WO2016138845A1 - 一种实现协议报文上送cpu的方法和装置 - Google Patents

一种实现协议报文上送cpu的方法和装置 Download PDF

Info

Publication number
WO2016138845A1
WO2016138845A1 PCT/CN2016/074861 CN2016074861W WO2016138845A1 WO 2016138845 A1 WO2016138845 A1 WO 2016138845A1 CN 2016074861 W CN2016074861 W CN 2016074861W WO 2016138845 A1 WO2016138845 A1 WO 2016138845A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
protocol
layer
identifier
interface
Prior art date
Application number
PCT/CN2016/074861
Other languages
English (en)
French (fr)
Inventor
潘庭山
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP16758461.4A priority Critical patent/EP3267641A4/en
Priority to US15/555,163 priority patent/US20180054416A1/en
Publication of WO2016138845A1 publication Critical patent/WO2016138845A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/256—NAT traversal
    • H04L61/2564—NAT traversal for a higher-layer protocol, e.g. for session initiation protocol [SIP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/10—Packet switching elements characterised by the switching fabric construction
    • H04L49/109—Integrated on microchip, e.g. switch-on-chip
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/12—Shortest path evaluation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/35—Switches specially adapted for specific applications
    • H04L49/354—Switches specially adapted for specific applications for supporting virtual local area networks [VLAN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5061—Pools of addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5076—Update or notification mechanisms, e.g. DynDNS
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL

Definitions

  • This document relates to, but is not limited to, a LAN switching technology, and specifically relates to a method and apparatus for implementing a protocol message to be sent to a Central Processing Unit (CPU).
  • CPU Central Processing Unit
  • the switch generally includes a switch chip and a CPU connected to the switch chip.
  • the switch chip performs fast forwarding of data packets in Layer 2 and Layer 3, and Layer 2 and Layer 3 protocols exchange between switches. It is processed by the CPU inside the switch.
  • the switch chip sends the protocol packets to the CPU through internal register settings, internal entry settings, or access control list (ACL) settings.
  • ACL access control list
  • the current switch chip has a defect in the support of the protocol packet. In actual use, the internal device is sent, the internal entry is sent, and the ACL rule is sent to send all the required protocol packets to the CPU for processing. It can be seen that the processing of the protocol packets sent by the switch chip is complicated, and it takes up a lot of ACL resources.
  • the ACL is a ternary content addressable memory (TCAM).
  • TCAM ternary content addressable memory
  • the TCAM resource is relatively expensive.
  • the ACL entries supported by the switch chip are limited.
  • the ACL can flexibly support all functions of the switch chip. There are more ACL entries. Then it will affect the performance indicators of many functions of the switch chip.
  • ACL Address Resolution Protocol
  • the embodiment of the invention provides a method and a device for implementing a protocol message to be sent to a CPU, which can reduce the processing load of the CPU.
  • An embodiment of the present invention provides a method for implementing a protocol packet to be sent to a CPU, including:
  • the switch chip receives and parses the message
  • the switch chip searches for the identifier of the Layer 3 interface corresponding to the virtual LAN vlan identifier of the parsed packet in the preset vlan table, where the vlan table includes the vlan identifier and the identifier indicating whether it is a Layer 3 interface. Correspondence between them;
  • the switch chip determines whether the identifier of the Layer 3 interface is the identifier of the Layer 3 interface, and determines the protocol type packet of the parsed packet and the Layer 3 protocol packet in the pre-set report. The protocol types match and the packets are sent to the CPU.
  • the method further includes:
  • the switching chip determines whether the identifier that is the Layer 3 interface is an identifier that is not a Layer 3 interface, and performs processing on the packet without a Layer 3 related protocol packet.
  • the method further includes:
  • the switch chip determines that the protocol type of the parsed packet does not match the protocol type of the Layer 3 related protocol packet in the previous report, and does not send the packet to the CPU.
  • the protocol type of the Layer 3 related protocol packet in the foregoing report includes one or more of the following: an address resolution protocol ARP, an open shortest path first OSPF, and a dynamic host configuration protocol DHCP.
  • Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions for performing any of the methods described above.
  • An embodiment of the present invention further provides an apparatus for implementing a protocol packet to be sent to a CPU, including a receiving module and a processing module, where:
  • the receiving module is configured to receive and parse a message
  • the processing module is configured to: in the vlan table that is configured to be configured, the mapping of the virtual local area network vlan identifier corresponding to the parsed packet is an identifier of the layer 3 interface, where the vlan table includes the vlan identifier and indicates whether the layer is a layer 3 Correspondence between the identifiers of the interfaces;
  • the switch chip determines whether the identifier of the Layer 3 interface is the identifier of the Layer 3 interface, and determines the protocol type of the parsed packet and the protocol of the Layer 3 protocol packet in the previous report. The types match and the message is sent to the CPU.
  • processing module is further configured to:
  • the identifier of the Layer 3 interface is determined to be an identifier that is not a Layer 3 interface, and the packet is processed by a non-Layer 3 related protocol packet.
  • processing module is further configured to:
  • the protocol type of the Layer 3 related protocol packet in the foregoing report includes one or more of the following: an address resolution protocol ARP, an open shortest path first OSPF, and a dynamic host configuration protocol DHCP.
  • the embodiment of the present invention reduces the processing load of the CPU, and implements the accurate and convenient delivery of the protocol packets, which solves the problem that the current switching chip protocol packet sending operation is complicated and occupies excessive ACL resources, and may exist at the same time. Unnecessary packets are sent to the CPU.
  • FIG. 1 is a schematic diagram of a switch system in the related art
  • FIG. 3 is a schematic structural view of a device according to Embodiment 2 of the present invention.
  • FIG. 4 is a flowchart of an example protocol packet sent to a CPU according to an embodiment of the present invention.
  • This embodiment describes a method for implementing a protocol packet to be sent to a CPU. As shown in FIG. 2, the method includes the following steps:
  • Step 110 The switch chip receives and parses the message.
  • the packet enters the switch chip for normal parsing, and the virtual local area network (VLAN) identifier (the outermost vlan identifier) of the packet and the protocol type of the packet are parsed.
  • VLAN virtual local area network
  • Each protocol packet corresponds to a global register for storing packets of this protocol type.
  • the manner in which the switch chip parses the packet to obtain the vlan identifier can be implemented by using a well-known technology of the present invention, and is not intended to limit the scope of protection of the present invention, and details are not described herein again.
  • Step 120 The switch chip searches for the identifier of the Layer 3 interface corresponding to the vlan identifier of the parsed packet in the preset vlan table, and determines whether the identifier that is found to be the Layer 3 interface is three layers. ID of the interface, step 130 is performed;
  • a flag indicating whether the VLAN tag is a Layer 3 interface is set in advance. For example, if the VLAN tag is a Layer 3 interface, it indicates whether it is a Layer 3 interface. The ID of the Layer 3 interface is 0. If the VLAN ID is not a Layer 3 interface, the ID of the Layer 3 interface is 0. Indicates whether the ID of the Layer 3 interface is a global setting. If the vlan ID of the packet is a Layer 3 interface, the switch chip identifies the packet.
  • the switch If the VLAN tag is an identifier that is not a Layer 3 interface, the switch performs non-Layer 3 protocol packet processing on the packet according to the inbound port number and the protocol type.
  • the inbound port number is the port number on which the switch chip receives the packet.
  • the processing of the non-Layer 3 related protocol packet by the switch chip according to the inbound port number and the protocol type includes:
  • the switch chip finds the inbound port number in the preset port number, and determines that the protocol type of the parsed packet matches the packet type of the Layer 2 protocol packet that is set in advance, and the packet is matched. Send it to the CPU.
  • the switch chip does not find the inbound port number in the preset port number, or determines that the protocol type of the parsed packet does not match the packet type of the Layer 2 protocol packet.
  • the packet is sent to the CPU and forwarded according to the normal forwarding process of the switch chip.
  • the switch determines that the protocol type of the packet is matched with the protocol type of the Layer 2 protocol packet.
  • the switch determines that the protocol type of the packet is not matched with the protocol type of the Layer 2 protocol packet.
  • the pre-set port number can be implemented in various manners.
  • the port enable bitmap is stored in the switch chip, and each port corresponds to an enable bit (ie, one bit), and 1 is used to send the CPU to the CPU. 0 means not sent to the CPU.
  • Step 130 The switch chip determines that the protocol type of the parsed packet matches the protocol type of the Layer 3 related protocol packet in the pre-set report, and sends the packet to the CPU.
  • the switch chip determines the protocol type of the parsed packet and the three in the preset report. The protocol types of the layer-related protocol packets match.
  • the switch chip determines the protocol type of the packet and the Layer 3 protocol in the previous report. The protocol types of the text do not match.
  • the method further includes:
  • the switch chip determines that the protocol type of the parsed packet does not match the protocol type of the Layer 3 protocol packet in the previous report. The packet is not sent to the CPU.
  • the protocol types of the Layer 3 related protocol packets in the above report include one or more of the following: Address Resolution Protocol (ARP), Open Shortest Path First (OSPF), dynamic Host Configuration Protocol (DHCP, Dynamic Host Configuration Protocol).
  • ARP Address Resolution Protocol
  • OSPF Open Shortest Path First
  • DHCP Dynamic Host Configuration Protocol
  • the Layer 3 related protocol report text described herein is not necessarily a Layer 3 packet, that is, the Ethernet type may not be 0x0800, such as an ARP packet.
  • the protocol packets of the Layer 2 and Layer 3 switches are differentiated.
  • the Layer 2 protocol packets are sent based on the physical port.
  • the Layer 3 protocol packets are sent based on the VLAN interface.
  • a conditional packet may be sent to the CPU.
  • the vlan ID of the packet is enabled on the Layer 3 interface.
  • the protocol type of the packet belongs to the protocol type of the Layer 3 protocol packet.
  • the reporting process is controlled globally by the register, and is independent of the physical port and the vlan port, reducing processing complexity and saving hardware resources.
  • This embodiment describes an apparatus for implementing the method of the foregoing embodiment, as shown in FIG. 3, including a receiving module 210 and a processing module 220, where:
  • the receiving module 210 is configured to receive and parse a message
  • the processing module 220 is configured to: in the vlan table set in the preset, the identifier of the virtual local area network vlan identifier corresponding to the parsed packet is a identifier of the layer 3 interface, where the vlan table includes the vlan identifier and indicates whether the Corresponding relationship between the identifiers of the Layer 3 interfaces;
  • the switch chip determines whether the identifier of the Layer 3 interface is the identifier of the Layer 3 interface, and determines the protocol type of the parsed packet and the protocol of the Layer 3 protocol packet in the previous report. The types match and the message is sent to the CPU.
  • processing module 220 is further configured to:
  • the identifier of the Layer 3 interface is determined to be an identifier that is not a Layer 3 interface, and the packet is processed by a non-Layer 3 related protocol packet.
  • processing module 220 is further configured to:
  • the protocol type of the Layer 3 protocol packet in the preceding report includes one or more of the following: ARP, OSPF, and DHCP.
  • the receiving packet is an arp packet as an example.
  • Other types of protocol packets are referenced for execution.
  • the port 1 belongs to vlan 1
  • port 2 belongs to vlan 2.
  • a Layer 3 interface is configured for vlan 2 and a Layer 3 interface is not configured for vlan 1.
  • the vlan table of the vlan 2 is set globally.
  • the vlan2 is the Layer 3 interface vlan.
  • the protocol type is arp.
  • Vlan 1 does not need to be set.
  • the global setting of the report is used to record the protocol type of the Layer 3 protocol packets that can be reported to the CPU. In this example, the protocol type in the upper report includes the arp packet.
  • Port 1 has a large number of vlan 1 arp request packets to enter the switch to attack the cpu, and port 2 has vlan 2 arp request packets that need to be processed by the cpu.
  • the process of sending packets to the CPU is shown in Figure 4. The following describes the processing of port 1 incoming packets and port 2 incoming packets.
  • Port 1's arp request packet is processed as follows:
  • Step 1 The arp request packet enters the switch from port 1, and the switch chip parses the packet as an arp packet.
  • Step 2 Check the vlan table to determine whether the vlan ID is a Layer 3 interface. If the vlan of the packet is 1, the mapping between vlan 1 in the vlan table is the identifier of the Layer 3 interface. interface;
  • Step 3 Check the report to determine whether the protocol type of the packet is the protocol type of the Layer 3 protocol packet.
  • the arp packet is a Layer 2 packet but belongs to the Layer 3 protocol packet. The type of agreement in the match is matched;
  • step 3 can be omitted.
  • Step 4' Since the vlan of the packet does not belong to the Layer 3 interface vlan, the arp packet will not be sent to the CPU, and the purpose of attempting to attack the CPU is not achieved.
  • Packets that are not sent to the CPU are processed according to other forwarding rules of the switch chip, such as the ingress port number and protocol type.
  • Port 2's arp request packet is processed as follows:
  • Step 1 The arp request packet enters the switch from port 2, and the switch chip parses the packet as an arp packet.
  • Step 2 Check the vlan table to determine whether the vlan ID of the packet belongs to the Layer 3 interface.
  • the vlan of the vlan 2 is the ID of the Layer 3 interface. interface;
  • Step 3 Check the report to determine whether the protocol type of the packet is the protocol type of the Layer 3 protocol packet.
  • the arp packet is a Layer 2 packet but belongs to the Layer 3 protocol packet. The type of agreement in the match is matched;
  • Step 4 The switch chip according to the vlan of the packet belongs to the Layer 3 interface vlan, and the protocol type matches the protocol type in the previous report. Therefore, the arp packet is sent to the CPU for processing, and the normal arp packet is sent.
  • Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions for performing any of the methods described above.
  • each module/unit in the foregoing embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program in a storage and a memory by a processor. / instruction to achieve its corresponding function.
  • the invention is not limited to any specific form of combination of hardware and software.
  • the embodiment of the invention reduces the processing load of the CPU, and implements the accurate and convenient delivery of the protocol packets, which solves the problem that the current switching chip protocol packet sending operation is complicated, occupies excessive ACL resources, and unnecessary packets may exist. Send a question to attack the CPU.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

一种实现协议报文上送中央处理器CPU的方法和装置，包括：接收并解析报文，根据所述报文的虚拟局域网vlan标识查找vlan表，所述vlan表中包含vlan标识是否为三层接口的标识，根据所述vlan表判断所述vlan标识如果为三层接口，则根据所述vlan标识为三层接口的标识以及所述报文的协议类型判断是否将所述报文上送CPU。所述装置包括接收模块和转发模块。

Description

一种实现协议报文上送CPU的方法和装置 技术领域
本文涉及但不限于局域网交换技术，具体涉及一种实现协议报文上送中央处理器(CPU，Central Processing Unit)的方法和装置。
背景技术
如图1所示，对于交换机来说，一般都包括交换芯片以及与交换芯片相连的CPU，交换芯片对于数据报文进行二、三层硬件快速转发，交换机之间的二、三层协议交互一般由交换机内部的CPU来处理，交换芯片通过内部寄存器设置、内部表项设置或者访问控制列表(ACL，Access Control List)规则设置来实现协议报文上送CPU。目前的交换芯片对于协议报文上送支持都有缺陷，实际使用中一般需要综合内部寄存器上送、内部表项上送和ACL规则上送来实现所有需要的协议报文上送CPU处理。由此可见目前交换芯片上送协议报文处理复杂，而且会占用比较多的ACL资源。ACL都是三态内容寻址存储器(TCAM，ternary content addressable memory)，TCAM资源比较贵，交换芯片一般支持的ACL条目是有限的，ACL基本可以灵活支持交换芯片的所有功能，如果协议上送占用ACL条目多了。那么就会影响交换芯片很多功能的性能指标。
即使采用ACL资源，由于ACL资源的限制和全局的权衡，目前很多协议请求比如地址解析协议(ARP，Address Resolution Protocol)请求等都存在不必要的错误上送问题，导致有用的协议报文被攻击从而丢弃，同时会增加CPU不必要的处理负担。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提出了一种实现协议报文上送CPU的方法和装置，能够减少CPU的处理负担。
本发明实施例提供了一种实现协议报文上送CPU的方法，包括：
交换芯片接收并解析报文；
交换芯片在预先设置的vlan表中查找解析得到的报文的虚拟局域网vlan标识对应的表示是否为三层接口的标识，其中，所述vlan表中包含vlan标识和表示是否为三层接口的标识之间的对应关系；
交换芯片判断出查找到的表示是否为三层接口的标识为表示是三层接口的标识，判断出解析得到的报文的协议类型报文与预先设置的上报表中的三层相关协议报文的协议类型相匹配，将报文上送CPU。
可选地，该方法还包括：
所述交换芯片判断出所述查找到的表示是否为三层接口的标识为表示不是三层接口的标识，对所述报文进行非三层相关协议报文的处理。
可选地，该方法还包括：
所述交换芯片判断出所述解析得到的报文的协议类型与所述上报表中的三层相关协议报文的协议类型不匹配，不将所述报文上送所述CPU。
可选地，所述上报表中的三层相关协议报文的协议类型包括以下的一种或多种：地址解析协议ARP，开放式最短路径优先OSPF，动态主机配置协议DHCP。
本发明实施例还提出了一种计算机可读存储介质，存储有计算机可执行指令，计算机可执行指令用于执行上述描述的任意一个方法。
本发明实施例还提供了一种实现协议报文上送CPU的装置，包括接收模块和处理模块，其中：
所述接收模块，设置为接收并解析报文；
处理模块，设置为在预先设置的vlan表中查找解析得到的报文的虚拟局域网vlan标识对应的表示是否为三层接口的标识，其中，所述vlan表中包含vlan标识和表示是否为三层接口的标识之间的对应关系；
交换芯片判断出查找到的表示是否为三层接口的标识为表示是三层接口的标识，判断出解析得到的报文的协议类型与预先设置的上报表中的三层相关协议报文的协议类型相匹配，将报文上送CPU。
可选地，所述处理模块还设置为，
判断出所述查找到的表示是否为三层接口的标识为表示不是三层接口的标识，对所述报文进行非三层相关协议报文的处理。
可选地，所述处理模块还设置为，
判断出所述解析得到的报文的协议类型与所述上报表中的三层相关协议报文的协议类型不匹配，不将所述报文上送所述CPU。
可选地，所述上报表中的三层相关协议报文的协议类型包括以下的一种或多种：地址解析协议ARP，开放式最短路径优先OSPF，动态主机配置协议DHCP。
与相关技术相比较，本发明实施例减少了CPU的处理负担，实现了协议报文准确便捷上送，解决了目前交换芯片协议报文上送操作复杂，占用过多的ACL资源，同时可能存在不必要的报文上送攻击CPU的问题。
本发明实施例的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明实施例的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为相关技术中交换机系统示意图；
图2为本发明实施例一流程图；
图3为本发明实施例二装置结构示意图；
图4为本发明实施例应用示例协议报文上送CPU流程图。
本发明的实施方式
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
实施例一
本实施例描述实现协议报文上送CPU的方法，如图2所示，包括以下步骤：
步骤110，交换芯片接收并解析报文；
本步骤中，报文进入交换芯片进行正常的解析处理，解析出报文的虚拟局域网(vlan，Virtual Local Area Network)标识(最外层vlan标识)以及该报文的协议类型。每种协议报文对应一个全局寄存器，用于存储该种协议类型的报文。
其中，交换芯片如何对报文进行解析处理得到vlan标识可以采用本领域技术人员的公知技术实现，并不用于限定本发明的保护范围，这里不再赘述。
步骤120，交换芯片在预先设置的vlan表中查找解析得到的报文的vlan标识对应的表示是否为三层接口的标识，判断出查找到的表示是否为三层接口的标识为表示是三层接口的标识，执行步骤130；
在vlan表中预先设置一个表示vlan标识是否为三层接口的标识，例如设置1比特(bit)的表示是否为三层接口的标识，如果vlan标识为三层接口，则表示是否为三层接口的标识为1，如果vlan标识不是三层接口，则表示是否为三层接口的标识为0。表示是否为三层接口的标识为全局设置。如果报文的vlan标识为三层接口，那么交换芯片会对该报文进行标识。
如果所述vlan标识为表示不是三层接口的标识，则交换芯片根据入端口号和协议类型对报文进行非三层相关协议报文的处理。
其中，入端口号是指交换芯片接收到报文的端口号。
其中，交换芯片根据入端口号和协议类型对报文进行非三层相关协议报文的处理包括：
交换芯片在预先设置的端口号中查找到入端口号，且判断出解析得到的报文的协议类型与预先设置的二层相关协议报文的报文类型相匹配，将报文 上送CPU。
可选的，交换芯片在预先设置的端口号中查找不到入端口号，或判断出解析得到的报文的协议类型与预先设置的二层相关协议报文的报文类型不匹配，不将报文上送CPU，按照交换芯片的正常转发流程进行转发。
如果二层相关协议报文的协议类型包含有解析得到的报文的协议类型，交换芯片判断出解析得到的报文的协议类型与预先设置的二层相关协议报文的协议类型相匹配。
如果二层相关协议报文的协议类型不包含解析得到的报文的协议类型，交换芯片判断出解析得到的报文的协议类型与预先设置的二层相关协议报文的协议类型不匹配。
其中，预先设置的端口号可以采用多种方式实现，例如将端口使能位图保存在交换芯片中，每一个端口对应一个使能位(即一个比特位)，采用1表示上送CPU，采用0表示不上送CPU。
步骤130，交换芯片判断出解析得到的报文的协议类型与预先设置的上报表中的三层相关协议报文的协议类型相匹配，将报文上送CPU。
本步骤中，如果上报表中的三层相关协议报文的协议类型包含有解析得到的报文的协议类型，交换芯片判断出解析得到的报文的协议类型与预先设置的上报表中的三层相关协议报文的协议类型相匹配。
如果上报表中的三层相关协议报文的协议类型不包含解析得到的报文的协议类型，交换芯片判断出解析得到的报文的协议类型与预先设置的上报表中的三层相关协议报文的协议类型不匹配。
可选的，该方法还包括：
交换芯片判断出解析得到的报文的协议类型与预先设置的上报表中的三层相关协议报文的协议类型不匹配，不将报文上送CPU。
所述上报表中的三层相关协议报文的协议类型包括以下的一种或多种：地址解析协议(ARP，Address Resolution Protocol)，开放式最短路径优先(OSPF，Open Shortest Path First)，动态主机配置协议(DHCP，Dynamic Host Configuration Protocol)。
本文所述三层相关协议报文本身不一定是三层报文即以太网类型可能不是0x0800，例如ARP报文。
本实施例针对二三层交换机的协议报文进行区分，二层协议报文基于物理端口上送，三层相关协议报文基于vlan端口是否使能三层接口进行上送，即满足以下两个条件的报文才可能被上送CPU：报文的vlan标识使能三层接口，报文的协议类型属于预设的三层相关协议报文的协议类型。上报过程由寄存器全局控制，与物理端口、vlan端口均无关，降低处理复杂度，节省硬件资源。
实施例二
本实施例描述实现上述实施例一方法的装置，如图3所示，包括接收模块210和处理模块220，其中：
所述接收模块210，设置为接收并解析报文；
所述处理模块220，设置为在预先设置的vlan表中查找解析得到的报文的虚拟局域网vlan标识对应的表示是否为三层接口的标识，其中，所述vlan表中包含vlan标识和表示是否为三层接口的标识之间的对应关系；
交换芯片判断出查找到的表示是否为三层接口的标识为表示是三层接口的标识，判断出解析得到的报文的协议类型与预先设置的上报表中的三层相关协议报文的协议类型相匹配，将报文上送CPU。
可选地，处理模块220还设置为，
判断出所述查找到的表示是否为三层接口的标识为表示不是三层接口的标识，对所述报文进行非三层相关协议报文的处理。
可选的，处理模块220还设置为，
判断出所述解析得到的报文的协议类型与所述上报表中的三层相关协议报文的协议类型不匹配，不将所述报文上送所述CPU。
可选的，上报表中的三层相关协议报文的协议类型包括以下的一种或多种：ARP，OSPF，DHCP。
应用示例
下面结合应用示例对上述实施例方法进行具体说明。在以下示例中，以接收报文为arp报文为例进行说明，其他类型协议报文参照执行。
如图1所示的交换机，其中端口1属于vlan 1，端口2属于vlan 2。对于vlan 2配置了三层接口，对于vlan 1没有配置三层接口。由于vlan 2配置为三层接口，全局设置vlan 2的vlan表，标识该vlan2为三层接口vlan，协议类型为arp报文上送cpu。vlan 1不用设置。全局设置一上报表，用于记录允许上报CPU的三层相关协议报文的协议类型，在本示例中所述上报表中的协议类型包括arp报文。
端口1有大量vlan 1的arp请求报文进入交换机准备攻击cpu，端口2有vlan 2的arp请求报文需要cpu进行处理。报文上送cpu的流程如图4所示，下面对端口1进入报文和端口2进入报文的处理进行分别说明。
端口1的arp请求报文处理如下：
步骤1：arp请求报文从端口1进入交换机，交换芯片解析报文为arp报文；
步骤2：查vlan表判断报文携带vlan标识是否属于3层接口，由于报文的vlan为1，查找vlan表中vlan 1对应的表示是否为三层接口的标识，判断出vlan1不属于三层接口；
步骤3：查上报表判断报文的协议类型是否为预设的三层相关协议报文的协议类型，arp报文虽然本身是二层报文，但是属于三层相关协议报文，与上报表中协议类型相匹配；
在其他实施例中，步骤3可以省略。
步骤4’：由于报文的vlan不属于三层接口vlan，所以此arp报文不会上送cpu，企图攻击cpu的目的达不到。
不上送cpu的报文按照交换芯片的其他转发规则(例如入端口号和协议类型)进行处理。
端口2的arp请求报文处理如下：
步骤1：arp请求报文从端口2进入交换机，交换芯片解析报文为arp报文；
步骤2：查vlan表判断报文携带的vlan标识是否属于3层接口，由于报文的vlan为2，查找vlan表vlan 2对应的表示是否为三层接口的标识，判断出vlan 2属于三层接口；
步骤3：查上报表判断报文的协议类型是否为预设的三层相关协议报文的协议类型，arp报文虽然本身是二层报文，但是属于三层相关协议报文，与上报表中协议类型相匹配；
步骤4：交换芯片根据报文的vlan属于三层接口vlan，以及协议类型与上报表中协议类型相匹配，所以此arp报文上送cpu处理，进行正常的arp报文上送。
本发明实施例还提出了一种计算机可读存储介质，存储有计算机可执行指令，计算机可执行指令用于执行上述描述的任意一个方法。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。可选地，上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储与存储器中的程序/指令来实现其相应功能。本发明不限于任何特定形式的硬件和软件的结合。
虽然本发明所揭露的实施方式如上，但所述的内容仅为便于理解本发明而采用的实施方式，并非用以限定本发明。任何本发明所属领域内的技术人员，在不脱离本发明所揭露的精神和范围的前提下，可以在实施的形式及细节上进行任何的修改与变化，但本发明的专利保护范围，仍须以所附的权利 要求书所界定的范围为准。
工业实用性
本发明实施例减少了CPU的处理负担，实现了协议报文准确便捷上送，解决了目前交换芯片协议报文上送操作复杂，占用过多的ACL资源，同时可能存在不必要的报文上送攻击CPU的问题。

Claims (9)

  1. 一种实现协议报文上送中央处理器CPU的方法，包括：
    交换芯片接收并解析报文；
    交换芯片在预先设置的虚拟局域网vlan表中查找解析得到的报文的虚拟局域网vlan标识对应的表示是否为三层接口的标识，其中，所述vlan表中包含vlan标识和表示是否为三层接口的标识之间的对应关系；
    交换芯片判断出查找到的表示是否为三层接口的标识为表示是三层接口的标识，判断出解析得到的报文的协议类型与预先设置的上报表中的三层相关协议报文的协议类型相匹配，将报文上送CPU。
  2. 根据权利要求1所述的方法，该方法还包括：
    所述交换芯片判断出所述查找到的表示是否为三层接口的标识为表示不是三层接口的标识，对所述报文进行非三层相关协议报文的处理。
  3. 根据权利要求1所述的方法，该方法还包括：
    所述交换芯片判断出所述解析得到的报文的协议类型与所述上报表中的三层相关协议报文的协议类型不匹配，不将所述报文上送所述CPU。
  4. 根据权利要求1～3任意一项所述的方法，其中，
    所述上报表中的三层相关协议报文的协议类型包括以下的一种或多种：地址解析协议ARP，开放式最短路径优先OSPF，动态主机配置协议DHCP。
  5. 一种实现协议报文上送中央处理器CPU的装置，包括接收模块和处理模块，其中：
    所述接收模块，设置为接收并解析报文；
    所述处理模块，设置为在预先设置的虚拟局域网vlan表中查找解析得到的报文的虚拟局域网vlan标识对应的表示是否为三层接口的标识，其中，所述vlan表中包含vlan标识和表示是否为三层接口的标识之间的对应关系；
    交换芯片判断出查找到的表示是否为三层接口的标识为表示是三层接口的标识，判断出解析得到的报文的协议类型与预先设置的上报表中的三层相关协议报文的协议类型相匹配，将报文上送CPU。
  6. 根据权利要求5所述的装置，所述处理模块还设置为，
    判断出所述查找到的表示是否为三层接口的标识为表示不是三层接口的标识，对所述报文进行非三层相关协议报文的处理。
  7. 根据权利要求5所述的装置，所述处理模块还设置为，
    判断出所述解析得到的报文的协议类型与所述上报表中的三层相关协议报文的协议类型不匹配，不将所述报文上送所述CPU。
  8. 根据权利要求5～7任意一项所述的装置，其中，
    所述上报表中的三层相关协议报文的协议类型包括以下的一种或多种：地址解析协议ARP，开放式最短路径优先OSPF，动态主机配置协议DHCP。
  9. 一种计算机可读存储介质，存储有计算机可执行指令，计算机可执行指令用于执行权利要求1～4任意一项所述的方法。
PCT/CN2016/074861 2015-03-03 2016-02-29 一种实现协议报文上送cpu的方法和装置 WO2016138845A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16758461.4A EP3267641A4 (en) 2015-03-03 2016-02-29 Method and device realizing upload of protocol packet to cpu
US15/555,163 US20180054416A1 (en) 2015-03-03 2016-02-29 Method and device for uploading protocol packet to cpu

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510094446.X 2015-03-03
CN201510094446.XA CN105991391A (zh) 2015-03-03 2015-03-03 一种协议报文上送cpu的方法和装置

Publications (1)

Publication Number Publication Date
WO2016138845A1 true WO2016138845A1 (zh) 2016-09-09

Family

ID=56848761

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/074861 WO2016138845A1 (zh) 2015-03-03 2016-02-29 一种实现协议报文上送cpu的方法和装置

Country Status (4)

Country Link
US (1) US20180054416A1 (zh)
EP (1) EP3267641A4 (zh)
CN (1) CN105991391A (zh)
WO (1) WO2016138845A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114390120A (zh) * 2022-01-04 2022-04-22 烽火通信科技股份有限公司 一种对协议帧的处理方法和装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110677385B (zh) * 2019-08-27 2022-07-19 浪潮思科网络科技有限公司 一种基于vlan的arp分类及转发方法
CN111131090A (zh) * 2019-12-26 2020-05-08 盛科网络（苏州）有限公司 报文的处理方法及装置
CN112511527B (zh) * 2020-11-26 2022-10-21 杭州迪普科技股份有限公司 报文传输方法及装置
CN114745340A (zh) * 2022-03-23 2022-07-12 新华三技术有限公司合肥分公司 一种报文处理方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101115006A (zh) * 2007-08-21 2008-01-30 杭州华三通信技术有限公司 三层报文转发方法及路由设备和二层交换模块
US20110222538A1 (en) * 2010-03-12 2011-09-15 Bijendra Singh Method and System for L3 Bridging Using L3-To-L2 Mapping Database
CN102546348A (zh) * 2012-02-08 2012-07-04 中兴通讯股份有限公司 一种网络处理器实现多种三层接口的方法和网络处理器

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100694296B1 (ko) * 2005-11-08 2007-03-14 한국전자통신연구원 가상 인터페이스 기반의 2 계층 멀티캐스트 스위칭 및 3계층 멀티캐스트 라우팅 동시 제공 시스템 및 그 방법
CN101820383B (zh) * 2010-01-27 2014-12-10 中兴通讯股份有限公司 限制交换机远程访问的方法及装置
CN102158421B (zh) * 2011-05-25 2013-11-06 杭州华三通信技术有限公司 创建三层接口的方法及单元

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101115006A (zh) * 2007-08-21 2008-01-30 杭州华三通信技术有限公司 三层报文转发方法及路由设备和二层交换模块
US20110222538A1 (en) * 2010-03-12 2011-09-15 Bijendra Singh Method and System for L3 Bridging Using L3-To-L2 Mapping Database
CN102546348A (zh) * 2012-02-08 2012-07-04 中兴通讯股份有限公司 一种网络处理器实现多种三层接口的方法和网络处理器

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3267641A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114390120A (zh) * 2022-01-04 2022-04-22 烽火通信科技股份有限公司 一种对协议帧的处理方法和装置
CN114390120B (zh) * 2022-01-04 2023-06-09 烽火通信科技股份有限公司 一种对协议帧的处理方法和装置

Also Published As

Publication number Publication date
CN105991391A (zh) 2016-10-05
US20180054416A1 (en) 2018-02-22
EP3267641A1 (en) 2018-01-10
EP3267641A4 (en) 2018-02-28

Similar Documents

Publication Publication Date Title
US11729059B2 (en) Dynamic service device integration
CN109587065B (zh) 转发报文的方法、装置、交换机、设备及存储介质
US9977763B2 (en) Network proxy for high-performance, low-power data center interconnect fabric
US10341185B2 (en) Dynamic service insertion
CN107113240B (zh) 可扩展虚拟局域网报文发送方法、计算机设备和可读介质
WO2016138845A1 (zh) 一种实现协议报文上送cpu的方法和装置
US20150358232A1 (en) Packet Forwarding Method and VXLAN Gateway
US7894451B2 (en) Method of providing virtual router functionality
EP3282649B1 (en) Data packet forwarding
US10237130B2 (en) Method for processing VxLAN data units
US10397116B1 (en) Access control based on range-matching
US10057162B1 (en) Extending Virtual Routing and Forwarding at edge of VRF-aware network
WO2016101488A1 (zh) 一种三态内容可寻址存储器tcam查表方法及装置
US10616105B1 (en) Extending virtual routing and forwarding using source identifiers
EP3487123B1 (en) Message forwarding
US9984036B2 (en) Communication system, control apparatus, communication method, and program
WO2018019146A1 (zh) 设备探测
US9898069B1 (en) Power reduction methods for variable sized tables
WO2019196914A1 (zh) 一种发现转发路径的方法及其相关设备
US8605732B2 (en) Method of providing virtual router functionality
US8537831B2 (en) Method and system for common group action filtering in telecom network environments
US7817633B1 (en) Method of providing virtual router functionality through abstracted virtual identifiers
EP4304144A1 (en) Communication method and apparatus
WO2021098602A1 (zh) 一种报文转发方法、装置及分布式设备
US20200067842A1 (en) Sender side assisted flow classification

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16758461

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15555163

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2016758461

Country of ref document: EP