # a2 confirms that the upper limit A ′ = 255 exceeds the final upper limit B = 200, the calculation of the data entry and the mask entry is not performed, and the process proceeds to # b1 and the rest Find an entry whose destination port hits the search key from the lower limit A = 192 to the upper limit B = 200.
[0037]
The fifth entry has an upper limit B = 200, and a lower limit B ′ = 200 is obtained by the calculation formula # b1 [B ′ ← B AND NOT (NOT (B) −1)]. It is confirmed by conditional expression # b2 (A> B ′) that the lower limit B ′ = 200 is equal to or greater than A = 192, and calculation formula # b3 [D [n] ← B ′, M [n] ← NOT (B XOR B ′)] determines data entry D [4] = 200 = 00000000, 11001000 (binary) and mask entry M [4] = 11111111, 11111111 (binary) (entry # 35 shown in FIG. 3). . This entry hits a search key whose destination port is 200.
[0038]
In the sixth entry, the upper limit B = 199 is obtained by the calculation formula # b4 (n ← n + 1, B ← B′−1), and the lower limit B ′ = 192 is obtained by the calculation formula # b1. It is confirmed by conditional expression # b2 that the lower limit B ′ = 192 is equal to or greater than A = 192, and data entry D [5] = 192 = 00000000, 11000000 (binary) and mask entry M [5 by calculation expression # b3 ] = 11111111 and 11111000 (binary) are obtained (entry # 36 shown in FIG. 3). This entry hits a search key whose destination port is 192 to 199.
[0039]
In the seventh entry, the upper limit B = 191 and the lower limit B ′ = 128 are obtained by the calculation formula # b4. However, since the lower limit B ′ = 128 is less than A = 192 by the conditional expression # b2, the processing ends here. To do.
[0040]
Through the above processing, data entries D [0], D [1],... To be registered in the destination port field of CAM2 shown in FIG. . . , D [5] and mask entries M [0], M [1],. . . , M [5]. Using these, the CPU 4 performs entry registration in the CAM 2 and the small-capacity high-speed memory 3 as shown in FIG. 3, and ends the processing relating to the packet # 41.
[0041]
When the router device receives the packet # 42 shown in FIG. 4B following the packet # 41, the source address = SA3, the destination address = DA3, and the destination port = 153 are input to the search engine 1 as header information thereof. The search engine 1 inputs it to the CAM 2 as a search key.
[0042]
The entry shown in FIG. 3 is already registered in CAM2, and the input header information hits entry # 34. The search engine 1 receives the corresponding flow identifier = 5 from the small-capacity high-speed memory 3 and uses it as the output of the search system.
[0043]
In this way, when a packet belonging to the same search entry is received again, the entry already exists in the CAM 2 and the small-capacity high-speed memory 3, so that low-speed search processing by the CPU 4 and the large-capacity low-speed memory 5 is not required. The corresponding flow identifier can be obtained in a very short time.
[0044]
When registering a search entry whose range is included in the search hit condition in CAM2, conventionally, since an entry is registered for each element belonging to the range, the number of entries to be registered in CAM2 increases. It will lead to performance degradation.
[0045]
In contrast, in the present invention, by using the CAM2 mask function (Don't Care function), the search hit conditions of all elements belonging to the range can be registered with a small number of entries, and the performance of the search system can be improved. Can be improved.
[0046]
As described above, since many search hit conditions can be registered by one CAM2, the search performance per CAM2 can be improved. In addition, since the number of CAM2 entries required to obtain desired performance can be reduced, cost and power consumption can be reduced.
[0047]
Furthermore, the number of entry registrations to the CAM 2 is reduced, and the load on the CPU 4 can be reduced. Furthermore, since the search hit rate of CAM2 increases, the number of entry registrations from the CPU 4 to the CAM 2 decreases, and the load on the CPU 4 can be reduced.
[0048]
In the method for registering search conditions in the CAM 2 according to the above-described embodiment of the present invention, the effect becomes greater as compared with the conventional method for registering the search conditions in the CAM 2 as the difference between the upper limit and the lower limit of the range is particularly large. .
[0049]
In the above description, the header information is divided into only the destination ports specified in the range, a plurality of entries are obtained, and the plurality of entries are registered in the CAM 2 at the same time. When the range of the original address and the destination address is also specified, it can be registered in the CAM 2 by the same method as described above.
[0050]
【The invention's effect】
As described above, according to the present invention, in a search system for registering an entry including a search hit condition specified for a range in the CAM and searching for a flow identifier corresponding to the header information of the packet, the range specified search in the entry By dividing the hit condition into a plurality of parts using a predetermined algorithm and registering it in the CAM, the search hit condition can be registered with a small number of entries, and the search performance can be improved.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a search system according to an embodiment of the present invention.
2 is a diagram showing a specific example of a search entry stored in the large-capacity low-speed memory of FIG. 1. FIG.
FIG. 3 is a diagram showing a specific example of search entries stored in the CAM and the small-capacity high-speed memory shown in FIG. 1;
FIGS. 4A and 4B are diagrams showing a configuration example of a packet used in an embodiment of the present invention.
FIG. 5 is a flowchart illustrating an algorithm of a search system according to an embodiment of the present invention.
[Explanation of symbols]
1 Search engine 2 CAM
3 Small-capacity high-speed memory 4 CPU
5 Large-capacity low-speed memory 6 Recording medium

Claims (10)

A search system for registering a search hit condition specified in a range as an entry in a CAM (Content-Addressable Memory) and searching for a flow identifier corresponding to packet header information using the CAM entry,
A search system comprising: means for dividing the search hit condition specified in the range into entries of 2 or more and less than the number of ports and registering them in the CAM . The entry registered in the CAM stores a data entry that represents the lower limit port number in the entry and a mask entry that defines the upper limit port number of the entry when used together with the data entry. The search system according to claim 1, wherein: Entries registered before Symbol CAM is search system according to claim 1 or 2, characterized in that so as to store at least the source address and destination address and destination port of said header information. A search system for registering a search hit condition specified in a range as an entry in a CAM (Content-Addressable Memory) and searching for a flow identifier corresponding to packet header information using the CAM entry,
  The search hit condition specified by the range is divided into entries of 2 or more and less than the number of ports by combining the division performed from the lower limit to the upper limit and the division performed from the upper limit to the lower limit, and is registered in the CAM. A search system comprising means. This is a search condition CAM registration method for registering a search hit condition specified as a range in the CAM as an entry for a search system that searches for a flow identifier corresponding to packet header information using a CAM (Content-Addressable Memory) entry. hand,
  A search condition CAM registration method comprising a step of registering the search hit condition specified in the range into entries of 2 or more and less than the number of ports and registering the entry in the CAM. The entry registered in the CAM stores a data entry that represents the lower limit port number in the entry and a mask entry that defines the upper limit port number of the entry when used together with the data entry. The search condition CAM registration method according to claim 5, wherein: 7. The search condition CAM registration according to claim 5 or 6, wherein the entry registered in the CAM stores at least a transmission source address, a destination address, and a destination port in the header information. Method. A search condition CAM registration method for registering a search hit condition specified as a range in a CAM (Content-Addressable Memory) as an entry for a search system that searches for a flow identifier corresponding to packet header information using the CAM entry. There,
  The search hit condition specified by the range is divided into entries of 2 or more and less than the number of ports by combining the division performed from the lower limit to the upper limit and the division performed from the upper limit to the lower limit, and is registered in the CAM. The search condition CAM registration method characterized by the above-mentioned. A search condition CAM registration method for registering a search hit condition specified as a range in a CAM (Content-Addressable Memory) as an entry for a search system that searches for a flow identifier corresponding to packet header information using the CAM entry. There,
  The range-specified search hit condition includes a division step for performing from the lower limit toward the upper limit, and a division step for performing from the upper limit toward the lower limit,
  In the division step performed from the lower limit toward the upper limit, the given lower limit value is set as the data entry of the entry, and the first is seen from the least significant bit of the lower limit value of the entry. 1 All the bits until 1 Is calculated as an upper limit value in the entry, and an entry having a mask value corresponding to the upper limit value of the entry as a mask entry of the entry is created and registered as an entry in the CAM. Update to the upper limit plus one, A split entry generation step in the split performed from the lower limit toward the upper limit;
  In the division step performed from the upper limit toward the lower limit, the given upper limit value is set as the upper limit value of the entry, and all bits until 0 appears first when viewed from the least significant bit of the lower limit value of the entry are set to 1. The replaced entry is a data entry in the entry, an entry having a mask value corresponding to the upper limit value of the entry as a mask entry of the entry is created, registered as an entry in the CAM, and the upper limit value is determined from the lower limit value. A division entry generation step of division performed from the upper limit to the lower limit, which is updated to a value obtained by subtracting 1;
  The division entry generation step of division performed from the lower limit toward the upper limit is repeatedly executed until it becomes larger than the upper limit value given by the range designation calculated in the step,
  The search condition CAM registration method, wherein the division entry generation step of division performed from the limit toward the lower limit is repeatedly performed until the division entry generation step is smaller than a lower limit value given by the range specification calculated in the step. A search condition CAM registration method program for registering a search hit condition specified as a range in the CAM as an entry for a search system that searches a flow identifier corresponding to packet header information using a CAM (Content-Addressable Memory) entry Because
  A program for causing a computer to execute a step of dividing the search hit condition specified in the range into two or more and less than the number of ports and registering it in the CAM.

Images