WO2014183518A1

WO2014183518A1 - Method and system for realizing forwarding of data packet

Info

Publication number: WO2014183518A1
Application number: PCT/CN2014/075370
Authority: WO
Inventors: 张君辉
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-05-13
Filing date: 2014-04-15
Publication date: 2014-11-20
Also published as: CN104158745B; CN104158745A

Abstract

A method and system for realizing forwarding of a data packet. The method comprises: according to flow table information containing a threshold value range, generating threshold value range checking information, and in accordance with the generated threshold value range checking information and the flow table information, forwarding a data packet. It can be seen from the method in the embodiments of the present invention, by matching flow tables of threshold value ranges of data packets, flow aggregation is performed on the data packets according to the threshold value ranges, and flow table configuration information and flow table entries are obviously reduced, thereby reducing the computing complexity of an SDN controller, improving the flow table configuration efficiency, saving flow table hardware resources, and improving the forwarding efficiency of the data packets.

Description

Method and system for realizing data packet forwarding

Technical field

The present invention relates to a software-defined network (SDN, Software-Defined Network) architecture technology, and more particularly to a method and system for implementing packet forwarding.

Background technique

As people's demand for network performance increases, the network also exposes more and more ills. To overcome these drawbacks, many complex functions are added to the router architecture, such as open shortest path first (OSPF, Open Shortest). Path First ), Border Gateway Protocol (BGP), Multicast, Differentiated Services, Traffic Engineering, Network Address Exchange (NAT), Firewall, Multi-Protocol Label Switching, etc. This makes switching devices such as routers more and more bloated and the space for performance improvement becomes more and more.

However, in stark contrast to the dilemma of the network sector, the computer field has evolved with each passing day. Thanks to a simple and usable hardware underlying (x86 instruction set), computers have evolved rapidly in terms of software, both in applications and in operating systems. At present, many people who advocate redesigning the computer network architecture believe that: The network can replicate the success of the computer field to solve all the problems encountered by the current network. Under the guidance of this idea, the future network must be like this: The underlying data path (switch, router) is "dumb, simple, minimal," and defines a flow table (FlowTable) that is open to the outside world. a common application programming interface (API), which uses the controller to control the entire network. In this way, the researcher can freely call the underlying API to program on the controller, thus implementing the network. Innovation.

Based on the above concepts, the concept of Software Defined Network (SDN) emerged, which was originally a new network innovation architecture proposed by the Stanford University clean slate research group. At present, its core technology OpenFlow protocol, by separating the control plane of the network device from the data plane, realizes flexible control of network traffic and provides a good platform for innovation of core networks and applications. Among them, OpenFlow is a new network exchange model.

The OpenFlow protocol is used to describe the criteria used for the interaction between the controller and the switch, and Interface standard for controllers and switches. The core part of the protocol is a collection of information structures for the OpenFlow protocol.

The flow table FlowTable is used to configure the switch forwarding path. An OpenFlow switch includes one or more flow tables. FlowTable „Each flow table Each flow entry in the flow table mainly includes three parts: (1) Match Fields (Use) The ingress port, the acket header, and the metadata passed by the previous flow table FlowTable; (2) counters (Counts) for counting packets that match successfully; (3) instruction set ( Instructions ) , used to modify the Action Set or pipeline processing.

The Match Fields field is information extracted from the header of the message and used to match a flow table. The Counters field is used to manage various statistics. The Instructions field is used to perform various operations on the packet. Commands, such as discarding packets, forwarding packets to designated ports, setting packet header field values, and adding encapsulation labels. The Action Set is associated with each message. It is passed between multiple flow tables in the pipeline and modified by the instructions of each flow table until the pipeline processing ends, forming the final set of actions. Specifically, the Match Fields field includes: access interface, metadata, Ethernet source address, destination address, type, virtual local area network identifier (vlan id), vlan priority, MPLS label, MPLS traffic class (MPLS Traffic Class), IP source address , destination address, protocol, IP service type (IP ToS) bit, Transmission Control Protocol/User Data Protocol (TCP/UDP) source port number, TCP/UDP destination port number, or Control Message Protocol (ICCMP) opcode. A domain consists of a certain value or all values (ANY ), and a more accurate match can be achieved by a mask.

In packet forwarding, starting from the first flow table FlowTable, it may go through multiple flow tables, FlowTable. This process is called pipeline processing. The benefit of pipeline processing is that packets are allowed to be sent to the next stream table for further processing or metadata information to flow through the table. First, find the flow entries with the highest priority in the FlowTable FlowTable to match, that is, match the incoming port, the header, and the matching fields of the metadata specified by the previous flow table. If a packet successfully matches a flow entry in the flow table, the counter for that flow entry is updated and the instruction set operation in that flow entry is validated by the application. Pipelining ends in the instruction set without specifying the next flow table. In this case, the packet is usually forwarded by the action set it carries.

At present, the commonly used openflow matching method uses domain value and mask matching to complete the data packet. Forwarding requires more flow table configuration messages and more flow table entries, which increases management complexity and wastes valuable flow table hardware resources. Moreover, the use of masks increases the complexity of SDN controllers. . It also reduces the forwarding efficiency of data packets.

Summary of the invention

The present invention provides a method and system for implementing data packet forwarding. By matching a flow table with a range of message domain values, the computational complexity of the SDN controller can be reduced, the flow table configuration efficiency can be improved, the flow table hardware resources can be saved, and the data can be improved. Packet forwarding efficiency.

In order to solve the above technical problem, the present invention discloses a method for implementing data packet forwarding, which includes: generating domain value range check information according to flow table information including a range of domain values;

The data packet is forwarded according to the generated domain value range check information and the flow table information.

The method further includes: setting flow table information including a range of domain values; the flow table information is configured in the flow table.

The generating domain value range check information includes:

Obtaining the domain type and its range of domain values to be matched from the flow table, and setting a domain value range check table;

The domain value range checklist includes the type of domain to be checked and its corresponding range of domain values.

The forwarding the data packet according to the generated domain value range check information and the flow table information includes: determining a domain type in the range check table in the data packet, and the domain value of the domain is corresponding in the domain value range check table. The field value range check identifier of the entry is set to valid;

Carrying the domain value range check result containing the domain value range check identifier to the flow table by using the metadata;

The result of the domain value range check result in the matching metadata is matched with the key value and the mask in the flow table. If the two are consistent, the matching is successful; according to the corresponding action configured by the flow table, the data packet is forwarded.

The field value range check result is composed of a plurality of the field value range check identifiers, which are binary bit streams, and each bit corresponds to an index number of an entry of the field value range check table. The Key value and mask are determined according to the index number of the field value range check table.

The action is the set of actions specified by the Openflow specification.

The selected domain and its range of domain values are carried by the extended OpenFlow message; or, by the extensible matching type-length-value OXM TLV, the selected domain and its range of domain values are carried.

The domain corresponding to the domain value range is a domain in the matching domain of the existing flow table, or any combination of the domains.

The present invention further provides a system for implementing data packet forwarding, comprising at least a flow table processing unit, a data packet processing unit, wherein the flow table processing unit is configured to: generate a domain value range according to the flow table information including the domain value range Check information;

The packet processing unit is configured to: forward the data packet according to the generated domain value range check information and the flow table information.

The system further includes: a flow table information sending unit, configured to: configure the flow table information including the domain value range in the flow table, and send the information to the flow table processing unit.

The flow table processing unit is configured to: obtain a domain type and a range of domain values to be matched from the flow table, and set a domain value range check table; and include a domain type to be checked in the domain value range check table, and The corresponding range of domain values.

The data packet processing unit is configured to: determine, when the domain type in the range check table exists in the data packet, determine a corresponding index number of the domain value of the domain in the domain value range check table, and select an entry corresponding to the index number The domain value range check identifier is set to be valid; the metadata carrying the domain value range check result containing the domain value range check identifier is notified to the flow table; the domain value range check result in the matching metadata, and the key in the flow table The result of the Key value and the mask are the same, indicating that the domain value of the data packet is within the range; the data packet is forwarded according to the corresponding action of the flow table configuration.

The flow table information delivery unit is disposed in a software defined network SDN controller.

The flow table processing unit and the packet processing unit are disposed in an OpenFlow switch.

The technical solution of the present application includes: generating domain value range check information according to the flow table information including the domain value range, and forwarding the data packet according to the generated domain value range check information and the flow table information. It can be seen from the method of the present invention that traffic matching is performed on the data packet according to the range of the domain value by matching the flow table in the range of the value of the packet domain, thereby significantly reducing the flow table configuration message and the flow table entry, thereby reducing the SDN control. The computational complexity of the device improves the efficiency of the flow table configuration, saves the flow table hardware resources, and improves the forwarding efficiency of the data packets. BRIEF abstract

The drawings are intended to provide a further understanding of the invention, and are intended to be illustrative of the invention. In the drawing:

1 is a flowchart of a method for implementing data packet forwarding according to an embodiment of the present invention;

2 is a schematic diagram of an embodiment of an OPenFlow switch processing flow table according to the present invention;

3 is a schematic structural diagram of a system for implementing data packet forwarding according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of an embodiment of implementing packet forwarding according to the present invention. Preferred embodiment of the invention

FIG. 1 is a flowchart of a method for implementing data packet forwarding according to the present invention. As shown in FIG. 1, the method includes the following steps: Step 100: Generate domain value range check information according to flow table information including a domain value range. Before this step, the method further includes: setting flow table information including a range of domain values, and configuring the flow table information in the flow table. Specifically, the method includes: expanding an existing flow table to save a range of domain values, specifically, using an extended OpenFlow message to carry a range of domain values; or extending an extended type of value by an existing OpenFlow type (OXM TLV, The OpenFlow Extensible Match type-length-value carries the selected domain and its range of domain values, etc., and the specific implementation method is not used to limit the scope of the present invention.

According to the actual situation, select a domain or some domain and its range of domain values that need to be range checked. The selected domain can be any domain in the match field of the existing flow table or any combination of each domain. For example, vlan id, and / or TCP / UDP source port number, and / or TCP / UDP destination port number, etc.; and set the domain value range of the selected domain, that is, the upper limit of the domain value and the lower limit of the domain value.

This step generates the domain value range check information according to the flow table information including the range of the domain value. The specific information includes: obtaining the domain type and domain value range to be matched from the flow table, and setting the domain value range check table RangeTable. Include the domain to be checked in the field value range checklist, and its corresponding range of domain values The upper limit of the domain value and the lower limit of the domain value. The domain value range checklist can include multiple entries, each entry corresponding to a domain that needs to be checked and its range of domain values.

Step 101: Forward the data packet according to the generated domain value range check information and the flow table information. First, determine whether the data packet has a domain type in the range check table, and if yes, further determine the domain value of the domain in the domain value range check table, in which domain value range, and the entry The field value range check flag is set to valid as set to 1 (two mechanism bits); otherwise, the entry's field value range check flag is set to invalid if set to 0. The field value range check identifier is used to identify whether the domain value of the data packet is in the indicated item. If the domain value range check identifier is displayed as 1, it indicates that it is within the range of the entry; if the domain value range check identifier is displayed as 0, it means that it is not within the scope of the entry; and the secondary level stream composed of multiple domain value range check identifiers is the result of the domain value range check, that is, a specific value, and the field value range check result may be a certain width ( A binary bit stream corresponding to a flow table entry, each bit corresponding to an entry in the field value range checklist. It should be noted that the data packet can be checked for multiple domain value ranges at the same time.

Then, the domain value range check result is carried to the flow table by using metadata; here, when the flow table is used for packet forwarding, the flow table can only match a specific value instead of a range, and the domain value range is adopted in the present invention. The result of the check informs the flow table of the domain value range of the domain value that needs to be matched by the current data packet to be forwarded, so that the flow table corresponds to the subsequent matching processing.

Then, the data packet and the metadata enter the flow table, and the result of the domain value range check in the matching metadata, that is, the comparison field value range check result, and the result of the key (Key) value and the mask (Mask) in the flow table are matched. If the two match, the match is successful, indicating that the domain value is within the range; otherwise, the match fails and the domain value is not in the range. The Key value and the mask are determined according to the domain value range check table index number.

Finally, the data packet is forwarded according to the corresponding action of the flow table configuration. The action can be the set of actions specified by the existing openflow specification.

2 is a schematic diagram of an embodiment of an OPenFlow switch processing flow table according to the present invention. As shown in FIG. 2, it is assumed that an SDN controller sends an open flow table configuration message to an OpenFlow switch by using an extended openflow message, and specifies a certain range check or Multiple domains, their range of values, and the flow table FlowTable are configured. Assume that the domain that requires range checking is vlan id. There are two types of domain values: 1-1000 bits and 1001 -2000 bits. After the OpenFlow switch receives the flow table FlowTable, the specific processing is as follows: Generate a domain value range checklist, as shown in Table 1:

Table 1

According to the information in the flow table, two entries in Table 1 are generated. The domain of index number 2 is vlan id, and the corresponding domain value range is 1-1000. The domain of index number 3 is vlan id, and its corresponding domain value. The range is 1001-2000. The other entries in Table 1 are not examples, they can be other domains that need to be checked and their range of domain values. If you follow the OpenFlow matching method in the existing packet forwarding, you need to configure a flow table entry for each client vlan. In this way, 2000 flow table entries (upstream direction) will need to be set. However, by the method of the present invention, only Two flow table entries can be set in the uplink direction and the downlink direction respectively. The index number is used to distinguish the domain value range check identifier of the different entries. As shown in FIG. 2, the index value of the domain value range check table corresponding to the vlan id field value range 1-1000 is 2, then the domain corresponding to the entry The value range check identifies the second bit of the field value range check result value (binary bit code).

Referring to FIG. 2, when a data packet arrives, if a certain field in the data packet is in the field value range check table, the entry of the domain value range in which the domain value of the domain falls is valid, as shown in Table 1. The field value range check identifier corresponding to the entry is 1, that is, the output metadata data data position is 1; in this embodiment, the data packet is checked by the traffic of the cell 1 and the vlan id range check is performed, then the metadata metadata output is output. The bit stream is 00000010, and the valid bit 1 corresponds to entry 2.

In the flow table, the metadata metadata is matched, and the corresponding domain value range is specified by a mask: The Key value and the mask are determined according to the range check table index number. In this embodiment, the Key value may be xxxxxxlx, where X represents 0 or 1, and the mask is 00000010 (dimension, hexadecimal is 0x02), and the Key value and the mask are combined, that is, xxxxxxlx AND 0x02 The phase and the resulting result are compared with the field value range check results in the metadata. The flow table only focuses on bits with a vlan id ranging from 1-1000. Then, the mask (binary) is 00000010, and the corresponding Key value is calculated to be 00000010. When the packet vlan id is in the range of 1-1000, the packet is in the required range. Check the domain and domain value range of the packet. In the embodiment, the cell 1 user data packet with the vlan id range of 1-1000 is added with an outer layer vlan=2000 and then forwarded.

It can be seen that, by matching the flow table of the range of the packet field value, traffic aggregation is performed on the data packet according to the range of the domain value, which significantly reduces the flow table configuration message and the flow table entry, thereby reducing the computational complexity of the SDN controller. Sexuality improves the efficiency of flow table configuration, saves the flow table hardware resources, and improves the forwarding efficiency of data packets.

3 is a schematic structural diagram of a system for implementing data packet forwarding according to the present invention. As shown in FIG. 2, at least a flow table processing unit and a data packet processing unit are included.

The flow table processing unit is configured to generate the domain value range check information according to the flow table information including the domain value range.

And a data packet processing unit, configured to forward the data packet according to the generated domain value range check information and the flow table information.

The flow table processing unit and the packet processing unit may be disposed in an OpenFlow switch, such as a carrier edge router (PE), a client router (CE) device, and the like.

The system of the present invention further includes: a flow table information sending unit, configured to configure the flow table information including the domain value range in the flow table, and send the information to the flow table processing unit. The flow table information delivery unit can be set in the SDN controller.

The flow table processing unit is specifically configured to obtain a domain type and a range of domain values to be matched from the flow table, and set a domain value range check table RangeTable; include a domain type to be checked in the domain value range check table, and corresponding The range of field values is the upper limit of the field value and the lower limit of the field value.

The data packet processing unit is specifically configured to determine a domain type in the range check table in the data packet, determine a domain index of the domain value in the domain value range check table, and set a domain of the entry corresponding to the index number The value range check identifier is set to be valid; the metadata carrying the domain value range check result containing the domain value range check identifier is notified to the flow table; the domain value range check result in the matching metadata, and the key Key value in the flow table And the result of the sum of the masks, if the two are consistent, it indicates that the domain value of the data packet is within the range; the data packet is forwarded according to the corresponding action of the flow table configuration.

4 is a schematic diagram of an embodiment of implementing packet forwarding according to the present invention, and combining with a specific implementation The method of the present invention is described in detail. In Figure 4, the flow table processing part is omitted in this embodiment, which mainly describes the forwarding processing of different types of data packets by the range of domain values carried in the flow table. As shown in Figure 4,

This example uses the networking and vlan tag processing of the carrier VLAN (SVLAN) as an example. Assume that the OpenFlow switch and the SDN controller have been connected, and the SDN controller has queried the basic configuration of the switch by switching to the OpenFlow switch. Information and configure the basic parameters of the OpenFlow switch; and the controller has sent a Layer 2 Adjacent Device Probe Command message (LLDP) to the OpenFlow switch to discover the OpenFlow network topology.

Suppose there are two cells, and two cells use different clients vlan, where the vlan range of cell 1 is 1-1000, and the vlan range of cell 2 is 1001-2000. In order to isolate different cell traffic, different operators vlan tags need to be placed on the edge router (PE) of the aggregation device operator.

The SDN controller sends a flow table to the PE device and configures the OpenFlow switch forwarding channel. The upper and lower limits of the domain and domain values that require range checking are specified in the delivered flow table, such as flow table 1 and flow table 2 in Figure 4. As shown in the flow table 1 and the flow table 2, in this embodiment, the range of the vlan id needs to be checked, and the range of the vlan id is 1-1000 and 1001-2000 respectively.

On the PE device, to isolate user traffic of different cells, you need to add different carrier vlan tags to each cell. As shown in flow table 1 and flow table 2 in Figure 4, add ( ush ) to cell 1. The vlan of the layer is 2000, and the outer vlan added to the cell 2 is 2001.

If the OpenFlow matching method in the existing packet forwarding is used, a flow table entry needs to be configured for each client vlan, so that 2000 flow table entries (upstream direction) need to be set on the PE device; The vlan ids in the flow table are classified into two types according to the range of the field value. Only two flow table entries (upstream or downstream) need to be set on the PE device.

The uplink direction includes: Flow table 1: Match field = {in port 1, vlan id range 1-1000}; action = {push vlan 2000; output port 2; }; flow table 2: matching field = {in port 1, vlan Id range 1001-2000}; action = {push vlan 2001 ; output port 2; }.

The downlink direction includes: flow table 3: matching field = {in port 2, vlan id 2000}; action = {pop vlan 2000; output port 1; }; flow table 4: matching field = {in port 2, vlan id 2001 } Action = {pop vlan 2001 ; output port 1; }.

The SDN controller sends a flow table to the client router (CE7) switch, and configures OpenFlow. On the CE7 device, in the uplink direction, traffic of each cell needs to be aggregated to uplink port 3. The configured flow table is: Flow table 5: Matching field = {in port 1 }; Action = { output port 3 ; } ; Flow Table 6: Matching Field = {In Port 2}; Action = {output Port 3; }. The downlink direction includes: Flow table 7: Match field = {in port 3, vlan id range 1-1000 }; action = {output port 1; }; flow table 8: matching field = {in port 3, vlan id range 1001- 2000 } ; Action = {output port 2; }.

Then, the forwarding process of the uplink packet includes:

After the packets from the cell 1 and the cell 2 arrive at the CE7, they are processed according to the flow table 5 and the flow table 6, respectively, and then forwarded out from the port 3. Assume that the user data packet format of cell 1 is: dmac=0xl l, smac=0x22, client vlan id=100, payload=0xl 12233; the user packet format of cell 2 is: dmac=0xl l, smac=0x33, client vlan Id=l 100, payload=0x332211;

After the cell user data packet arrives at the PE device, it is processed according to flow table 1 and flow table 2, and then different outer vlans are added and forwarded from port 2. After the PE device, the user data packet format of the cell 1 is: dmac=0xl l, smac=0x22, outer vlan id=2000, payload=0xl 12233; the user data packet format of the cell 2 is: dmac=0xl l, smac =0x33, outer vlan id =2001, payload=0x332211;.

The forwarding process of the uplink packet includes:

The data packets from the BRAS server reach the PE device, and the outer vlans are 2000 and 2001 respectively; they are forwarded according to the flow table 3 and the flow table 4 respectively, wherein the traffic of the vlan2000 matches the flow table 3, and the outer vlan is stripped (pop) and Forwarded to port 1; traffic of vlan2001, after matching flow table 4, stripped outer vlan and forwarded to port 1;

Assume that the packet format sent to cell 1 is: dmac=0x22, smac=0x55, outer vlan id=2000, inner vlan id=100, payload=0x778899; The format of the packet sent to cell 2 is: dmac=0x33 , smac=0x55, eve layer vlan id=2001, inner layer vlan id=l 100, payload=0x998877. After processing by the PE device, the packet format of the cell 1 is: dmac=0x22, smac=0x55, inner layer vlan id=100, payload=0x778899; the packet format of the cell 2 is: dmac=0x33, smac=0x55, Layer vlan id=l 100, payload=0x998877.

The data packet of the BRAS server that strips the outer vlan reaches CE7 and will be forwarded according to the configured flow table 7 and flow table 8. According to the configuration of flow table 7, the traffic with the vlan range of 1-1000 will be sent to Port 1 (ie, cell 1 network), traffic with a vlan range of 1001-2000 will be sent to port 2 (ie, cell 2 network).

Of course, the present invention may have other various embodiments, such as performing matching processing based on a range of domain values of a TCP/UDP source port number and/or a destination port number, or performing matching processing based on other domain value ranges. A person skilled in the art can make various changes and modifications in accordance with the present invention without departing from the spirit and scope of the invention, but the corresponding changes and modifications should be included in the appended claims. The scope of protection.

The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

The technical solution of the present application includes: generating domain value range check information according to the flow table information including the domain value range, and forwarding the data packet according to the generated domain value range check information and the flow table information. It can be seen from the method of the present invention that traffic matching is performed on the data packet according to the domain value range by matching the flow table range of the packet domain value range, thereby significantly reducing the flow table configuration message and the flow table entry, thereby reducing the computational complexity of the SDN controller. Sexuality improves the efficiency of flow table configuration, saves the flow table hardware resources, and improves the forwarding efficiency of data packets.

Claims

Claim

A method for implementing data packet forwarding, comprising: generating domain value range check information according to flow table information including a range of domain values;

2. The method according to claim 1, wherein the method further comprises: setting flow table information including a range of domain values; the flow table information being configured in the flow table.

The method according to claim 2, wherein the generating the domain value range check information comprises: obtaining a domain type to be matched and a range of the domain value from the flow table, and setting a domain value range check table;

The method according to claim 3, wherein the forwarding the data packet according to the generated domain value range check information and the flow table information comprises: determining a domain type in a range check table in the data packet, The domain value of the domain is set to valid in the domain value range check identifier of the corresponding entry in the domain value range check table;

The method according to claim 4, wherein the field value range check result is composed of a plurality of the field value range check identifiers, which are binary bit streams, and each bit corresponds to an entry of the field value range check table. Index number.

The method according to claim 5, wherein the Key value and the mask are determined according to an index number of the field value range check table.

7. The method of claim 4, wherein the action is an action set specified by the Openflow specification.

The method according to any one of claims 2 to 7, wherein the selected domain and its domain The range of values is carried with the extended OpenFlow message; or the selected field and its range of field values are carried by the extensible matching type-length-value OXM TLV.

The method according to claim 8, wherein the domain corresponding to the domain value range is a domain in a matching domain of an existing flow table, or any combination of domains.

10. A system for implementing packet forwarding, comprising at least a flow table processing unit and a data packet processing unit; wherein

The flow table processing unit is configured to: generate domain value range check information according to the flow table information including the domain value range;

The system of claim 10, wherein the system further comprises: a flow table information sending unit, configured to: configure the flow table information including the domain value range in the flow table, and send the information to the Flow table processing unit.

The system according to claim 11, wherein the flow table processing unit is configured to: obtain a domain type and a range of domain values to be matched from the flow table, and set a domain value range check table; The range check table includes the type of domain to be checked and its corresponding range of domain values.

The system according to claim 12, wherein the data packet processing unit is configured to: when determining a domain type in the range check table in the data packet, determining that the domain value of the domain is in the domain value range check table Corresponding index number, and setting the domain value range check identifier of the entry corresponding to the index number to be valid; notifying the flow table the metadata carrying the domain value range check result including the domain value range check identifier; matching metadata The result of the field value range check result is the same as the result of the key Key value and the mask in the flow table. If the two are consistent, the domain value of the data packet is within the range; according to the corresponding action of the flow table configuration, the data is The package is forwarded.

The system according to any one of claims 11 to 13, wherein the flow table information delivery unit is disposed in a software defined network SDN controller.

The system according to any one of claims 10 to 13, wherein the flow table processing unit and the data packet processing unit are disposed in an OpenFlow switch.