WO2015074324A1 - 一种数据包快速转发方法及装置 - Google Patents

一种数据包快速转发方法及装置 Download PDF

Info

Publication number
WO2015074324A1
WO2015074324A1 PCT/CN2014/000988 CN2014000988W WO2015074324A1 WO 2015074324 A1 WO2015074324 A1 WO 2015074324A1 CN 2014000988 W CN2014000988 W CN 2014000988W WO 2015074324 A1 WO2015074324 A1 WO 2015074324A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
layer
forwarding
modification
information
Prior art date
Application number
PCT/CN2014/000988
Other languages
English (en)
French (fr)
Inventor
管建智
Original Assignee
上海斐讯数据通信技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海斐讯数据通信技术有限公司 filed Critical 上海斐讯数据通信技术有限公司
Publication of WO2015074324A1 publication Critical patent/WO2015074324A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/10—Current supply arrangements

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a data packet fast forwarding method and apparatus.
  • the forwarding of data packets by the Linux network protocol stack on the gateway products can be classified into uplink forwarding and downlink forwarding according to the forwarding direction.
  • the network layer classification according to forwarding can be divided into two layers: Layer 2 forwarding and Layer 3 forwarding.
  • the forwarding process for a general packet that needs to be forwarded is:
  • the first step when the network interface driver receives the data packet, it hands it to the receiving function of the Linux network protocol stack, and the protocol stack determines whether to perform Layer 2 forwarding or Layer 3 forwarding according to the destination MAC.
  • Step 2 If it is Layer 2 forwarding, the processing of uplink and downlink forwarding is the same.
  • the bridge module first checks the firewall filtering rules; the packets that can be forwarded are forwarded according to the port configuration relationship of the bridge; and then sent to the physical link by the network interface driver sequence of the outgoing interface.
  • Step 3 If it is Layer 3 forwarding, for downstream packets, if it is PPPoE (Point-to-Point Protocol over Ethernet), first remove the PPPoE encapsulation; then enter the PREROUTING of the Netfilter (Network Filter, Firewall) module.
  • PPPoE Point-to-Point Protocol over Ethernet
  • an object of the present invention is to provide a data packet fast forwarding method and apparatus for solving the problem that the performance of the above-mentioned prior art gateway product is insufficient to cope with network bandwidth requirements.
  • the present invention provides a data packet fast forwarding method, including: determining the same link of multiple data packets in respective forwarding processes; and extracting the data packets according to the same link And the same feature information; performing fast forwarding classification on the predetermined types of data packets according to the same feature information; associating the fast forward classified data packet categories with corresponding forwarding operation sets; when the data packets belong to the data packet category When the data packet is modified according to the corresponding forwarding operation set and forwarded; when the data packet does not belong to the data packet category, it is forwarded through the network protocol stack of the Linux system.
  • the data packet is forwarded in the MAC layer, that is, the Layer 2 and/or the IP layer, that is, the Layer 3; the same feature information includes: forwarding, for the Layer 2, all the packets with the same source MAC address and destination MAC address,
  • the multicast data packet of a multicast source, the TCP three-way handshake succeeds in the subsequent data transmission, and the UDP data transmission source IP address, destination IP address, and source port information destination port information are the same.
  • the fast forwarding classification refers to: generating a fast forwarding table, wherein the fast forwarding table records the packet type of the fast forwarding classification and a corresponding forwarding operation set; the data packet belongs to the data
  • the packet class refers to: the information field extracted from the data packet hits the same feature information corresponding to the packet class in the fast forwarding table.
  • the information included in the data packet category includes: a source MAC address, a destination MAC address, a virtual local area network identifier, a source IP address, a destination IP address, a communication protocol, source port information, and destination port information of the data packet.
  • the fast forwarding table includes: a Layer 2 fast forwarding table corresponding to the MAC layer, and a Layer 3 fast forwarding table corresponding to the TCP/IP layer; and the packet type information in the Layer 2 fast forwarding table includes: a source MAC address.
  • the modifying the data packet according to the corresponding forwarding operation set includes: modifying the modification of the Layer 2 fast forwarding table, including: modifying the virtual local area network identifier information of the data packet, and modifying the Layer 2 network protocol;
  • the modification of the Layer 3 fast forwarding table includes: modification of the source MAC address of the data packet, modification of the destination MAC address, modification of the virtual local area network identifier, modification of the source IP address, modification of the destination IP address, modification of the communication protocol, and source Modification of port information, modification of destination port information, PPPoE encapsulation, and TTL modification.
  • the modification of the source IP address information and the modification of the source port information are performed when there is a NAT in the forwarding process of the three-layer uplink data packet; the modification of the destination IP address information and the modification of the destination port information are The process of forwarding the Layer 3 downlink data packet is performed when the NAT is performed; the PPPoE encapsulation is performed when the PPPoE port information is involved in the Layer 3 forwarding; the TTL modification refers to the TTL value reduction when the Layer 3 forwarding data packet is used. 1.
  • the modifying the data packet according to the corresponding forwarding operation set comprises: modifying a data packet format to adapt to the designated forwarding network interface.
  • the data packet fast forwarding method further includes: recording information that the data packet is intercepted by the firewall; and according to the information intercepted by the firewall, the data that is intercepted by the intercepted data packet belongs to the same type in the data packet category.
  • the package is forwarded through the network protocol stack of the Linux system.
  • the present invention further provides a packet forwarding device, including:
  • a confirmation module configured to determine the same link of the plurality of data packets in the respective forwarding process;
  • the extracting module is configured to extract the same feature information in each data packet according to the same link;
  • the fast forwarding classification module is configured to And the same feature information is used to perform fast forwarding classification on each of the predetermined types of data packets;
  • the association module is configured to associate the fast forwarded data packet category with a corresponding forwarding operation set;
  • the determining module is configured to determine Whether the forwarded data packet belongs to the data packet category, and when it is determined that the data packet does not belong to the data packet category, is forwarded through a Linux network protocol stack; and
  • the modifying module is configured to: when the determining module determines that the data packet belongs to the In the case of a packet class, the packet is modified and forwarded according to the corresponding forwarding operation set.
  • the data packet is forwarded in the MAC layer, that is, the Layer 2 and/or the IP layer, that is, the Layer 3; the same feature information includes: forwarding, for the Layer 2, all the packets with the same source MAC address and destination MAC address, A multicast data packet of a multicast source, and a TCP three-way handshake succeeds in transmitting data. If the UDP data is transmitted, the source IP address, the destination IP address, and the destination port information of the source port are the same.
  • the fast forwarding classification refers to: generating a fast forwarding table, wherein the fast forwarding table records the packet type of the fast forwarding classification and a corresponding forwarding operation set; the data packet belongs to the data
  • the packet class refers to: the information field extracted from the data packet hits the same feature information corresponding to the packet class in the fast forwarding table.
  • the information included in the data packet category includes: a source MAC address, a destination MAC address, a virtual local area network identifier, a source IP address, a destination IP address, a communication protocol, source port information, and destination port information of the data packet.
  • the fast forwarding table includes: a Layer 2 fast forwarding table corresponding to the MAC layer, and a Layer 3 fast forwarding table corresponding to the TCP/IP layer; and the packet type information in the Layer 2 fast forwarding table includes: a source MAC address.
  • the modification of the data packet by the modifying module includes: modifying the modification of the Layer 2 fast forwarding table, including: modifying the virtual local area network identification information of the data packet to be forwarded, and modifying the Layer 2 network protocol;
  • the modification of the Layer 3 fast forwarding table includes: modification of the source MAC address of the data packet to be forwarded, modification of the destination MAC address, modification of the virtual local area network identifier, modification of the source IP address, modification of the destination IP address, modification of the communication protocol
  • the source port information is modified, the destination port information is modified, the PPPoE encapsulation, and the TTL are modified.
  • the modification of the source IP address information and the modification of the source port information are performed when there is a NAT in the forwarding process of the three-layer uplink data packet; the modification of the destination IP address information and the modification of the destination port information are The process of forwarding the Layer 3 downlink data packet is performed when the NAT is performed; the PPPoE encapsulation is performed when the PPPoE port information is involved in the Layer 3 forwarding; the TTL modification refers to the TTL value reduction when the Layer 3 forwarding data packet is used. 1.
  • the modifying module is further configured to modify a data packet format to adapt to a specified forwarding network interface.
  • the data packet fast forwarding device further includes: a recording module, configured to record information intercepted by the firewall, and according to the information intercepted by the firewall, the intercepted data packet is in the data packet. Packets belonging to the same category in the category through the network protocol stack of the Linux system Forward.
  • the present invention provides a data packet fast forwarding method and apparatus for extracting the same feature in each data packet according to the same link by determining the same link of multiple data packets in respective forwarding processes.
  • Information and performing fast forwarding classification on the predetermined types of data packets according to the same feature information, and then associating the fast forward classified data packet categories with corresponding forwarding operation sets, and when subsequently forwarding the data packets
  • the data packet can be modified and forwarded according to the corresponding forwarding operation set, thereby saving the operation time of checking the routing table, checking the NAT table, and the like, and accelerating the forwarding of the data packet.
  • FIG. 1 is a schematic flow chart of steps of a packet fast forwarding method according to the present invention.
  • FIG. 2 is a schematic flow chart of steps of an embodiment of a data packet fast forwarding method according to the present invention.
  • FIG. 3 is a schematic flow chart of steps of another embodiment of a method for rapidly forwarding data packets according to the present invention.
  • FIG. 4 is a schematic structural diagram of a packet fast forwarding apparatus according to the present invention.
  • FIG. 5 is a schematic diagram of the operation of the data packet fast forwarding method and apparatus according to the present invention.
  • the present invention provides a data packet fast forwarding method, including:
  • Step S1 determining the same link of multiple data packets in respective forwarding processes
  • Step S2 extracting the same feature information in each data packet according to the same link
  • Step S3 performing fast forwarding classification on each predetermined type of data packet according to the same feature information
  • Step S4 correlating the packet class after the fast forwarding classification with the corresponding forwarding operation set
  • Step S5 When the data packet belongs to the data packet category, the data packet is modified according to the corresponding forwarding operation set and forwarded; when the data packet does not belong to the data packet category, it is forwarded through the network protocol stack of the Linux system.
  • the data packet When the data packet is forwarded for the first time, it is still forwarded through the network protocol stack of the Linux system, and then a packet fast forwarding method provided by the present invention is executed, and the forwarding operation process of the data packet successfully forwarded by the network protocol stack of the Linux system is performed. Record and learn to generate a fast forwarding table.
  • the steps S1 to S4 are to learn the information fields included in the data packet that has been successfully forwarded through the network protocol stack of the Linux system to establish the packet type information in the fast forwarding table.
  • the packet forwarding method of the present invention further provides a learning mechanism, that is, a record of establishing a Layer 2 fast forwarding table or a Layer 3 fast forwarding table according to the characteristics of the data packet that has been successfully forwarded, so as to ensure that the subsequent features have the same feature.
  • the data packet can be forwarded by the fast forwarding module based on the record.
  • step S1 to S4 are only operated once at the initial time. In the subsequent data packet forwarding process, only step S5 is performed, because the fast forwarding classification table has been defined, and the subsequent data packet forwarding process is performed. It is sufficient to determine which fast-forward classification table the packet uses to modify the transmission.
  • the packet fast forwarding device receives the data packet sent by the network driver layer, extracts the feature field of the data packet to the corresponding field of the skbuff, and the skbuff.h is the header file of the Linux kernel, skbuff.h
  • the main thing is to include the Linux kernel network subsystem (protocol stack) Represents the data structure of a packet. The data packet is handed over to the receiving function of the Linux protocol stack for forwarding processing; when the Linux protocol stack is doing forwarding processing, the learning flag bit in the skbuff is set as needed; the Linux protocol stack sends the data packet to call the packet fast forwarding device before sending.
  • the Linux kernel network subsystem protocol stack
  • the processing function checks the learning flag bit in the skbuff; if set, compares the record field in the skbuff with the modified data packet, determines the same link of multiple data packets in the respective forwarding processes, and generates corresponding modifications. Processing rules.
  • the Linux protocol stack needs to set the learning flag of the corresponding skbuff:
  • the above is an exemplary learning mechanism and is not limited to this.
  • the same link includes: modification of the data packet (modification: MAC address, IP address, port number) and forwarding of the data packet (from which network interface is sent out).
  • the source MAC address, the destination MAC address, the receiving device, and the virtual local area network identifier of the source data packet of the data packet are extracted as a data packet classification standard, and the modification and the sending interface of the virtual local area network identifier are recorded as a modification.
  • the forwarding rule for the three-layer forwarding, the receiving device of the extracted data packet, the virtual local area network identifier of the source data packet, the destination IP, the source IP, the destination port, the source port, and the protocol information are used as the packet classification standard, and the source MAC address is recorded. Changes to the destination MAC address, virtual LAN ID, source IP address, destination IP address, source port, and destination port are used as rules for modification and forwarding.
  • the same feature information includes: forwarding, by the Layer 2, all the packets with the same source MAC address and the destination MAC address, the multicast data packet of the same multicast source, the TCP three-way handshake succeeding subsequent data transmission, and the UDP transmission data.
  • the packets with the same source IP address, destination IP address, and source port information have the same common characteristics for the packets described above. As long as these features are the same, the corresponding forwarding processing is the same. The subsequent modification and forwarding processing are the same.
  • the method of the present invention utilizes these features to reduce the judgment logic and processing flow in the forwarding process, thereby improving the forwarding efficiency of the data packet.
  • the predetermined type is at least one of seven elements: a source MAC address, a destination MAC address, a VLAN ID (virtual local area network identifier), a source IP address, a destination IP address, a source port, a destination port, and a protocol type of the data packet.
  • a source MAC address a source MAC address
  • a destination MAC address a destination MAC address
  • a VLAN ID virtual local area network identifier
  • the fast forwarding classification generates a fast forwarding table, wherein the fast forwarding table records the packet type of the fast forwarding classification and a corresponding forwarding operation set;
  • the information included in the data packet category includes: a source MAC address, a destination MAC address, a virtual local area network identifier, a source IP address, a destination IP address, a communication protocol, a source port information, and a destination port information of the data packet.
  • the fast forwarding table may include two: a Layer 2 fast forwarding table corresponding to the MAC layer, a Layer 3 fast forwarding table corresponding to the TCP/IP layer, and the Layer 2 fast forwarding table.
  • the packet type information in the packet includes: a source MAC address, a destination MAC address, and a virtual local area network identifier; and the packet type information of the Layer 3 fast forwarding table includes: a virtual local area network identifier, a source IP address, a destination IP address information, a communication protocol, Source port information and destination port information.
  • the fast forwarding classification is a classification method for “destination MAC+source MAC+VLANID” for Layer 2 forwarding; and “VLANID+destination IP+source IP+destination port+source port+protocol type” is used for Layer 3 forwarding;
  • Each classification method maintains a table, the former is defined as a two-layer fast forwarding table; the latter is defined as a three-layer fast forwarding table, and each record in the table corresponds to a data stream that can be forwarded by the packet fast forwarding device.
  • the information included in the forwarding operation set includes: modification of the Layer 2 fast forwarding table, including: modification of the virtual local area network identification information of the data packet, modification of the Layer 2 network protocol; and corresponding to the three-layer fast forwarding table.
  • the modification includes: modification of the source MAC address of the data packet, modification of the destination MAC address, modification of the virtual local area network identifier, modification of the source IP address, modification of the destination IP address, modification of the communication protocol, modification of the source port information, purpose Modification of port information, PPPoE encapsulation, and TTL modification.
  • the records of the Layer 2 fast forwarding table and the Layer 3 fast forwarding table have a life cycle.
  • the Layer 2 fast forwarding table uses a timeout mechanism.
  • the timeout mechanism is the same as that of the Mac protocol of the kernel protocol stack.
  • the default timeout time is 2 minutes.
  • the record is successfully used to implement the refresh timeout timer when forwarding, and the record is cleared after 2 minutes of inactivity.
  • the Layer 3 fast forwarding table uses the same timeout mechanism as the Layer 2 fast forwarding table, but the default timeout is 20 seconds.
  • the data packet type hits the data packet of the Layer 2 fast forwarding table and is associated with the forwarding operation set in the Layer 2 fast forwarding table
  • the data packet category hits the data packet of the three-layer fast forwarding table and three The forwarding operation set association in the layer fast forwarding table.
  • the data packet belongs to the data packet category, and the information field extracted from the data packet hits the same feature information corresponding to the data packet category in the fast forwarding table.
  • the modifying the data packet according to the corresponding forwarding operation set includes: modifying the modification of the Layer 2 fast forwarding table, including: modifying the virtual local area network identification information of the data packet, and modifying the Layer 2 network protocol; corresponding to the third layer
  • the modification of the fast forwarding table includes: modification of the source MAC address of the data packet, modification of the destination MAC address, modification of the virtual local area network identifier, modification of the source IP address, modification of the destination IP address, modification of the communication protocol, and source port information. Modification, modification of destination port information, PPPoE encapsulation, and TTL modification.
  • the modification of the source IP address information and the modification of the source port information are performed when there is network address translation (NAT) in the forwarding process of the three-layer uplink data packet; the destination IP address The modification of the information and the modification of the destination port information are performed when there is a NAT in the forwarding process of the Layer 3 downlink data packet; the PPPoE encapsulation is performed when the PPPoE port information is involved in the Layer 3 forwarding; The TTL value is decremented by 1 when the Layer 3 forwards the packet, and the TTL is Time To Live.
  • NAT network address translation
  • the modifying the data packet according to the corresponding forwarding operation set includes: modifying a data packet format to adapt to a specified forwarding network interface, such as a PPPoE interface.
  • the data packet fast forwarding method further includes: recording information that the data packet is intercepted by the firewall; and according to the information intercepted by the firewall, the data packet that belongs to the same type as the intercepted data packet in the data packet category passes through the Linux.
  • the network protocol stack of the system is forwarded.
  • the firewall the first packet is processed by the Linux protocol stack for the same type of data packet, and the corresponding fast forwarding rule is configured after the forwarding is successful, and the subsequent similar data packet is fast. Forward.
  • the subsequent packets of the same type should also comply with the principle that the firewall allows to pass; if the first packet is discarded by the firewall rule, then Fast forwarding rules will not be generated, and subsequent packets of the same type will be forwarded by the Linux network protocol stack, which will also be discarded by firewall rules. Therefore, the acceleration logic does not affect the normal operation of the firewall.
  • the data packet is forwarded at the MAC layer, that is, the second layer and/or the IP layer, that is, the third layer, that is, the protocol layer applied to the OSI of the Ethernet or the TCP/IP network model, and the present invention can be applied to the gateway of the Linux system.
  • Devices such as routers and switches, Layer 3 switches are common devices.
  • the so-called Layer 3 switches are switches with partial router functions.
  • the most important purpose of Layer 3 switches is to speed up data exchange within large LANs.
  • the routing function is also This purpose service can do a route once.
  • the embodiment of the uplink packet acceleration forwarding includes the following steps:
  • Step S6 receiving an uplink data packet
  • Step S7 determining whether the destination MAC address is on the LAN side; if yes, performing a three-layer forwarding process, that is, performing from step S8, if otherwise, to the second-layer forwarding flow, executing from step S16;
  • Step S8 determining whether the data packet hits the three-layer fast forwarding table; if otherwise, step S19 is sent to the Linux network protocol stack for transmission, if yes, step S9 is performed;
  • Step S9 determining whether there is a NAT, and if so, proceeding to step S10, if not, skipping directly to step S11;
  • Step S10 Modify the source IP and the source port.
  • Step S11 determining whether PPPoE encapsulation is required; if yes, proceeding to step S12, if otherwise, skipping directly to step S13;
  • Step S12 performing PPPoE encapsulation on the data packet
  • Step S13 modifying the VLAN
  • Step S14 modifying the source MAC address and the destination MAC address
  • Step S15 sending the data packet from the specified network interface
  • Step S16 determining whether it is a broadcast MAC; if it is not necessary to consider fast-forward, normal transmission can be, that is, step S19 is sent to the Linux network protocol stack for transmission; otherwise, step S17 is performed;
  • Step S17 determining whether to hit the Layer 2 fast forwarding table; if otherwise, the same as the above-mentioned Layer 3 forwarding, proceeding to step S19; if yes, proceeding to step S18: modifying the VLAN, and then jumping to step S15 to send from the designated network interface.
  • the embodiment of the downlink packet acceleration forwarding includes the following steps:
  • Step S20 receiving a downlink data packet
  • Step S21 determining whether the destination MAC address is on the WAN side; if yes, performing a three-layer forwarding process, that is, executing from step S22, if otherwise, to the second-layer forwarding flow, executing from step S30;
  • Step S22 determining whether the data packet hits the three-layer fast forwarding table; if otherwise, step S33 is sent to the Linux network protocol stack for transmission, if yes, step S23 is performed;
  • Step S23 determining whether there is a NAT, and if so, proceeding to step S24, if not, skipping directly to step S25;
  • Step S24 modifying the destination IP and the destination port
  • Step S25 determining whether PPPoE encapsulation is required; if yes, proceeding to step S26, if otherwise, skipping directly to step S27;
  • Step S26 performing PPPoE encapsulation on the data packet
  • Step S27 modifying the VLAN
  • Step S28 Modify the source MAC address and the destination MAC address.
  • Step S29 sending the data packet from the specified network interface
  • Step S30 determining whether it is a broadcast MAC; if it is not necessary to consider fast-forward, normal transmission can be, that is, step S33 is sent to the Linux network protocol stack for transmission; otherwise, step S31 is performed;
  • Step S31 determining whether to hit the Layer 2 fast forwarding table; if otherwise, the same as the above-mentioned Layer 3 forwarding, proceeding to step S33; if yes, to step S32: modifying the VLAN, and then jumping to step S29 to send from the designated network interface.
  • the present invention further provides a data packet fast forwarding device 1 , the principle and the features of which are substantially the same as the data packet fast forwarding method, and therefore, the data packet fast forwarding device 1 includes:
  • the confirmation module 11 is configured to determine the same link of the plurality of data packets in the respective forwarding process; the extracting module 12 is configured to extract the same feature information in each data packet according to the same link; the fast forwarding classification module 13 For performing fast forwarding classification on the predetermined types of data packets according to the same feature information; the association module 14 is configured to associate the fast forward classified data packet categories with corresponding forwarding operation sets; and the determining module 15 When it is determined whether the data packet to be forwarded belongs to the data packet category, when it is determined that the data packet does not belong to the data packet category, it is forwarded through the Linux network protocol stack; and the modification module 16 is configured to be used by the determining module 15 When it is determined that the data packet belongs to the data packet category, the data packet is modified according to the corresponding forwarding operation set and forwarded.
  • the data packet is forwarded in the MAC layer, that is, the Layer 2 and/or the IP layer, that is, the Layer 3; the same feature information includes: forwarding, for the Layer 2, all the packets with the same source MAC address and destination MAC address,
  • the multicast data packet of a multicast source, the TCP three-way handshake succeeds in the subsequent data transmission, and the UDP data transmission source IP address, destination IP address, and source port information destination port information are the same.
  • the fast forwarding classification refers to: generating a fast forwarding table, wherein the fast forwarding table records the packet type of the fast forwarding classification and a corresponding forwarding operation set; the data packet belongs to the data
  • the packet category refers to: the information field extracted from the packet hits the fast forwarding table. The same feature information corresponding to the packet class.
  • the information included in the data packet category includes: a source MAC address, a destination MAC address, a virtual local area network identifier, a source IP address, a destination IP address, a communication protocol, source port information, and destination port information of the data packet.
  • the fast forwarding table includes: a Layer 2 fast forwarding table corresponding to the MAC layer, and a Layer 3 fast forwarding table corresponding to the TCP/IP layer; and the packet type information in the Layer 2 fast forwarding table includes: a source MAC address.
  • the modification of the data packet by the modifying module 16 includes: modifying the Layer 2 fast forwarding table, including: modifying the virtual local area network identification information of the data packet to be forwarded, and modifying the Layer 2 network protocol;
  • the modification of the Layer 3 fast forwarding table includes: modification of the source MAC address of the data packet to be forwarded, modification of the destination MAC address, modification of the virtual local area network identifier, modification of the source IP address, modification of the destination IP address, and communication protocol Modification, modification of source port information, modification of destination port information, PPPoE encapsulation, and TTL modification.
  • the modification of the source IP address information and the modification of the source port information are performed when there is a NAT in the forwarding process of the three-layer uplink data packet; the modification of the destination IP address information and the modification of the destination port information are The process of forwarding the Layer 3 downlink data packet is performed when the NAT is performed; the PPPoE encapsulation is performed when the PPPoE port information is involved in the Layer 3 forwarding; the TTL modification refers to the TTL value reduction when the Layer 3 forwarding data packet is used. 1.
  • the modifying module 16 is further configured to modify a data packet format to adapt to a specified forwarding network interface.
  • the packet fast forwarding device 1 further includes: a recording module 18, configured to record information intercepted by the firewall, and according to the information intercepted by the firewall, the intercepted data packet is in the Packets belonging to the same class in the packet class are forwarded through the network protocol stack of the Linux system.
  • a recording module 18 configured to record information intercepted by the firewall, and according to the information intercepted by the firewall, the intercepted data packet is in the Packets belonging to the same class in the packet class are forwarded through the network protocol stack of the Linux system.
  • the present invention adds a packet fast forwarding device 1 based on the Linux kernel, and the module works in Between the network interface driver and the Linux kernel protocol stack; after receiving the data packet, the network interface driver does not hand it to the Linux network protocol stack, but hands it to the fast forwarding module.
  • the sending module checks whether the data packet can be quickly forwarded. If it can, it is directly modified and forwarded by the fast forwarding module, and finally sent out through the sending function of the network interface driver, which is called fast path; Forwarded by the Linux network protocol stack, called slow path.
  • the change of the standard kernel is: when the kernel protocol stack sends the data packet, it first calls the pre-transmission processing function of the fast path layer, and then calls the transmission function of the network interface driver; the pre-transmission processing function mainly completes the fast forwarding. Learning the rules without modifying the contents of the packet.
  • the present invention provides a data packet fast forwarding method and apparatus, by determining the same link of multiple data packets in respective forwarding processes, and correspondingly extracting the same in each data packet according to the same link. Characteristic information, and performing fast forwarding classification on the predetermined types of data packets according to the same feature information, and then associating the fast forward classified data packet categories with corresponding forwarding operation sets, and when subsequently forwarding data
  • the packet can be modified and forwarded according to the corresponding forwarding operation set, thereby saving operation time of checking the routing table, checking the NAT table, and the like, and accelerating the forwarding of the data packet.
  • the invention has been experimentally tested and tested on a determined hardware scheme, and the forwarding performance on a 500 MHz main frequency network processor is 20 Mbps higher than the existing scheme (layer 2 forwarding), and 30 Mbps or more (three layer forwarding). , greatly improve forwarding efficiency.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供的一种数据包快速转发方法及装置，通过确定多个数据包在各自转发过程中的相同环节，进而根据所述相同环节对应提取所述各数据包中的相同特征信息，并且，根据所述相同特征信息对所述各预定种类的数据包进行快转分类，再将快转分类后的数据包类别关联上对应的转发操作集，而当后续要转发的数据包属于所述数据包类别时，即可根据所对应的转发操作集修改数据包并转发，从而节省查路由表、查NAT表等等的操作时间，加速了数据包的转发。

Description

一种数据包快速转发方法及装置 技术领域
本发明涉及通信技术领域，特别是涉及一种数据包快速转发方法及装置。
背景技术
互联网设备发展迅猛，网关产品上Linux网络协议栈对数据包的转发按转发方向分类可以分为：上行转发和下行转发；按转发涉及的网络层次分类可以分为：二层转发和三层转发。
对于一般的需要做转发处理的数据包的转发流程是：
第一步：当网络接口驱动程序接收到数据包后，交给Linux网络协议栈的收包函数，协议栈根据目的MAC做二层转发还是三层转发的判断，
第二步：如果是二层转发，上行和下行转发的处理过程是一样的。先交由bridge模块先做防火墙过滤规则检查；对于能够转发的数据包，根据桥的端口配置关系进行转发；然后交由出接口的网络接口驱动层序发送到物理链路。
第三步：如果是三层转发，对于下行数据包，如果是PPPoE(以太网上的点对点协议)封包，先去掉PPPoE封装；然后进入Netfilter(网络过滤器，即防火墙)模块的PREROUTING(路由前处理)模块，做DNAT(目标地址转换)检查，对于下行数据包需要修改目的IP和目的端口；然后进入FORWARD(转发)模块，做防火墙的过滤规则检查；然后进入OUTPUT(输出)模块，查路由表，选择出去的路由，然后做防火墙的过滤规则检查；然后进入POSTROUTING模块，对于上行数据包需要根据NAT(网络地址转换)规则，修改源IP和源端口；对于上行数据包如果出接口是PPPoE类型的，需要对封包进行PPPoE封装；然后交由出接口的网络接口驱动程序发送到物理链路。
但是，终端用户对网络带宽的要求越来越大，提升网关设备的转发性能也越来来越迫切。解决这个问题总体来说有两个方案：一个是提升硬件的处 理能力；另一个是在软件上做优化，但是目前针对网关设备的软件优化方案还是比较少。
发明的公开
鉴于以上所述现有技术的缺点，本发明的目的在于提供一种数据包快速转发方法及装置，用于解决上述现有技术网关产品性能不足以应对网络带宽要求的问题。
为实现上述目的及其他相关目的，本发明提供一种数据包快速转发方法，包括：确定多个数据包在各自转发过程中的相同环节；根据所述相同环节对应提取所述各数据包中的相同特征信息；根据所述相同特征信息对所述各预定种类的数据包进行快转分类；将快转分类后的数据包类别关联上对应的转发操作集；当数据包属于所述数据包类别时，根据所对应的转发操作集修改数据包并转发；当数据包不属于所述数据包类别时，通过Linux系统的网络协议栈转发。
优选的，所述数据包是在MAC层即二层和/或IP层即三层转发的；所述相同特征信息包括：对于二层转发所有源MAC地址和目的MAC地址相同的报文，同一个组播源的组播数据报文，TCP三次握手成功后续传数据的报文，UDP传输数据时源IP地址、目的IP地址、源端口信息目的端口信息都相同的报文。
优选的，所述快转分类指的是：生成快速转发表，其中，所述快速转发表记录所述快转分类后的数据包类别及对应的转发操作集；所述数据包属于所述数据包类别指的是：从数据包中提取的信息字段命中所述快速转发表中的数据包类别对应的相同特征信息。
优选的，所述数据包类别所包括的信息有：数据包的源MAC地址、目的MAC地址、虚拟局域网标识、源IP地址、目的IP地址、通信协议、源端口信息、目的端口信息。
优选的，所述快速转发表包括：对应MAC层的二层快速转发表、对应TCP/IP层的三层快速转发表；所述二层快速转发表中的数据包类别信息包括：源MAC地址、目的MAC地址、虚拟局域网标识；所述三层快速转发表的数据包类别信息包括：虚拟局域网标识、源IP地址、目的IP地址信息、 通信协议、源端口信息、目的端口信息。
优选的，所述根据所对应的转发操作集修改数据包，包括：对应所述二层快速转发表的修改，包括：数据包的虚拟局域网标识信息的修改、二层网络协议的修改；对应所述三层快速转发表的修改，包括：数据包的源MAC地址的修改、目的MAC地址的修改、虚拟局域网标识的修改、源IP地址的修改、目的IP地址的修改、通信协议的修改、源端口信息的修改、目的端口信息的修改、PPPoE封装、TTL的修改。
优选的，所述源IP地址信息的修改和源端口信息的修改是在三层上行数据包的转发过程中有NAT时进行的；所述目的IP地址信息的修改和目的端口信息的修改是在三层下行数据包的转发过程中有NAT时进行的；所述PPPoE封装是在三层转发中涉及PPPoE端口信息时进行的；所述TTL的修改指的是三层转发数据包时TTL值减1。
优选的，所述根据所对应的转发操作集修改数据包，包括：修改数据包格式以适应指定转发的网络接口。
优选的，所述数据包快速转发方法还包括：记录数据包被防火墙拦截的信息；根据所述数据包被防火墙拦截的信息，将与被拦截数据包在所述数据包类别中属于同类的数据包通过Linux系统的网络协议栈转发。
为实现上述目的及其他相关目的，本发明还提供一种数据包快速转发装置，包括：
确认模块，用于确定多个数据包在各自转发过程中的相同环节；提取模块，用于根据所述相同环节对应提取所述各数据包中的相同特征信息；快转分类模块，用于根据所述相同特征信息对所述各预定种类的数据包进行快转分类；关联模块，用于将快转分类后的数据包类别关联上对应的转发操作集；判断模块，用于当判断出待转发的数据包是否属于所述数据包类别，当判断出数据包不属于所述数据包类别时，通过Linux网络协议栈转发；修改模块，用于当所述判断模块判断出数据包属于所述数据包类别时，根据所对应的转发操作集修改数据包并转发。
优选的，所述数据包是在MAC层即二层和/或IP层即三层转发的；所述相同特征信息包括：对于二层转发所有源MAC地址和目的MAC地址相同的报文，同一个组播源的组播数据报文，TCP三次握手成功后续传数据的报 文，UDP传输数据时源IP地址、目的IP地址、源端口信息目的端口信息都相同的报文。
优选的，所述快转分类指的是：生成快速转发表，其中，所述快速转发表记录所述快转分类后的数据包类别及对应的转发操作集；所述数据包属于所述数据包类别指的是：从数据包中提取的信息字段命中所述快速转发表中的数据包类别对应的相同特征信息。
优选的，所述数据包类别所包括的信息有：数据包的源MAC地址、目的MAC地址、虚拟局域网标识、源IP地址、目的IP地址、通信协议、源端口信息、目的端口信息。
优选的，所述快速转发表包括：对应MAC层的二层快速转发表、对应TCP/IP层的三层快速转发表；所述二层快速转发表中的数据包类别信息包括：源MAC地址、目的MAC地址、虚拟局域网标识；所述三层快速转发表的数据包类别信息包括：虚拟局域网标识、源IP地址、目的IP地址信息、通信协议、源端口信息、目的端口信息。
优选的，所述修改模块对数据包的修改包括：对应所述二层快速转发表的修改，包括：待转发的数据包的虚拟局域网标识信息的修改、二层网络协议的修改；对应所述三层快速转发表的修改，包括：待转发的数据包的源MAC地址的修改、目的MAC地址的修改、虚拟局域网标识的修改、源IP地址的修改、目的IP地址的修改、通信协议的修改、源端口信息的修改、目的端口信息的修改、PPPoE封装、TTL的修改。
优选的，所述源IP地址信息的修改和源端口信息的修改是在三层上行数据包的转发过程中有NAT时进行的；所述目的IP地址信息的修改和目的端口信息的修改是在三层下行数据包的转发过程中有NAT时进行的；所述PPPoE封装是在三层转发中涉及PPPoE端口信息时进行的；所述TTL的修改指的是三层转发数据包时TTL值减1。
优选的，所述修改模块，还用于修改数据包格式以适应指定转发的网络接口。
优选的，所述数据包快速转发装置还包括：记录模块，用于记录数据包被防火墙拦截的信息，并根据所述数据包被防火墙拦截的信息，将与被拦截数据包在所述数据包类别中属于同类的数据包通过Linux系统的网络协议栈 转发。
如上所述，本发明提供的一种数据包快速转发方法及装置，通过确定多个数据包在各自转发过程中的相同环节，进而根据所述相同环节对应提取所述各数据包中的相同特征信息，并且，根据所述相同特征信息对所述各预定种类的数据包进行快转分类，再将快转分类后的数据包类别关联上对应的转发操作集，而当后续要转发的数据包属于所述数据包类别时，即可根据所对应的转发操作集修改数据包并转发，从而节省查路由表、查NAT表等等的操作时间，加速了数据包的转发。
附图的简要说明
图1为本发明的数据包快速转发方法的步骤流程示意图。
图2为本发明的数据包快速转发方法的一实施例的步骤流程示意图。
图3为本发明的数据包快速转发方法的另一实施例的步骤流程示意图。
图4为本发明的数据包快速转发装置的结构示意图。
图5为本发明的数据包快速转发方法及装置的运作原理图。
元件标号说明
1              数据包快速转发装置
11             确认模块
12             提取模块
13             快转分类模块
14             关联模块
15             判断模块
16             修改模块
17             快速转发表更新模块
18             记录模块
S1～S33        方法步骤
实现本发明的最佳方式
以下通过特定的具体实例说明本发明的实施方式，本领域技术人员可由 本说明书所公开的内容轻易地了解本发明的其他优点与功效。本发明还可以通过另外不同的具体实施方式加以实施或应用，本说明书中的各项细节也可以基于不同观点与应用，在没有背离本发明的精神下进行各种修饰或改变。需说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
如图1所示，本发明提供的一种数据包快速转发方法，包括：
步骤S1：确定多个数据包在各自转发过程中的相同环节；
步骤S2：根据所述相同环节对应提取所述各数据包中的相同特征信息；
步骤S3：根据所述相同特征信息对所述各预定种类的数据包进行快转分类；
步骤S4：将快转分类后的数据包类别关联上对应的转发操作集；
步骤S5：当数据包属于所述数据包类别时，根据所对应的转发操作集修改数据包并转发；当数据包不属于所述数据包类别时，通过Linux系统的网络协议栈转发。
在首次转发数据包时，仍然通过Linux系统的网络协议栈转发，然后再执行本发明提供的一种数据包快速转发方法，对通过Linux系统的网络协议栈成功转发的数据包的转发操作过程做记录和学习，生成快速转发表。
所述的步骤S1～步骤S4就是学习已经通过Linux系统的网络协议栈成功转发的数据包所包含的信息字段，以建立所述快速转发表中的数据包类别信息。具体来说，本发明的数据包快速转发方法还提供学习机制，即一种根据已经成功转发的数据包的特征建立二层快速转发表或三层快速转发表的记录，以保证后续具有同样特征的数据包能够由快速转发模块根据该记录实现转发的机制。
所述的步骤S1～步骤S4仅在最初始的时候操作一次，在后续的数据包转发过程中，仅仅执行步骤S5就可以了，因为已经定义好了快转分类表，后续数据包转发过程中就判断数据包使用哪个快转分类表进行修改发送就可以了。
所述的步骤S1中，数据包快速转发装置接收到网络驱动层序发送过来的数据包，提取数据包的特征字段到skbuff的对应字段，skbuff.h是Linux内核的头文件，skbuff.h中最主要的是包含了Linux内核网络子系统(协议栈)用来 表示数据包的数据结构。数据包交由Linux协议栈的收包函数，做转发处理；Linux协议栈在做转发处理时，根据需要设置skbuff中的学习标志位；Linux协议栈发送数据包调用数据包快速转发装置的发送前处理函数，检查skbuff中的学习标志位；如果被置位，则对skbuff中的记录字段和修改后的数据包做比较，确定多个数据包在各自转发过程中的相同环节，生成相应的修改处理规则。
对于下面的几种情形Linux协议栈需要设置相应skbuff的学习标志位：
二层转发，bridge模块成功转发一个单播数据包时；
三层转发，Netfilter模块成功加入一条连接跟踪表(nf_contrack)记录时，目前只针对TCP和UDP协议做处理。
以上为例示性的学习机制，并非以此为限。
所述的相同环节包括：数据包的修改(修改：MAC地址、IP地址、端口号)和数据包的转发(从哪个网络接口发送出去)。
所述的步骤S2中，对于二层转发，提取数据包的源MAC、目的MAC、接收设备和源数据包的虚拟局域网标识作为数据包分类标准，并记录虚拟局域网标识的改动和发送接口作为修改和转发的规则；而对于三层转发，提取数据包的接收设备、源数据包的虚拟局域网标识、目的IP、源IP、目的port、源port和协议信息作为数据包分类标准，并记录源MAC、目的MAC、虚拟局域网标识、源IP地址、目的IP地址、源端口和目的端口的改动作为修改和转发的规则。
所述相同特征信息包括：对于二层转发所有源MAC地址和目的MAC地址相同的报文，同一个组播源的组播数据报文，TCP三次握手成功后续传数据的报文，UDP传输数据时源IP地址、目的IP地址、源端口信息目的端口信息都相同的报文，对于上面描述的这几类数据包有各自的共同特征，只要这些特征相同，那么对应的转发处理也相同，即后续所要做的修改和转发处理都相同，本发明的方法就是利用这些特征减少转发过程中的判断逻辑和处理流程，来提升数据包的转发效率。
所述的步骤S3中，所述的预定种类由数据包的源MAC、目的MAC、VLANID(虚拟局域网标识)、源IP、目的IP、源端口、目的端口、协议类型这7个元素中的至少两个来标识，有时只需两个元素，有时需要5个元素来标 识。对于二层转发，只需要源MAC、目的MAC和VLANID 3个元素，三层转发需要源IP、目的IP、源端口、目的端口、协议类型5个元素。
所述快转分类生成快速转发表，其中，所述快速转发表记录所述快转分类后的数据包类别及对应的转发操作集；
所述数据包类别所包括的信息有：数据包的源MAC地址、目的MAC地址、虚拟局域网标识、源IP地址、目的IP地址、通信协议、源端口信息、目的端口信息。
并且，因为要考虑二层和三层转发，因此快速转发表可以包括两张：对应MAC层的二层快速转发表、对应TCP/IP层的三层快速转发表；所述二层快速转发表中的数据包类别信息包括：源MAC地址、目的MAC地址、虚拟局域网标识；所述三层快速转发表的数据包类别信息包括：虚拟局域网标识、源IP地址、目的IP地址信息、通信协议、源端口信息、目的端口信息。
所述快转分类就是对于二层转发用“目的MAC+源MAC+VLANID”的分类方法；对于三层转发采用“VLANID+目的IP+源IP+目的端口+源端口+协议类型”的分类方法；为这两种分类方法各维护一张表，前者定义为二层快速转发表；后者定义为三层快速转发表，表内的每条记录对应一条可以由数据包快速转发装置的数据流。
所述的转发操作集所包括的信息有：对应所述二层快速转发表的修改，包括：数据包的虚拟局域网标识信息的修改、二层网络协议的修改；对应所述三层快速转发表的修改，包括：数据包的源MAC地址的修改、目的MAC地址的修改、虚拟局域网标识的修改、源IP地址的修改、目的IP地址的修改、通信协议的修改、源端口信息的修改、目的端口信息的修改、PPPoE封装、TTL的修改。
由于二层快速转发表和三层快速转发表的记录都是有生存周期的，二层快速转发表采用超时机制，超时机制与内核协议栈的Mac table的一致，超时时间默认为2分钟，在成功使用该记录实现转发时刷新超时定时器，在闲置2分钟后，清除该记录。三层快速转发表采用和二层快速转发表相同的超时机制，但默认超时时间为20秒。
所述的步骤S4中，数据包类别命中二层快速转发表的数据包与二层快速转发表中的转发操作集关联，数据包类别命中三层快速转发表的数据包与三 层快速转发表中的转发操作集关联。
所述的步骤S5中，所述数据包属于所述数据包类别指的是：从数据包中提取的信息字段命中所述快速转发表中的数据包类别对应的相同特征信息。
所述根据所对应的转发操作集修改数据包，包括：对应所述二层快速转发表的修改，包括：数据包的虚拟局域网标识信息的修改、二层网络协议的修改；对应所述三层快速转发表的修改，包括：数据包的源MAC地址的修改、目的MAC地址的修改、虚拟局域网标识的修改、源IP地址的修改、目的IP地址的修改、通信协议的修改、源端口信息的修改、目的端口信息的修改、PPPoE封装、TTL的修改。
对数据包的修改处理见下表例示：
Figure PCTCN2014000988-appb-000001
从表中可知，所述源IP地址信息的修改和源端口信息的修改是在三层上行数据包的转发过程中有网络地址转换(NAT)时进行的；所述目的IP地址 信息的修改和目的端口信息的修改是在三层下行数据包的转发过程中有NAT时进行的；所述PPPoE封装是在三层转发中涉及PPPoE端口信息时进行的；所述TTL的修改指的是三层转发数据包时TTL值减1，TTL是生存时间(Time To Live)。
所述根据所对应的转发操作集修改数据包，包括：修改数据包格式以适应指定转发的网络接口，如PPPoE接口等。
在做分类时，从数据包中提取相应的字段，和两个表中的所有记录做比较，如果命中，则说明该数据包能够做快速转发；不能命中，则交由Linux网络协议栈做转发。
所述数据包快速转发方法还包括：记录数据包被防火墙拦截的信息；根据所述数据包被防火墙拦截的信息，将与被拦截数据包在所述数据包类别中属于同类的数据包通过Linux系统的网络协议栈转发。在本实施例中，关于防火墙的考虑：本发明对于同一类型的数据包，第一个包是由Linux协议栈处理的，当转发成功后配置相应的快速转发规则，后续的同类数据包做快速转发。如果第一个数据包能够完成转发，则认为是符合防火墙的允许通过原则的，那么后续同类的数据包也应该是符合防火墙允许通过的原则的；如果第一个数据包被防火墙规则丢弃，则不会生成快速转发规则，后续同类的数据包也会交由Linux网络协议栈做转发，同样会被防火墙规则丢弃。所以该加速逻辑，不会影响防火墙的正常工作。
所述数据包是在MAC层即二层和/或IP层即三层转发的，意即应用于以太网的OSI或TCP/IP网络模型中的协议层，本发明可以应用于Linux系统的网关设备如路由器、交换机中，三层交换机已是常见设备，所谓三层交换机就是具有部分路由器功能的交换机，三层交换机的最重要目的是加快大型局域网内部的数据交换，所具有的路由功能也是为这目的服务的，能够做到一次路由。
如图2所示，显示本发明的数据包快速转发方法中的一实施例，关于上行数据包加速转发的实施例，包括如下步骤：
步骤S6：接收到上行数据包；
步骤S7：判断目的MAC地址是否是LAN侧的；若是则执行三层转发流程，即从步骤S8执行，若否则至二层转发流程即从步骤S16执行；
步骤S8：判断数据包是否命中三层快速转发表；若否则进行步骤S19发送到Linux网络协议栈进行发送，若是则执行步骤S9；
步骤S9：判断是否有NAT，若是则进行步骤S10，若否则直接跳至步骤S11；
步骤S10：修改源IP及源端口；
步骤S11：判断是否需要做PPPoE封装；若是则进行步骤S12，若否则直接跳至步骤S13；
步骤S12：给数据包做PPPoE封装；
步骤S13：修改VLAN；
步骤S14：修改源MAC和目的MAC地址；
步骤S15：将数据包从指定网络接口发送；
所述二层转发流程：
步骤S16：判断是否是广播MAC；若是就不用考虑快转，正常发送即可，即进行步骤S19发送到Linux网络协议栈进行发送；若否则执行步骤S17；
步骤S17：判断是否命中二层快速转发表；若否则与上述三层转发相同，进行步骤S19；若是则至步骤S18：修改VLAN，然后跳转至步骤S15从指定网络接口发送。
需说明的是，此实施例中的标号并非承接上述S1～S5。
如图3所示，显示本发明的数据包快速转发方法中的又一实施例，关于下行数据包加速转发的实施例，包括如下步骤：
步骤S20：接收到下行数据包；
步骤S21：判断目的MAC地址是否是WAN侧的；若是则执行三层转发流程，即从步骤S22执行，若否则至二层转发流程即从步骤S30执行；
步骤S22：判断数据包是否命中三层快速转发表；若否则进行步骤S33发送到Linux网络协议栈进行发送，若是则执行步骤S23；
步骤S23：判断是否有NAT，若是则进行步骤S24，若否则直接跳至步骤S25；
步骤S24：修改目的IP及目的端口；
步骤S25：判断是否需要做PPPoE封装；若是则进行步骤S26，若否则直接跳至步骤S27；
步骤S26：给数据包做PPPoE封装；
步骤S27：修改VLAN；
步骤S28：修改源MAC和目的MAC地址；
步骤S29：将数据包从指定网络接口发送；
所述二层转发流程：
步骤S30：判断是否是广播MAC；若是就不用考虑快转，正常发送即可，即进行步骤S33发送到Linux网络协议栈进行发送；若否则执行步骤S31；
步骤S31：判断是否命中二层快速转发表；若否则与上述三层转发相同，进行步骤S33；若是则至步骤S32：修改VLAN，然后跳转至步骤S29从指定网络接口发送。
需说明的是，此实施例中的标号并非承接上述S6～S19。
如图4所示，本发明还提供一种数据包快速转发装置1，其原理及特征与上述数据包快速转发方法大致相同，因此不另作赘述，所述数据包快速转发装置1包括：
确认模块11，用于确定多个数据包在各自转发过程中的相同环节；提取模块12，用于根据所述相同环节对应提取所述各数据包中的相同特征信息；快转分类模块13，用于根据所述相同特征信息对所述各预定种类的数据包进行快转分类；关联模块14，用于将快转分类后的数据包类别关联上对应的转发操作集；判断模块15，用于当判断出待转发的数据包是否属于所述数据包类别，当判断出数据包不属于所述数据包类别时，通过Linux网络协议栈转发；修改模块16，用于当所述判断模块15判断出数据包属于所述数据包类别时，根据所对应的转发操作集修改数据包并转发。
优选的，所述数据包是在MAC层即二层和/或IP层即三层转发的；所述相同特征信息包括：对于二层转发所有源MAC地址和目的MAC地址相同的报文，同一个组播源的组播数据报文，TCP三次握手成功后续传数据的报文，UDP传输数据时源IP地址、目的IP地址、源端口信息目的端口信息都相同的报文。
优选的，所述快转分类指的是：生成快速转发表，其中，所述快速转发表记录所述快转分类后的数据包类别及对应的转发操作集；所述数据包属于所述数据包类别指的是：从数据包中提取的信息字段命中所述快速转发表中 的数据包类别对应的相同特征信息。
优选的，所述数据包类别所包括的信息有：数据包的源MAC地址、目的MAC地址、虚拟局域网标识、源IP地址、目的IP地址、通信协议、源端口信息、目的端口信息。
优选的，所述快速转发表包括：对应MAC层的二层快速转发表、对应TCP/IP层的三层快速转发表；所述二层快速转发表中的数据包类别信息包括：源MAC地址、目的MAC地址、虚拟局域网标识；所述三层快速转发表的数据包类别信息包括：虚拟局域网标识、源IP地址、目的IP地址信息、通信协议、源端口信息、目的端口信息。
优选的，所述修改模块16对数据包的修改包括：对应所述二层快速转发表的修改，包括：待转发的数据包的虚拟局域网标识信息的修改、二层网络协议的修改；对应所述三层快速转发表的修改，包括：待转发的数据包的源MAC地址的修改、目的MAC地址的修改、虚拟局域网标识的修改、源IP地址的修改、目的IP地址的修改、通信协议的修改、源端口信息的修改、目的端口信息的修改、PPPoE封装、TTL的修改。
优选的，所述源IP地址信息的修改和源端口信息的修改是在三层上行数据包的转发过程中有NAT时进行的；所述目的IP地址信息的修改和目的端口信息的修改是在三层下行数据包的转发过程中有NAT时进行的；所述PPPoE封装是在三层转发中涉及PPPoE端口信息时进行的；所述TTL的修改指的是三层转发数据包时TTL值减1。
优选的，所述修改模块16，还用于修改数据包格式以适应指定转发的网络接口。
优选的，所述数据包快速转发装置1还包括：记录模块18，用于记录数据包被防火墙拦截的信息，并根据所述数据包被防火墙拦截的信息，将与被拦截数据包在所述数据包类别中属于同类的数据包通过Linux系统的网络协议栈转发。
如图5所示，总结下本发明的加速转发原理：举例来说，因大部分网关设备采用Linux系统，本发明就是在基于Linux内核内新增一个数据包快速转发装置1，该模块工作在网路接口驱动和Linux内核协议栈之间；网络接口驱动接收到数据包后，不交给Linux网络协议栈，而是交给快速转发模块。快速转 发模块检查该数据包能否做快速转发，如果可以，则直接由快速转发模块完成修改和转发，最后通过网络接口驱动的发送函数发送出去，称为fast path；不能做快速转发的数据包交由Linux网络协议栈做转发，称为slow path。Slow path在发送数据包时较标准内核的改动是：内核协议栈发送数据包时先调用fast path层的发送前处理函数，再调用网络接口驱动程序的发送函数；发送前处理函数主要完成快速转发规则的学习，不修改数据包的内容。
综上所述，本发明提供的一种数据包快速转发方法及装置，通过确定多个数据包在各自转发过程中的相同环节，进而根据所述相同环节对应提取所述各数据包中的相同特征信息，并且，根据所述相同特征信息对所述各预定种类的数据包进行快转分类，再将快转分类后的数据包类别关联上对应的转发操作集，而当后续要转发的数据包属于所述数据包类别时，即可根据所对应的转发操作集修改数据包并转发，从而节省查路由表、查NAT表等等的操作时间，加速了数据包的转发。本发明已经通过实验，并在以确定的硬件方案上做过比较试验，在500MHz主频的网络处理器上转发性能比现有方案要高20Mbps(二层转发)，30Mbps以上(三层转发)，大大提升转发效率。
上述实施例仅例示性说明本发明的原理及其功效，而非用于限制本发明。任何熟悉此技术的人士皆可在不违背本发明的精神及范畴下，对上述实施例进行修饰或改变。因此，举凡所属技术领域中具有通常知识者在未脱离本发明所公开的精神与技术思想下所完成的一切等效修饰或改变，仍应由本发明的权利要求所涵盖。

Claims (18)

  1. 一种数据包快速转发方法，其特征在于，包括：
    确定多个数据包在各自转发过程中的相同环节；
    根据所述相同环节对应提取所述各数据包中的相同特征信息；
    根据所述相同特征信息对所述各预定种类的数据包进行快转分类；
    将快转分类后的数据包类别关联上对应的转发操作集；
    当数据包属于所述数据包类别时，根据所对应的转发操作集修改数据包并转发；
    当数据包不属于所述数据包类别时，通过Linux系统的网络协议栈转发。
  2. 根据权利要求1所述的数据包快速转发方法，其特征在于，所述数据包是在MAC层即二层和/或IP层即三层转发的；所述相同特征信息包括：对于二层转发所有源MAC地址和目的MAC地址相同的报文，同一个组播源的组播数据报文，TCP三次握手成功后续传数据的报文，UDP传输数据时源IP地址、目的IP地址、源端口信息目的端口信息都相同的报文。
  3. 根据权利要求2所述的数据包快速转发方法，其特征在于，所述快转分类指的是：
    生成快速转发表，其中，所述快速转发表记录所述快转分类后的数据包类别及对应的转发操作集；
    所述数据包属于所述数据包类别指的是；从数据包中提取的信息字段命中所述快速转发表中的数据包类别对应的相同特征信息。
  4. 根据权利要求3所述的数据包快速转发方法，其特征在于，所述数据包类 别所包括的信息有：数据包的源MAC地址、目的MAC地址、虚拟局域网标识、源IP地址、目的IP地址、通信协议、源端口信息、目的端口信息。
  5. 根据权利要求4所述的数据包快速转发方法，其特征在于，所述快速转发表包括：对应MAC层的二层快速转发表、对应TCP/IP层的三层快速转发表；
    所述二层快速转发表中的数据包类别信息包括：源MAC地址、目的MAC地址、虚拟局域网标识；
    所述三层快速转发表的数据包类别信息包括：虚拟局域网标识、源IP地址、目的IP地址信息、通信协议、源端口信息、目的端口信息。
  6. 根据权利要求5所述的数据包快速转发方法，其特征在于，所述根据所对应的转发操作集修改数据包，包括：
    对应所述二层快速转发表的修改，包括：数据包的虚拟局域网标识信息的修改、二层网络协议的修改；
    对应所述三层快速转发表的修改，包括：数据包的源MAC地址的修改、目的MAC地址的修改、虚拟局域网标识的修改、源IP地址的修改、目的IP地址的修改、通信协议的修改、源端口信息的修改、目的端口信息的修改、PPPoE封装、TTL的修改。
  7. 根据权利要求6所述的数据包快速转发方法，其特征在于，所述源IP地址信息的修改和源端口信息的修改是在三层上行数据包的转发过程中有NAT时进行的；所述目的IP地址信息的修改和目的端口信息的修改是在三层下行数据包的转发过程中有NAT时进行的；所述PPPoE封装是在三层转发中涉及PPPoE端口信息时进行的；所述TTL的修改指的是三层转 发数据包时TTL值减1。
  8. 根据权利要求1至7中任一项所述的数据包快速转发方法，其特征在于，所述根据所对应的转发操作集修改数据包，包括：修改数据包格式以适应指定转发的网络接口。
  9. 根据权利要求1所述的数据包快速转发方法，其特征在于，还包括：
    记录数据包被防火墙拦截的信息；
    根据所述数据包被防火墙拦截的信息，将与被拦截数据包在所述数据包类别中属于同类的数据包通过Linux系统的网络协议栈转发。
  10. 一种数据包快速转发装置，其特征在于，包括：
    确认模块，用于确定多个数据包在各自转发过程中的相同环节；
    提取模块，用于根据所述相同环节对应提取所述各数据包中的相同特征信息；
    快转分类模块，用于根据所述相同特征信息对所述各预定种类的数据包进行快转分类；
    关联模块，用于将快转分类后的数据包类别关联上对应的转发操作集；
    判断模块，用于当判断出待转发的数据包是否属于所述数据包类别，当判断出数据包不属于所述数据包类别时，通过Linux网络协议栈转发；
    修改模块，用于当所述判断模块判断出数据包属于所述数据包类别时，根据所对应的转发操作集修改数据包并转发。
  11. 根据权利要求10所述的数据包快速转发装置，其特征在于，所述数据包是在MAC层即二层和/或IP层即三层转发的；所述相同特征信息包括：对于二层转发所有源MAC地址和目的MAC地址相同的报文，同一个组 播源的组播数据报文，TCP三次握手成功后续传数据的报文，UDP传输数据时源IP地址、目的IP地址、源端口信息目的端口信息都相同的报文。
  12. 根据权利要求11所述的数据包快速转发装置，其特征在于，所述快转分类指的是：生成快速转发表，其中，所述快速转发表记录所述快转分类后的数据包类别及对应的转发操作集；
    所述数据包属于所述数据包类别指的是：从数据包中提取的信息字段命中所述快速转发表中的数据包类别对应的相同特征信息。
  13. 根据权利要求12所述的数据包快速转发装置，其特征在于，所述数据包类别所包括的信息有：数据包的源MAC地址、目的MAC地址、虚拟局域网标识、源IP地址、目的IP地址、通信协议、源端口信息、目的端口信息。
  14. 根据权利要求13所述的数据包快速转发装置，其特征在于，所述快速转发表包括：对应MAC层的二层快速转发表、对应TCP/IP层的三层快速转发表；
    所述二层快速转发表中的数据包类别信息包括：源MAC地址、目的MAC地址、虚拟局域网标识；
    所述三层快速转发表的数据包类别信息包括：虚拟局域网标识、源IP地址、目的IP地址信息、通信协议、源端口信息、目的端口信息。
  15. 根据权利要求14所述的数据包快速转发装置，其特征在于，所述修改模块对数据包的修改包括：
    对应所述二层快速转发表的修改，包括：待转发的数据包的虚拟局域网标识信息的修改、二层网络协议的修改；
    对应所述三层快速转发表的修改，包括：待转发的数据包的源MAC地址的修改、目的MAC地址的修改、虚拟局域网标识的修改、源IP地址的修改、目的IP地址的修改、通信协议的修改、源端口信息的修改、目的端口信息的修改、PPPoE封装、TTL的修改。
  16. 根据权利要求15所述的数据包快速转发装置，其特征在于，所述源IP地址信息的修改和源端口信息的修改是在三层上行数据包的转发过程中有NAT时进行的；所述目的IP地址信息的修改和目的端口信息的修改是在三层下行数据包的转发过程中有NAT时进行的；所述PPPoE封装是在三层转发中涉及PPPoE端口信息时进行的；所述TTL的修改指的是三层转发数据包时TTL值减1。
  17. 根据权利要求10或16所述的数据包快速转发装置，其特征在于，所述修改模块，还用于修改数据包格式以适应指定转发的网络接口。
  18. 根据权利要求10所述的数据包快速转发装置，其特征在于，还包括：
    记录模块，用于记录数据包被防火墙拦截的信息，并根据所述数据包被防火墙拦截的信息，将与被拦截数据包在所述数据包类别中属于同类的数据包通过Linux系统的网络协议栈转发。
PCT/CN2014/000988 2013-11-22 2014-11-11 一种数据包快速转发方法及装置 WO2015074324A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310597300.8A CN103647716A (zh) 2013-11-22 2013-11-22 一种数据包快速转发方法及装置
CN201310597300.8 2013-11-22

Publications (1)

Publication Number Publication Date
WO2015074324A1 true WO2015074324A1 (zh) 2015-05-28

Family

ID=50252875

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/000988 WO2015074324A1 (zh) 2013-11-22 2014-11-11 一种数据包快速转发方法及装置

Country Status (2)

Country Link
CN (1) CN103647716A (zh)
WO (1) WO2015074324A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111510513A (zh) * 2020-01-03 2020-08-07 普联国际有限公司 一种map-e链路加速方法、装置、存储介质及网络设备
CN112087534A (zh) * 2020-09-12 2020-12-15 洪世协 一种简便可溯源无线路由器实现方法
CN112448912A (zh) * 2019-08-27 2021-03-05 中兴通讯股份有限公司 一种防报文攻击方法、装置及存储介质
CN113489737A (zh) * 2021-07-14 2021-10-08 芯河半导体科技(无锡)有限公司 一种基于netfilter的包过滤器的实现方法
CN115022225A (zh) * 2022-05-31 2022-09-06 东风电驱动系统有限公司 报文转发方法、装置、设备及可读存储介质

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103647716A (zh) * 2013-11-22 2014-03-19 上海斐讯数据通信技术有限公司 一种数据包快速转发方法及装置
CN104410541B (zh) * 2014-11-18 2017-09-15 盛科网络（苏州）有限公司 Vxlan内层虚拟机流量在中间交换机上进行统计的方法及装置
EP3073701B1 (en) * 2015-03-27 2017-10-04 Deutsche Telekom AG Network protection entity and method for protecting a communication network against fraud messages
CN104954262B (zh) * 2015-06-24 2017-11-24 上海斐讯数据通信技术有限公司 一种数据快速转发方法和系统
CN106330715A (zh) * 2015-06-30 2017-01-11 杭州华三通信技术有限公司 报文处理方法及装置
CN105591977A (zh) * 2015-08-28 2016-05-18 杭州华三通信技术有限公司 报文处理方法以及装置
CN105959236A (zh) * 2015-11-06 2016-09-21 西安交大捷普网络科技有限公司 提升网络防护设备吞吐性能的数据包转发方法
CN105959254B (zh) * 2015-12-02 2019-09-06 杭州迪普科技股份有限公司 处理报文的方法和装置
CN105939216B (zh) * 2016-03-16 2019-11-12 杭州迪普科技股份有限公司 报文传输的方法及装置
CN108096831B (zh) * 2016-11-25 2021-07-09 盛趣信息技术（上海）有限公司 网络游戏防加速控制系统及方法
CN110651451B (zh) * 2017-05-24 2021-03-02 瑞典爱立信有限公司 基于策略的路由系统中的路由表选择方法及网络设备
CN107682267B (zh) * 2017-09-21 2020-04-28 烽火通信科技股份有限公司 Linux设备的网络数据转发方法及系统
TW201921893A (zh) * 2018-12-14 2019-06-01 就肆電競股份有限公司 資料傳輸加速裝置
CN111371728B (zh) * 2018-12-25 2022-05-10 华为终端有限公司 一种处理方法及装置
CN110224932B (zh) * 2019-05-06 2021-06-15 烽火通信科技股份有限公司 一种数据快速转发的方法及系统
CN110572330A (zh) * 2019-09-17 2019-12-13 普联技术有限公司 实现转发加速功能和协议栈功能兼容的方法、装置及介质
CN113114569B (zh) * 2020-01-10 2023-06-02 北京京东尚科信息技术有限公司 数据流卸载的方法和装置
CN111404817B (zh) * 2020-03-24 2022-06-03 深圳市吉祥腾达科技有限公司 一种提升网络通信设备分片数据包转发性能的方法及系统
CN111800344A (zh) * 2020-07-08 2020-10-20 深圳市共进电子股份有限公司 数据转发方法、装置、路由器和可读存储介质
CN115883454A (zh) * 2021-09-27 2023-03-31 中兴通讯股份有限公司 无线电力终端的路由设置方法、无线电力终端和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100748090B1 (ko) * 2005-12-07 2007-08-09 한국전자통신연구원 고속 라우터에서의 패킷 처리 장치 및 그 방법
CN101442493A (zh) * 2008-12-26 2009-05-27 华为技术有限公司 Ip报文分发方法、集群系统和负载均衡器
CN103067473A (zh) * 2012-12-21 2013-04-24 中标软件有限公司 一种远程协助转发方法及系统
CN103647716A (zh) * 2013-11-22 2014-03-19 上海斐讯数据通信技术有限公司 一种数据包快速转发方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100591044C (zh) * 2006-10-16 2010-02-17 华为技术有限公司 建立转发过滤表的方法与装置
CN102123082A (zh) * 2011-01-14 2011-07-13 中兴通讯股份有限公司 数据包转发方法和设备
CN102821032B (zh) * 2011-06-10 2016-12-28 中兴通讯股份有限公司 一种快速转发数据包的方法及三层设备
CN103347014A (zh) * 2013-06-25 2013-10-09 深圳市共进电子股份有限公司 网络快速转发模块及网络快速转发实现方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100748090B1 (ko) * 2005-12-07 2007-08-09 한국전자통신연구원 고속 라우터에서의 패킷 처리 장치 및 그 방법
CN101442493A (zh) * 2008-12-26 2009-05-27 华为技术有限公司 Ip报文分发方法、集群系统和负载均衡器
CN103067473A (zh) * 2012-12-21 2013-04-24 中标软件有限公司 一种远程协助转发方法及系统
CN103647716A (zh) * 2013-11-22 2014-03-19 上海斐讯数据通信技术有限公司 一种数据包快速转发方法及装置

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112448912A (zh) * 2019-08-27 2021-03-05 中兴通讯股份有限公司 一种防报文攻击方法、装置及存储介质
CN111510513A (zh) * 2020-01-03 2020-08-07 普联国际有限公司 一种map-e链路加速方法、装置、存储介质及网络设备
CN111510513B (zh) * 2020-01-03 2022-08-30 普联国际有限公司 一种map-e链路加速方法、装置、存储介质及网络设备
CN112087534A (zh) * 2020-09-12 2020-12-15 洪世协 一种简便可溯源无线路由器实现方法
CN113489737A (zh) * 2021-07-14 2021-10-08 芯河半导体科技(无锡)有限公司 一种基于netfilter的包过滤器的实现方法
CN115022225A (zh) * 2022-05-31 2022-09-06 东风电驱动系统有限公司 报文转发方法、装置、设备及可读存储介质
CN115022225B (zh) * 2022-05-31 2023-11-10 东风电驱动系统有限公司 报文转发方法、装置、设备及可读存储介质

Also Published As

Publication number Publication date
CN103647716A (zh) 2014-03-19

Similar Documents

Publication Publication Date Title
WO2015074324A1 (zh) 一种数据包快速转发方法及装置
US11979322B2 (en) Method and apparatus for providing service for traffic flow
EP3424183B1 (en) System and method for dataplane-signaled packet capture in ipv6 environment
US9571382B2 (en) Method, controller, and system for processing data packet
CN102970227B (zh) 在asic中实现vxlan报文转发的方法和装置
JP4627669B2 (ja) パケット転送装置およびその転送制御方式
US10356037B2 (en) Address resolution rewriting
EP2773073B1 (en) Entry generation method, message receiving method, and corresponding device and system
WO2015143802A1 (zh) 业务功能链处理方法及装置
EP2959647A1 (en) Method and system for flow table lookup parallelization in a software defined networking (sdn) system
WO2015127752A1 (zh) 数据报文处理方法及装置
CN103532672A (zh) 一种sdn网络中分片报文乱序的处理方法及应用
WO2011072532A1 (zh) 报文处理方法、接入设备和通信系统
EP2712130B1 (en) Service control method and system for autonomous network
WO2019127134A1 (zh) 一种数据传送的方法和虚拟交换机
WO2014183518A1 (zh) 一种实现数据包转发的方法及系统
WO2022021818A1 (zh) 数据报文的处理方法及装置、存储介质、电子装置
US20180359181A1 (en) Ethernet frame transmission method in software defined networks (sdn)
WO2018001373A1 (zh) 报文限速的方法及装置
CN108418765B (zh) 远程流量监控负载分担的芯片实现方法和装置
CN108400911B (zh) 一种实现Micro-BFD协议的装置及方法
CN109803178B (zh) 一种终端升级方法和装置
US20160099891A1 (en) Packet processing method, apparatus and system
CN110336796B (zh) 一种通信方法和通信装置
CN102868642B (zh) 在asic中实现nvgre报文转发的方法和装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14864961

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 14864961

Country of ref document: EP

Kind code of ref document: A1