KR20020055283A - Internet protocol routing block method for ethernet switch - Google Patents

Abstract

PURPOSE: An Internet protocol routing block method in an Ethernet switch is provided to compare a domain address of the received IP(Internet Protocol) packet with an IP address of a system, thereby determining the connection or interruption. CONSTITUTION: A routing flag relating to the allowance or interruption of communication between an another domain or a virtual LAN(Local Area Network) is previously set(S20). When a setup process is completed and then a packet of an IP is received(S21), it is discriminated whether the routing flag is set to the packet as allowance or interruption(S22). If the routing flag is set as the allowance, a process is performed within the system(S24) and if the routing flag is set as the interruption, it is discriminated whether the IP address of the reception area is the same as the system IP address(S23). If the IP address of the reception area is the same as the system IP address, a process is performed within the system(S24). If the IP address of the reception area is not the same as the system IP address, the received packet is deleted and returned to the initial process(S25).

Description

INTERNET PROTOCOL ROUTING BLOCK METHOD FOR ETHERNET SWITCH}

The present invention relates to an Internet protocol routing block method in an Ethernet switch, and more particularly, to an Ethernet switch configured to connect or block communication between another Internet Protocol Domain or a virtual local area network (VLAN) in an Ethernet switch. An internet protocol routing block method is provided.

In the related art, in order to control communication between different IP domains or virtual local area networks, an IP filtering function is used for an IP routing function such as an IP router (or an Ethernet switch).

The IP filtering function is configured to filter each IP packet using various methods, and for each set case, the IP filtering function is analyzed according to the set value for filtering all packets passing through the Ethernet switch. Process the IP packet. At this time, the values set for filtering should be stored in a database or structure for filtering.

Referring to FIG. 1 attached to the operation description of the prior art, the construction of a database for filtering each packet through a menu or other management method can be arbitrarily set by the user (it can be set in various ways) ( S10).

After that, when all the packets passing through the system are analyzed and the IP packet is received (S11), it is determined whether packet filtering is performed (S12). In the case of packet filtering, the packet is processed according to a predetermined IP database (S12). S13).

However, if the result of the determination is not packet filtering, the IP packet is processed in a general manner (that is, after checking each condition according to the preset filtering method, the process is performed according to the corresponding condition, S14).

However, in the prior art as described above, the database construction for filtering IP packets is very complicated, requires an administrator knowledge of the construction of IP packets, and the overhead of filtering. It is the action or resource required for the action to achieve the desired effect, and it has the property to be kept under the proper limit, and this problem occurs in the hard disk storage, which depends on 10% of the capacity of the disk device. The smaller the time, the better the performance).

Accordingly, the present invention has been made to solve the above problems of the prior art, and provides a method for determining a connection or blocking by comparing a domain IP address of a received IP packet with an IP address of a system. have.

1 is an exemplary view showing an operation flow according to the prior art.

2 is an exemplary view showing an operation flow according to the present invention.

In order to achieve the above object, an internet protocol routing block method of an Ethernet switch of the present invention includes: a flag setting step of presetting a routing flag for allowing or blocking communication between another domain or a virtual local area network (VLAN);

A setting determination step of determining whether the routing flag is set to allow or block when the setting operation of the flag setting step is completed and an Internet Protocol (IP) packet is received;

An address verification step of performing processing in the system according to the determination result of the setting determination step or determining whether the destination IP address and the system IP address are the same;

According to the determination result of the address verification step, the processing is performed in the system, or a block performing step of deleting the received corresponding packet without processing.

Below. When described in detail with reference to the accompanying drawings an embodiment according to the present invention.

FIG. 2 is an exemplary view illustrating an operation flow according to the present invention. As shown in FIG. 2, a routing flag for allowing or blocking communication between different domains or a virtual local area network (VLAN) is set in advance (S20). Set it as follows:

Routing_Flag = 1: To allow communication between different domains

Routing_Flag = 0: to block communication between different domains

Thereafter, when the setting operation is completed and an Internet Protocol (IP) packet is received (S21), it is determined whether the routing flag is set to allow (Routing_Flag = 1) or blocking (Routing_Flag = 0) in the packet (S22).

If the result of the determination is that the routing flag is set to allow (Routing_Flag = 1), processing is performed in the system (S24). If the determination result is set to blocking (Routing_Flag = 0), the destination IP address and the system IP are set. It is determined whether the addresses are the same (S23).

As a result of this determination, the processing is performed in the system if it is the same (S24). If not, the processing returns to the first step (S22) after deleting the received corresponding packet without processing the processing (S25).

As described above, the Internet protocol routing block method of the Ethernet switch of the present invention can set whether or not communication is possible by simply changing a configuration, and does not require much knowledge from the administrator, and also provides an IP filtering function for all packets passing through the system. It is possible to minimize the load of the system regardless of the amount of traffic because it determines whether communication is possible by checking only a simple flag value without the need of packet analysis of the set value.

Claims (1)

A flag setting step of presetting a routing flag for allowing or blocking communication between another domain or a virtual local area network (VLAN); A setting determination step of determining whether the routing flag is set to allow or block when the setting operation of the flag setting step is completed and an Internet Protocol (IP) packet is received; An address verification step of performing processing in the system according to the determination result of the setting determination step or determining whether the destination IP address and the system IP address are the same; And a block performing step of performing processing in the system or deleting the received packet without processing the received packet according to the determination result of the address verification step.