WO2017073033A1 - Flow processing device, communication system and flow processing method - Google Patents

Abstract

A core switch in a QinQ model receives frames having different IVIDs but having the same transmission source MAC address in some cases, and therefore a problem of MAC duplication occurs in the core switch. To solve this problem, this flow processing device is characterized by being provided with: an MAC address table 420 in which an MAC entry is registered; an MAC duplication table 490 in which in response to the updating of transmission destination information of the MAC entry on the basis of a received frame, a duplicate entry including information related to the frame is registered; and an access list table 450A in which in response to the registration of a plurality of duplicate entries related to each other in the MAC duplication table, a transfer entry for transferring the frame related to the plurality of duplicate entries is registered, wherein the frame related to the plurality of duplicate entries is transferred in accordance with the transfer entry.

Description

Flow processing apparatus, communication system, and flow processing method

The present invention relates to a flow processing device, a communication system, and a communication method.

As a network standard, there is IEEE (Institut of Electric and Electronics Engineers, Inc.) 802.1Q. IEEE 802.1Q is called QinQ.

Also, VLAN (Virtual LAN) is a technology for constructing a virtual LAN (Local Area Network) in a network.

In order to construct a large-scale virtual network, a virtual network configuration model (QinQ model) using QinQ is adopted.

In the QinQ model, the control device controls a plurality of flow processing devices using a control protocol such as OpenFlow based on the virtual network configuration set by the user or the host control device. For example, the QinQ model has a configuration in which a virtual bridge is arranged under a virtual network. In the QinQ model, a virtual network ID (IDentifier) and a virtual bridge ID managed by the flow control apparatus are associated with an OVID (Outer VLAN ID) and an IVID (Inner VLAN ID) of the frame, respectively. Thus, the QinQ model realizes MAC (Media Access Control) forwarding in units of the virtual bridge.

Here, Patent Document 1 describes that normal communication may not be possible in a network environment composed of virtual machines and network devices that are virtually constructed. Specifically, in Patent Document 1, in the above environment, if the MAC address set at the time of virtual machine creation is duplicated, normal communication cannot be performed with an operating virtual machine with the duplicated MAC address. It is described that it may be.

Patent Document 2 discloses that client devices are assigned to different subnets in order to prevent normal communication from being disabled due to MAC duplication. Specifically, in order to avoid the above, Patent Document 2 discloses that client devices are assigned to different subnets so that two client devices having the same MAC address are not assigned to the same subnet as necessary. ing.

JP 2013-168771 A Special table 2012-525018 gazette

As described above, the invention described in Patent Document 2 prevents MAC duplication by preventing two client devices having the same MAC address from being assigned to the same subnet.

However, in the invention described in Patent Document 2, since two client devices having the same MAC address cannot be assigned in the same subnet, there arises a problem that the flexibility of MAC address setting is reduced. In addition, the core switch in the QinQ model may receive a frame having the same transmission source MAC address although the IVID is different, and a MAC duplication problem occurs in the core switch.

In view of the above problems, the present invention provides a flow processing device, a communication system, and a flow processing method capable of avoiding erroneous transfer due to MAC duplication even when MAC duplication occurs in the flow processing device. That is.

According to the flow processing device of one embodiment of the present invention, the MAC address table in which the MAC entry is registered and the information related to the frame in accordance with the transmission destination information of the MAC entry being updated based on the received frame are displayed. A MAC duplication table for registering duplicate entries, and a transfer entry for transferring frames related to the plurality of duplicate entries in response to registration of a plurality of duplicate entries related to each other in the MAC duplication table And an access list table for transferring a frame related to a plurality of duplicate entries according to the transfer entry.

A communication system according to an aspect of the present invention includes a node that transfers a frame based on an instruction from a control device, and a flow processing device that transfers a frame received from the node based on a MAC address table in which a MAC entry is registered. The flow processing device includes a MAC duplication table for registering a duplicate entry including information related to the frame in response to the update of the transmission destination information of the MAC entry based on the received frame, and a MAC duplication An access list table for registering transfer entries for transferring frames related to the plurality of duplicate entries in response to the registration of a plurality of duplicate entries related to each other in the table, and a plurality of duplicate entries The frame related to is transferred according to the transfer entry.

The flow processing method according to one aspect of the present invention registers a MAC entry, and registers a duplicate entry including information related to the frame when the transmission destination information of the MAC entry is updated based on the received frame. In response to the registration of a plurality of duplicate entries related to each other, a transfer entry for transferring a frame related to the plurality of duplicate entries is registered, and a frame related to the plurality of duplicate entries is transferred. The transfer is performed according to the entry.

The flow processing apparatus, communication system, and flow processing method of the present invention can avoid erroneous transfer due to MAC duplication even when MAC duplication occurs in the flow processing apparatus.

It is a structural example of the communication system of 1st Embodiment. It is a structural example of the flow processing apparatus of 1st Embodiment. It is a flowchart which shows the operation example of the flow processing apparatus in 1st Embodiment. It is a structural example of the communication system of 2nd Embodiment. It is a structural example of the flow processing apparatus of 2nd Embodiment. It is a structural example of the entry stored in each table of 2nd Embodiment. It is a flowchart which shows the operation example of the flow processing apparatus in 2nd Embodiment. It is a structural example of the flow processing apparatus of 2nd Embodiment. It is another structural example of the flow processing apparatus of 2nd Embodiment. It is a flowchart which shows the other operation example of the flow processing apparatus in 2nd Embodiment. It is a flowchart which shows the other operation example of the flow processing apparatus in 2nd Embodiment. It is another structural example of the flow processing apparatus of 2nd Embodiment. It is a flowchart which shows the other operation example of the flow processing apparatus in 2nd Embodiment. It is another structural example of the flow processing apparatus of 2nd Embodiment. It is a flowchart which shows the other operation example of the flow processing apparatus in 2nd Embodiment. It is another structural example of the flow processing apparatus of 2nd Embodiment. It is a flowchart which shows the other operation example of the flow processing apparatus in 2nd Embodiment. It is another structural example of the flow processing apparatus of 2nd Embodiment. It is an example of composition of an outline of a 1st embodiment.

Hereinafter, embodiments and examples of the present invention will be described with reference to the drawings. Each embodiment is an exemplification, and the present invention is not limited to each embodiment. Note that the reference numerals of the drawings attached to the outline are attached to the respective elements for convenience as an example for facilitating understanding, and the description of the outline is not intended to be any limitation.

It should be noted that the same reference numerals and alphabets are attached to a plurality of similar configurations. Reference numerals are used to collectively describe these configurations.

<First Embodiment>
FIG. 1 is a diagram illustrating a configuration example of a communication system according to the first embodiment of the present invention.

As shown in FIG. 1, the communication system in the first embodiment includes a flow control device 100, an edge node 200, a terminal 300, and a flow processing device 400. The flow processing device 400 is included in the physical network 500.

The flow control apparatus 100 can manage a node that executes packet processing in, for example, a centralized management architecture.

The centralized management architecture is, for example, an OpenFlow network. In the OpenFlow network, a general switch mechanism is separated into the following modules. The first module is an OFC (OFC: OpenFlow Controller) that is a module that can be changed by externally programming the route determination process. The second module is an OFS (OFS: OpenFlow Switch) that is a module that performs only packet transfer processing.

The OFS in the OpenFlow network is an edge switch and a core switch that form the OpenFlow network and are under the control of the OFC. In the OpenFlow network, the OFC controls the behavior of the OFS by manipulating the OFS flow table.

The flow table is a table in which flow entries (Flow entries) defining predetermined operations (actions) to be performed on packets (communication data) that match (match) predetermined conditions (rules) are registered.

Each OFS holds at least one flow table. The OFC holds all the flow tables having the same contents as the flow tables of each subordinate OFS. That is, the OFC holds a master table for each OFS flow table. Note that “holding a flow table” means that the flow table is managed. As long as the flow table can be managed via a network or the like, the flow table may not actually exist within itself. For example, it is conceivable that OFC and OFS share the same flow table on the network.

The flow entry rules are defined by various combinations using any or all of the following addresses and ports, and are distinguishable. The address is a destination address (Destination Address) and a source address (Source Address) included in the header area of each protocol layer of the packet. A port is defined by various combinations using any or all of a destination port (Destination Port) and a source port (Source Port), and is distinguishable. Note that the above address includes a MAC address (Media Access Control Address) and an IP address (Internet Protocol Address). In addition to the above, information on the ingress port (Ingress Port) can also be used as a rule for the flow entry. In addition, as a flow entry rule, a part (or all) of a header area value of a packet indicating a flow expressed by a regular expression or a wild card “*” may be set as a flow entry rule. it can.

OFS processes a packet that matches the content described in the rule column according to the content described in the action column. The OFC can control processing for matching packets by registering such a flow entry in the OFS.

When a packet arrives, OFS reads the header information (transmission source information, transmission destination information, etc.) of the packet, and from the flow table of its own, a flow entry having a matching rule (hereinafter referred to as a matching flow entry and Search). If the search results in a matching flow entry, OFS processes the packet as described in the action for that flow entry. When a plurality of flow entries are found, the packet is processed according to the flow entry having the highest priority among the found flow entries. If no matching flow entry is found as a result of the search, OFS determines that the packet is a “first packet”. Then, the OFS inquires of the OFC about how to process the packet by transferring a copy (duplicate) of the packet to the OFC.

When the OFC receives an inquiry from the OFS, the OFC performs route calculation and derives an optimum route for transferring the inquiry packet to the transmission destination. The OFC additionally registers a new flow entry for configuring the derived route in the OFS flow table. At this time, the OFC additionally registers the same flow entry in its own flow table.

The edge node 200 is located at the boundary of the physical network 500 and executes processing for the packet. The edge node 200 includes, for example, an OFS function. Note that the edge node 200 includes not only the packet processing with the OFS function, but also the function of processing the packet by MAC learning, for example.

Note that the edge node 200 and the flow processing device 400 may be devices having the same configuration. In this case, when the device is arranged at the boundary of the physical network 500, the device becomes the edge node 200, and the transfer process is executed under the control of the flow control device 100. On the other hand, when the device is arranged in the core portion of the physical network 500, the device becomes the flow processing device 400, and executes a transfer process by MAC learning.

The terminal 300 is a device that performs communication via the edge node 200, the flow processing device 400, and the like. The terminal 300 is, for example, a mobile phone, a PC (Personal Computer), or a mobile router. Alternatively, the terminal 300 is, for example, a smart device (for example, a smart meter, a smart TV, or a wearable terminal that monitors household power consumption), an M2M (Machine to Machine) device, or the like. The M2M device includes, for example, an industrial device, a car, a healthcare device, and a home appliance in addition to the above device.

The flow processing device 400 is, for example, a core node included in a network (QinQ model) using QinQ. The flow processing apparatus 400 transfers the received frame 600 based on MAC learning.

In the QinQ model, the flow control device 100 remotely controls the edge node 200 and the flow processing device 400 using a control protocol such as OpenFlow based on the virtual network configuration set by the user or the host control device. The QinQ model is a simple configuration in which a virtual bridge is arranged under a virtual network. In the QinQ model, the virtual network ID and virtual bridge ID managed by the flow control apparatus 100 are associated with the OVID and IVID of the frame 600, respectively. As a result, the QinQ model realizes transfer control of MAC forwarding in units of virtual bridges in units of virtual networks.

However, the control of the flow processing device 400 is executed by MAC forwarding in units of Outer VLAN that can be controlled by a hardware chip. Therefore, if a different frame 600 having the same source MAC address and OVID but different IVID is input (received) from different ports in one flow processing device 400, MAC movement (MAC duplication) occurs. End up. That is, every time the different frame 600 is input, MAC movement (MAC duplication) occurs. That is, for a plurality of virtual bridges included in a specific virtual network, when a different frame 600 having the same source MAC address and OVID but different IVID is input, MAC movement (MAC duplication) occurs. Resulting in. That is, every time the frame 600 is input between the different IVIDs, MAC movement (MAC duplication) occurs. In this case, there arises a problem that the frame 600 having the transmission source MAC address as the transmission destination is transferred not only to the correct transmission destination but also to the wrong transmission destination.

FIG. 2 is a diagram illustrating a configuration example of the flow processing apparatus 400. The flow processing device 400 includes, for example, a control unit 401, a port 410, a MAC address table 420, a MAC duplication table 490, and an access list table 450. The control unit 401 and the MAC duplication table 490 are configured on software. The port 410, the MAC address table 420, and the access list table 450 are configured as hardware.

The port 410 is an interface that transmits and receives the frame 600.

The MAC address table 420 includes a MAC entry 421. In the MAC entry 421, the key is “OVID and destination MAC address”, and the action is “output port”. That is, when the frame 600 including “OVID and destination MAC address” specified in the MAC entry 421 is input, the flow processing device 400 can determine the output port.

Here, the flow processing device 400 receives the frame 600B of “OVID: N1, IVID: B1, transmission source MAC address: M1” from the edge node 200B. In this case, the MAC address table 420 of the flow processing device 400 determines that the transfer rule “transfers the frame with the transmission destination MAC address M1 and the OVID N1 to the port 410B” in response to receiving the frame 600B. (MAC learning).

After receiving the frame 600B, the flow processing device 400 receives the frame 600C of “OVID: N1, IVID: B2, transmission source MAC address: M1” from the edge node 200C. In this case, the MAC address table 420 of the flow processing device 400 indicates that the transfer rule that “the frame with the transmission destination MAC address M1 and the OVID N1 is transferred to the port 410B” in response to the reception of the frame 600C. Update. Here, the updated transfer rule is that “the frame with the transmission destination MAC address M1 and the OVID N1 is transferred to the port 410C”. This is a MAC move.

Subsequently, the flow processing apparatus 400 receives a frame 600A of “OVID: N1, IVID: B1, transmission source MAC address: M2, transmission destination MAC address: M1” from the edge node 200A. In this case, the flow processing apparatus 400 transfers the frame 600A according to the updated transfer rule “transfers the frame with the transmission destination MAC address M1 and the OVID N1 to the port 410C”. Here, in the frame 600A, the transmission destination MAC address is “M1”, and the original transfer destination is “port 410B”. However, as a result of updating the MAC address table 420 based on the frame 600C, there arises a problem that the frame 600A is transferred to the “port 410C” different from the original transfer destination (“port 410B”). Further, every time the frame 600B and the frame 600C are received, the MAC address table 420 is rewritten (MAC moves). Therefore, there is a problem that the frame 600A is transferred to “port 410B” at one time and transferred to “port 410C” at another time.

Therefore, the flow processing apparatus 400 in the first embodiment includes the MAC duplication table 490 and solves the problem due to the MAC duplication.

The control unit 401 of the flow processing device 400 responds to the reception of the frame 600 (for example, the frame 600B and the frame 600C) in which the source MAC address and the OVID overlap from each of the different input ports as follows. Operate. The control unit 401 registers a transfer rule using the transmission destination MAC address, OVID, and IVID in the MAC duplication table 490. For example, when the flow processing apparatus 400 receives the frame 600C following the frame 600B, the flow processing apparatus 400 operates as follows. In the MAC duplication table 490, the flow processing device 400, based on the frame 600C, “MAC duplication entry indicating that the transmission destination MAC address is M1, the OVID is N1, and the IVID is B2 is transferred to the port 410C”. 491 is learned. When the flow processing apparatus 400 receives the frame 600B again after receiving the frame 600C, the MAC movement occurs again in the MAC address table 420. Therefore, the control unit 401 stores, in the MAC duplication table 490, based on the frame 600B, the MAC duplication indicating that “the frame with the transmission destination MAC address of M1, the OVID of N1, and the IVID of B1 is transferred to the port 410B”. The entry 491 is learned.

The control unit 401 of the flow processing device 400 operates as follows according to the fact that a plurality of MAC duplication entries 491 having the same transmission destination MAC address and OVID are registered in the MAC duplication table 490. That is, the control unit 401 deletes the transfer rule related to the duplicate entry from the MAC address table 420. The flow processing apparatus 400, for example, stores in the MAC duplication table 490 “Destination MAC address is M1, OVID is N1, IVID is B2” and “Destination MAC address is M1, OVID is N1, and IVID is B1”. When is registered, it operates as follows. That is, the flow processing device 400 deletes the related transfer rule from the MAC address table 420 that “transfers the frame having the destination MAC address M1 and the OVID N1 to the port 410B”. Here, the transfer rule to be deleted is a transfer rule having the same MAC duplicate entry 491 and “destination MAC address and OVID”.

The control unit 401 of the flow processing apparatus 400 sets an output MAC duplication entry 491 (transfer rule) corresponding to the transfer rule learned in the MAC duplication table 490 in the access list table 450. For example, the control unit 401 operates as follows according to the fact that a plurality of duplicate entries having the same “destination MAC address” and “OVID” are registered in the MAC duplication table 490. That is, the control unit 401 registers an output entry (MAC duplicate UC (Unified Communication) output entry 453) in the access list table 450. The MAC duplicate UC output entry 453 is an entry whose keys are “destination MAC address”, “OVID”, and “IVID” and whose action is “destination port”. For example, two transfer rules are registered in the access list table 450. The first transfer rule is a transfer rule indicating that “a frame having a transmission destination MAC address of M1, an OVID of N1, and an IVID of B1 is transferred to the port 410B”. The second transfer rule is a transfer rule indicating that “a frame with a destination MAC address of M1, an OVID of N1, and an IVID of B2 is transferred to the port 410C”.

As a result, the flow processing apparatus 400 can perform transfer in consideration of “IVID”, and can transfer the frame 600 to the original transfer destination. For example, when receiving the frame 600A from the edge node 200A, the flow processing device 400 operates as follows. The flow processing device 400 transfers the frame 600A according to the transfer rule included in the access list table 450, which “transfers the frame with the destination MAC address M1, the OVID N1, and the IVID B1 to the port 410B”. Forward to port 410B.

FIG. 3 is a flowchart showing an operation example of the flow processing apparatus 400 in the first embodiment.

The flow processing device 400 receives different frames 600 having the same transmission source address from different ports 410 (S101). For example, the flow processing device 400 receives a frame 600B of “OVID: N1, IVID: B1, and transmission source MAC address: M1” from the edge node 200B. On the other hand, the flow processing device 400 receives a frame 600C of “OVID: N1, IVID: B2, source MAC address: M1” from the edge node 200C, for example.

The control unit 401 of the flow processing device 400 detects that a MAC move has occurred in the MAC address table 420 due to the reception of the frames 600 having the same transmission source address from different ports 410 (S102). . In response to receiving frame 600B, MAC address table 420 learns a transfer rule that “transfers a frame with destination MAC address M1 and OVID N1 to port 410B” (MAC learning). Thereafter, the MAC address table 420 updates the first transfer rule to the second transfer rule in response to reception of the frame 600C (MAC movement). The first transfer rule is a transfer rule indicating that “a frame with a destination MAC address of M1 and an OVID of N1 is transferred to the port 410B”. The second transfer rule is a transfer rule indicating that “a frame with a destination MAC address of M1 and an OVID of N1 is transferred to the port 410C”. The control unit 401 detects that the MAC movement has occurred.

The control unit 401 registers the MAC duplication entry 491 related to the received frame 600 in the MAC duplication table 490 (S103). Specifically, the control unit 401, based on the frame 600C, “transfers the frame with the transmission destination MAC address M1, the OVID N1, and the IVID B2 to the port 410C, for the MAC duplication table 490” The MAC duplication entry 491 is learned. For example, when the frame 600B is received again after the frame 600C, the control unit 401 operates as follows. That is, based on the frame 600B, the control unit 401 learns the MAC duplication entry 491 indicating that “the frame having the transmission destination MAC address M1, the OVID N1, and the IVID B2 is transferred to the port 410C”.

The control unit 401 of the flow processing device 400 operates as follows according to the fact that a plurality of MAC duplication entries 491 having the same transmission destination MAC address and OVID are registered in the MAC duplication table 490. In other words, the control unit 401 deletes the transfer rule related to the MAC duplicate entry 491 from the MAC address table 420 (S104). For example, the control unit 401 stores in the MAC duplication table 490 that “destination MAC address is M1, OVID is N1, IVID is B2,” and “destination MAC address is M1, OVID is N1, and IVID is B1”. If registered, it operates as follows. The control unit 401 deletes the related transfer rule from the MAC address table 420 that “transfers the frame with the destination MAC address M1 and the OVID N1 to the port 410B (or port 410C)”.

Specifically, the control unit 401 deletes the MAC entry 421 as a transfer rule.

The control unit 401 sets an entry for output (transfer rule) corresponding to the transfer rule learned in the MAC duplication table 490 in the access list table 450 (S105). For example, the control unit 401 operates as follows according to the fact that a plurality of duplicate entries having the same “destination MAC address” and “OVID” are registered in the MAC duplication table 490. That is, the control unit 401 registers an output entry (MAC duplicate UC output entry 453) in the access list table 450.

The flow processing device 400 transfers the received frame 600 according to the MAC duplicate UC output entry 453 (S106). For example, when receiving the frame 600A, the flow processing device 400 operates as follows. The flow processing device 400 transfers the frame 600A according to the transfer rule included in the access list table 450, which “transfers the frame with the destination MAC address M1, the OVID N1, and the IVID B1 to the port 410B”. Forward to port 410B.

As described above, the flow processing apparatus 400 includes the MAC duplication table 490 that operates on software, and sets a transfer rule that takes into account “IVID” when a duplicate MAC occurs. Therefore, the flow processing apparatus 400 can transfer the frame 600 to the correct transmission destination even when MAC duplication occurs.

[Outline of First Embodiment]
The outline of the first embodiment will be described with reference to the drawings. FIG. 19 is a diagram illustrating a schematic configuration example of the first embodiment. The flow control device 400 includes a MAC address table 420, a MAC duplication table 490, and an access list table 450.

The MAC address table 420 registers the MAC entry 421.

The MAC duplication table 490 registers a duplication entry including information related to the frame in response to the transmission destination information of the MAC entry 421 being updated based on the received frame. An example of a duplicate entry is a MAC duplicate entry 491.

The access list table 450 registers a transfer entry for transferring a frame related to a plurality of duplicate entries in response to registration of a plurality of duplicate entries related to each other in the duplicate table. An example of the transfer entry is a MAC duplicate UC output entry 453.

19, the flow control device 400 of FIG. 19 transfers frames related to a plurality of duplicate entries according to the transfer entry, similarly to the flow processing device 400 of FIG. 2.

That is, the flow processing apparatus 400 of FIG. 19 includes the MAC duplication table 490, as with the flow processing apparatus 400 of FIG. 2, and sets a transfer rule that takes into account “IVID” when a duplicate MAC occurs. To do. Therefore, the flow processing apparatus 400 of FIG. 19 can transfer the frame 600 to the correct transmission destination even when MAC duplication occurs.

<Second Embodiment>
FIG. 4 is a diagram illustrating a configuration example of a communication system according to the second embodiment of the present invention.

Note that the technique of the second embodiment is applicable to both the first embodiment and the embodiments described later.

4, the communication system includes, for example, a flow control device 100, an edge node 200, a terminal 300, and a flow processing device 400. Note that the edge node 200 and the terminal 300 have the same configurations as the edge node 200 and the terminal 300 of the communication system in the first embodiment shown in FIG.

The flow control device 100 sets the virtual network 700 and the virtual bridge 710 in response to a request from a user or a host control device, for example.

The physical network 500 includes, for example, the edge node 200 and the flow processing device 400, and provides a physical environment for realizing the transfer of the frame 600 in the virtual network using the virtual network 700A and the virtual bridges 710A and 710B. To do. The flow control apparatus 100 performs settings on the physical network 500 necessary for realizing virtual communication between the terminals 300 in the virtual network 700 for the edge node 200 to be managed. For example, the flow control apparatus 100 instructs the edge node 200A to perform frame conversion of the frame 600A in order to transfer the frame 600A transmitted from the terminal 300A on the virtual network 700A. More specifically, the flow control apparatus 100 associates the OVID of the frame 600A received from the terminal 300A with the ID: N1 of the virtual network 700A for the edge node 200A. Then, the flow control apparatus 100 instructs frame conversion for associating the IVID of the frame 600A with the ID: B1 of the virtual bridge 710A.

In the flow processing device 400, the frame 600B (OVID: N1, IVID: B1, source MAC address: M1) and the frame 600C (OVID: N1, IVID: B2, source MAC address: M1) are IVID (virtual). Bridge) is different. However, the OVID and the source MAC address are the same. Therefore, when the MAC address table 420 included in the flow processing device 400 receives the frame 600B and the frame 600C, MAC movement occurs. Therefore, if the flow processing apparatus 400 receives the frame 600A of “OVID: N1, IVID: B1, transmission source MAC address: M1, transmission destination MAC address: M1” and performs transfer according to the MAC address table 420, an error occurs. Transfers can occur.

Therefore, when a MAC duplication occurs in the frame 600 received from a different input source, the flow processing device 400 uses, for example, the software MAC duplication table 490 to avoid erroneous transfer due to the MAC movement.

FIG. 5 is a diagram illustrating a configuration example of the flow processing device 400 according to the second embodiment. The flow processing device 400 includes a port 410, a frame conversion table 430, a VLAN table 440, a MAC address table 420, and an access list table 450. The flow processing apparatus 400 includes a frame processing unit 460, a MAC duplication processing unit 470, a hardware processing unit 480, and a MAC duplication table 490.

In the flow processing device 400, the port 410, the frame conversion table 430, the VLAN table 440, the MAC address table 420, and the access list table 450 are configured in hardware. The frame processing unit 460, the MAC duplication processing unit 470, the hardware processing unit 480, and the MAC duplication table 490 are configured in software.

Here, the frame processing unit 460 of the flow processing device 400 detects the MAC movement when the frame 600B and the frame 600C pass through the hardware MAC address table 420. The MAC move is a process in which the transfer rule is rewritten in the transfer rule having the same OVID and destination MAC address in the MAC address table 420. For example, when the frame 600B passes, the MAC address table 420 learns a transfer rule that “a frame with a destination MAC address of M1 and an OVID of N1 is transferred to the port 410B”. The MAC address table 420 has the following transfer rule that “when the frame 600C passes after the frame 600B passes,“ transfer the frame with the destination MAC address M1 and the OVID N1 to the port 410B ”: Rewrite. That is, the MAC address table 420 rewrites the transfer rule with a transfer rule that “transfers a frame with the destination MAC address M1 and the OVID N1 to the port 410C”.

As described above, although the frames 600B and 600C have different IVIDs, the OVID and the source MAC address are the same, so the key information (OVID and MAC address) learned in the MAC address table 420 of the flow processing device 400 is the same. It becomes. Therefore, every time the frames 600B and 600C are input, the MAC entry 421 (transfer rule) in the MAC address table 420 repeats the MAC movement between the ports 410B and 410C. Therefore, when the flow processing apparatus 400 receives the frame 600A having the MAC address: M1 as the transmission destination, the flow processing apparatus 400 transmits the frame 600A to the port 410C of the MAC entry 421 (transfer rule) of the MAC address table 420. Therefore, the flow processing apparatus 400 transmits not only to the port 410B that is the correct transmission destination but also to the port 410C that is the wrong transmission destination.

Therefore, the flow processing apparatus 400 includes a MAC duplication table 490 to prevent erroneous transfer due to MAC movement.

The port 410 is an interface that transmits and receives the frame 600. The received frame 600 is subjected to pipeline processing in the order of the port 410, the frame conversion table 430, the VLAN table 440, the MAC address table 420, and the access list table 450.

The frame conversion table 430 is a table for performing VLAN conversion of the frame 600. Note that the frame conversion table 430 has a function for updating the frame 600 and can also execute other actions for the frame 600. In the second embodiment, the frame conversion table 430 is used, for example, to execute a MAC learning cancel action.

The VLAN table 440 includes a VLAN entry 441A. In the VLAN entry 441A, the key is “OVID” and the action is “frame relay (for example, an action for proceeding to processing to the MAC address table 420 in the subsequent stage)”. If there is no entry corresponding to the input frame 600 in the VLAN table 440, the frame 600 is discarded. The VLAN table 440 executes registration / update / deletion of the VLAN entry 441A according to an instruction of the flow control device 100 or a configuration of the flow processing device 400.

The MAC address table 420 includes a MAC entry 421. In the MAC entry 421, the key is “OVID and transmission destination MAC address”, and the action is “output port” designation. That is, when the frame 600 including “OVID and destination MAC address” specified in the MAC entry 421 is input, the output port can be determined. The MAC entry 421 is automatically registered / updated / deleted by hardware. If there is no MAC entry 421 with “OVID and destination MAC address” included in the frame 600 input to the MAC address table 420 as a key, MAC learning is performed (that is, a new MAC entry 421 is registered). ) When the MAC entry 421 exists, but the output port 410 specified in the MAC entry 421 is different from the input port 410 of the frame 600, the following occurs. That is, the MAC entry 421 updates the output port information (port 410 identifier, port number, etc.) designated in the MAC entry 421 to the input port information (port 410 identifier, port number, etc.) of the frame 600. (MAC move).

In the MAC address table 420, if the frame 600 matching the key of the MAC entry 421 is not received for a time exceeding the predetermined “aging setting time”, the MAC entry 421 is deleted.

The access list table 450 includes two logical tables, an access list table 450A for frame transfer and an access list table 450B for MAC duplication monitoring. When a frame 600 that hits (HIT) an entry included in the access list table 450 is input, the action of the hit entry is applied to the frame 600.

Also, the access list table 450 has “entry priority” indicating the priority when applied to the frame 600 in the logical table. For example, each entry included in the access list table 450 includes a priority, and when there are a plurality of entries that hit the input frame 600, the action specified by the entry with the higher priority is applied to the frame 600. Priority is applied. In the drawing of the second embodiment, an entry described at a higher level (upper position) in the access list table 450 is a higher priority entry.

The UC output entry 451A included in the access list table 450A (for frame transfer) is an entry in which only the frame 600 hit (HIT) in the MAC entry 421 of the MAC address table 420 is hit (HIT). The UC output entry 451A has a role of outputting the frame 600 from the port 410 specified by the MAC entry 421.

When the frame 600 does not hit (HIT) the UC output entry 451A (when MAC learning is not performed), the frame 600 hits the Flooding output entry 452A having a lower priority than the UC output entry 451A (HIT). To do. Then, the frame 600 is output as Flooding. The UC output entry 451A and the Flooding output entry 452A are registered / updated / deleted in the access list table 450A in accordance with an instruction from the flow control apparatus 100.

When the MAC movement in the MAC address table 420 occurs, the frame processing unit 460 receives the frame 600 that has caused the MAC movement or a copy thereof. The frame processing unit 460 receives the frame 600 hit (HIT) in the monitoring entry 454A or a copy thereof. The frame processing unit 460 notifies the MAC duplication processing unit 470 of the frame 600 or a copy thereof.

The MAC duplication processing unit 470 registers an entry in the MAC duplication table 490 based on the information (header information and the like) of the frame 600 received from the frame processing unit 460. For example, the MAC duplication processing unit 470 registers the MAC duplication entries 491A and 491B corresponding to the frames 600A and 600B in the MAC duplication table 490, and manages them as a MAC entry including a format including IVID.

In addition, the MAC duplication processing unit 470 registers / updates / deletes entries in each hardware table based on the information (header information and the like) of the frame 600 received from the frame processing unit 460 to the hardware processing unit 480. Instruct. For example, the MAC duplication processing unit 470 registers the aging entries 431A and 431B in the hardware frame conversion table 430 based on the information of the MAC duplication entries 491A and 491B in the MAC duplication table 490. Instruct. The aging entries 431A and 431B have a role of detecting aging when the frames 600A and 600B are not input.

In the aging entry 431, the key is “OVID, IVID, source MAC address, input port”, and the action is “MAC learning cancellation and WriteMetadata”. The MAC learning cancellation has a role of preventing MAC learning when a frame 600 that hits (HIT) the entry 431 for aging is input to the MAC address table 420. WriteMetadata has a role of holding that the aging entry 431 is hit (HIT) as frame information.

Also, in the MAC duplicate UC output entry 453, the key is “VID, IVID, destination MAC address” and the action is “port output”.

Also, the MAC duplication processing unit 470 instructs the access list table 450A to register the MAC duplication UC output entries 453A and 453B. The MAC duplicate UC output entries 453A and 453B have a role to output the frame 600 in which the duplicate MAC has occurred to the correct port 410. For example, the access list table 450A registers, as the MAC duplicate UC output entry 453A, that “the frame with the destination MAC address M1, the OVID N1, and the IVID B1 is transferred to the port 410B”. In addition, the access list table 450A registers, as the MAC duplicate UC output entry 453B, that “the frame with the transmission destination MAC address M1, the OVID N1, and the IVID B2 is transferred to the port 410C”.

The hardware processing unit 480 registers / updates / deletes an entry in each hardware table in accordance with an instruction from the MAC duplication processing unit 470. Also, the hardware processing unit 480 detects the age-out of the MAC duplication entry 491 from the statistical information (frame statistics) of the frame 600 of the aging entry 431. When the hardware processing unit 480 detects the age-out, the hardware processing unit 480 notifies the MAC duplication processing unit 470 of the age-out.

As described above, the MAC duplication UC output entry 453 and the aging entry 431 can avoid erroneous transfer in the flow processing device 400 and can follow aging. In addition, the MAC duplication processing unit 470 instructs the deletion of the MAC entry 451A and the registration of the monitoring entry 454A for each table configured by hardware. By deleting the MAC entry 451A, even if new MAC duplication further occurs, MAC learning can be performed quickly on the hardware, and the frame 600 transfer processing can be shifted to UC transfer. It becomes.

The monitoring entry 454A has a role of notifying the MAC duplication processing unit 470 operating on software of the newly generated frame 600 that causes the MAC duplication. The MAC duplication processing unit 470 registers a MAC duplication entry 491 for a new MAC duplication in the MAC duplication table 490, and registers an aging entry 431 and a MAC duplication UC output entry 453 in each table on the hardware. Therefore, the flow processing device 400 can dynamically cope with MAC duplication.

In the monitoring entry 454A, the key is “OVID, transmission source MAC address, Metadata”, and the action is “copy frame 600 to software”. Based on the metadata set in the aging entry 431, the metadata is registered under the condition that only the frame 600 that has not hit the aging entry 431 is hit (HIT). That is, Metadata is used to detect only newly generated MAC duplication and notify the software.

FIG. 6 is a diagram showing a configuration example of entries stored in each table described above. As shown in FIG. 6, in the MAC duplication entry 491, the key is “OVID, IVID, destination MAC address”, and the action is “designate output port”. The MAC entry 421 has a key “OVID, destination MAC address” and an action “designate output port”. In the VLAN entry 441A, the key is “OVID” and the action is “frame relay”. In the aging entry 431, the key is “OVID, IVID, transmission source MAC address, input port”, and the action is “MAC learning cancel, WriteMetadata”. In the MAC duplicate UC output entry 453, the key is “OVID, IVID, transmission destination MAC address”, and the action is “port designation”. In the monitoring entry 454A, the key is “OVID, transmission source MAC address, Metadata”, and the action is “copy frame to software”.

FIG. 7 is a flowchart showing an operation example of the flow processing apparatus 400 in the second embodiment.

The terminal 300A and the terminal 300B communicate with each other via the flow processing device 400 (S201). Specifically, the flow processing device 400 receives the frame 600A of “OVID: N1, IVID: B1, transmission source MAC address: M2, transmission destination MAC address: M1” from the port 410A, and passes through the port 410B. Forward. Further, the flow processing device 400 receives the frame 600B of “OVID: N1, IVID: B1, transmission source MAC address: M1, transmission destination MAC address: M2” from the port 410B, and transfers it through the port 410A.

FIG. 8 is a diagram illustrating a configuration example of the flow processing device 400 when the terminal 300A and the terminal 300B communicate with each other.

The flow processing device 400 receives the frame 600A from the terminal 300A via the port 410A. As a result, the MAC address table 420 of the flow processing device 400 learns the MAC entry 421B that “transfers the frame having the transmission destination MAC address M2 and the OVID N1 to the port 410A”. On the other hand, the flow processing apparatus 400 receives the frame 600B from the terminal 300B via the port 410B. As a result, the MAC address table 420 of the flow processing device 400 learns the MAC entry 421A that “transfers the frame having the transmission destination MAC address M1 and the OVID N1 to the port 410B”. As a result, as shown in FIG. 8, the MAC address table 420 learns the MAC entry 421A and the MAC entry 421B. In the flow processing apparatus 400 of FIG. 8, the MAC entry 421C and the MAC entry 421D are learned in advance.

When the flow processing device 400 receives the frame 600B, the transfer processing of the frame 600B is executed according to the MAC entry 421B registered in the MAC address table 420. When the flow processing device 400 receives the frame 600A, the transfer processing of the frame 600A is executed according to the MAC entry 421A registered in the MAC address table 420.

Also, as shown in FIG. 9, the access list table 450A registers a UC output entry 451A and a Flooding output entry 452A. As shown in FIG. 9, the frame 600 that hits the MAC entry 421 registered in the MAC address table 420 is transferred from the port 410 specified by the MAC entry 421 according to the UC output entry 451A. For example, the frame 600A is transferred from the port 410A designated by the MAC entry 421A in accordance with the UC output entry 451A.

Next, the flow processing device 400 receives the frame 600C of “OVID: N1, IVID: B2, transmission source MAC address: M1, transmission destination MAC address: M5” from the port 410C (S202). The frame 600C hits (HIT) the VLAN entry 441A of the VLAN table 440, and proceeds to the processing of the MAC address table 420 (S203).

When the flow processing device 400 receives the frame 600C, the MAC entry 421A of the MAC address table 420 is rewritten with the content “transfer frame with destination MAC address M1 and OVID N1 to port 410C”. (MAC move). That is, the frame 600C is the same key as “OVID: N1, destination MAC address M1” of the MAC entry 421A that has already been learned in the MAC address table 420, and the port 410 is different. Therefore, the flow processing device 400 updates the port of the MAC entry 421A to the input port 410C of the frame 600C (S204).

The flow processing apparatus 400 transfers the frame 600C according to the MAC entry 421C of the transmission destination learned in advance in the MAC address table 420 and the entry 451A for UC output registered in the access list table 450A (S205).

The flow processing device 400 notifies the frame processing unit 460 of the frame 600C in response to the occurrence of MAC movement (MAC duplication) in the MAC address table 420. The frame processing unit 460 notifies the frame 600C to the MAC duplication processing unit 470 (S206).

The MAC duplication processing unit 470 registers the MAC duplication entry 491B in the MAC duplication table 490 based on information (for example, header information) included in the frame 600C (S207). The MAC duplication entry 491B is an entry that uses “OVID: N1, IVID: B2, transmission destination MAC address: M1” as a key and “port 410C” as an output port.

The MAC duplication processing unit 470 instructs the hardware processing unit 480 to delete the MAC entry 421A. The hardware processing unit 480 deletes the instructed MAC entry 421A (S208).

By deleting the MAC entry 421A, it is possible to move to UC transfer promptly by MAC learning regardless of whether the next received frame 600 is 600C or 600B.

In addition, the flow processing device 400 is not a MAC duplication, and the MAC 600 is not notified to the software when the MAC is moved. I do.

FIG. 9 is a diagram illustrating a configuration example of the flow processing device 400 when the frame 600C is received via the port 410C of the flow processing device 400 in the state of FIG.

In the MAC address table 420 of the flow processing device 400, since the MAC movement occurs when the frame 600C is input, the frame processing unit 460 receives the notification of the frame 600C.

The MAC duplication processing unit 470 registers the MAC duplication entry 491B in the MAC duplication table 490 when the frame processing unit 460 is notified of the frame 600C.

In the MAC duplicate entry 491B, the key is “OVID, IVID, destination MAC address”, and the action is “output port”. That is, the MAC duplication entry 491 manages the MAC entry 421 including the IVID that cannot be expressed by hardware by software.

The key of the MAC duplicate entry 491B is “OVID: N1, IVID: B2, destination MAC address: M1”, and the action is “port 410C”. The MAC duplication entry 491B is set based on the frame 600C.

The MAC entry 421A is deleted via the hardware processing unit 480 according to an instruction from the MAC duplication processing unit 470. By deleting the MAC entry 421A, the frame 600A having the MAC address: M1 as a transmission destination hits (HITF) the Flooding output entry 452A of the access list table 450A, and is output as Flooding.

FIG. 10 is a flowchart illustrating another operation example of the flow processing apparatus 400 according to the second embodiment. FIG. 10 is a flowchart illustrating an operation example when the flow processing apparatus 400 receives the frame 600C from the port 410C after the operation of FIG.

The flow processing device 400 receives the frame 600C of “OVID: N1, IVID: B2, transmission source MAC address: M1, transmission destination MAC address: M5” from the port 410C (S301).

In the VLAN table 440 of the flow processing device 400, the frame 600C hits (HIT) the VLAN entry 441A, and proceeds to the processing of the MAC address table 420 (S302).

The flow processing apparatus 400 registers the MAC entry 421A in the MAC address table 420 because there is no entry with “OVID: N1, destination MAC address: M1” corresponding to the frame 600C as a key (S303).

The flow processing device 400 executes a transfer process for the frame 600C according to the MAC entry 421C of the transmission destination learned in advance in the MAC address table 420 and the UC output entry 451A of the access list table 450A (S304).

FIG. 11 is a flowchart illustrating another operation example of the flow processing apparatus 400 according to the second embodiment. FIG. 11 is a flowchart illustrating an operation example when the flow processing apparatus 400 receives the frame 600B from the port 410B after the operation of FIG.

The flow processing device 400 receives the frame 600B of “OVID: N1, IVID: B1, transmission source MAC address: M1, transmission destination MAC address: M2” via the port 410B (S401).

In the flow processing apparatus 400, the frame 600B hits (HIT) the VLAN entry 441A of the VLAN table 440, and proceeds to the processing of the MAC address table 420 (S402).

When the flow processing device 400 receives the frame 600B, the MAC entry 421A of the MAC address table 420 is rewritten with the content “transfer frame with the destination MAC address M1 and OVID N1 to the port 410B”. (MAC move). That is, the frame 600B is the same key as “OVID: N1, transmission MAC address M1” of the MAC entry 421A that has already been learned in the MAC address table 420, and the port 410 is different. Therefore, the flow processing device 400 updates the port of the MAC entry 421A to the input port 410B of the frame 600B (S403).

The flow processing device 400 transfers the frame 600B according to the MAC entry 421B learned in advance in the MAC address table 420 and the UC output entry 451A registered in the access list table 450A (S404).

The destination flow processing device 400 notifies the frame processing unit 460 of the frame 600B in response to the occurrence of MAC movement in the MAC address table 420. The frame processing unit 460 notifies the frame 600B to the MAC duplication processing unit 470 (S405).

The MAC duplication processing unit 470 registers the MAC duplication entry 491A in the MAC duplication table 490 based on information (for example, header information) included in the frame 600B (S406). The MAC duplicate entry 491A is an entry having “OVID: N1, IVID: B1, transmission destination MAC address: M1” as a key and “port 410B” as an output port.

The MAC duplication processing unit 470 causes MAC duplication (MAC migration) due to the presence of a plurality of entries having the same “OVID: N1, destination MAC address: M1” but different “IVID” in the MAC duplication table 490. (S407).

The MAC duplication processing unit 470 instructs the hardware processing unit 480 to register “aging entries 431A and 431B” in the frame conversion table 430. Further, the MAC duplication processing unit 470 instructs the hardware processing unit 480 to register “MAC duplication UC output entries 453A and 453B” in the access list table 450A (S408).

By the above operation, the MAC duplicate UC output entry 453 having higher priority than the UC output entry 451A and the Flooding output entry 452A is registered. Therefore, the flow processing apparatus 400 hits (HITs) the MAC duplicated UC output entry 453 for the frame 600 having the destination MAC address M1, such as the frame 600A, regardless of the presence or absence of the MAC entry 421A on the hardware. . Therefore, the flow processing apparatus 400 can output the frame 600 whose destination MAC address is M1 to the correct destination port 410.

The MAC duplication processing unit 470 instructs the hardware processing unit 480 to delete the MAC entry 421A (S409). In addition, the MAC duplication processing unit 470 instructs the access list table 450B to register the monitoring entry 454A (S409).

FIG. 12 is a diagram illustrating a configuration example of the flow processing device 400 when the frame 600C is further input from the port 410B after the frame 600C is input from the port 410C in the state of FIG.

The MAC address table 420 learns the MAC entry 421A by inputting the frame 600C. Thereafter, in the MAC address table 420, MAC movement (MAC duplication) occurs due to the input of the frame 600B. Therefore, the frame processing unit 460 receives the notification of the frame 600B in response to occurrence of MAC movement (MAC duplication).

In response to receiving the notification from the frame processing unit 460, the MAC duplication processing unit 470 registers the MAC duplication entry 491A in the MAC duplication table 490.

The MAC duplication processing unit 470 registers the aging entries 431A and 431B in the frame conversion table 430 via the hardware processing unit 480. Also, the MAC duplication processing unit 470 registers the MAC duplication UC output entries 453A and 453B via the hardware processing unit 480.

The aging entry 431A and the MAC duplicate UC output entry 453A are hardware entries corresponding to the MAC duplicate entry 491A, and are set based on the “key” and “action” of the MAC duplicate entry 491A. Similarly, the aging entry 431B and the MAC duplicate UC output entry 453B are hardware entries corresponding to the MAC duplicate entry 491B, and are set based on the “key” and “action” of the MAC duplicate entry 491B. In the hardware configuration of the flow processing device 400, the aging entry 431 and the MAC duplicated UC output entry 453 operate as the role of MAC forwarding in the inner VLAN unit.

When the flow processing apparatus 400 illustrated in FIG. 12 receives the frame 600A, the MAC address table 420 does not include a MAC entry 421 that hits (HIT). However, the flow processing apparatus 400 outputs to the port 410B, which is the correct transmission destination, in accordance with the UC output entry 451A and the MAC duplicate UC output entry 453A.

Here, conversely to the pattern of FIG. 12, there may be a case where the MAC movement by the frame 600C occurs again in the state where the MAC duplicate entry 491B corresponding to the frame 600C exists and the frame 600C is notified to the software. . In this case, an aging entry 431B corresponding to the MAC duplication entry 491B, a MAC duplication UC output entry 453B, and a monitoring entry 454A are registered. Thereafter, the entry registration for the frame 600B is performed when the frame 600B is notified to the software by the monitoring entry 454A. In this case, since only the MAC duplication entry 491B is registered, it is unknown whether MAC duplication has occurred or not. Therefore, if only the MAC duplication entry 491B is registered even after a predetermined time has elapsed, it is determined that the MAC duplication is resolved, and the aging entry 431B, the MAC duplication UC output entry 453B, and the monitoring entry 454A are deleted. There is a need.

FIG. 13 is a diagram illustrating an operation example when the flow processing device 400 receives the frame 600D from the port 410D in the state of FIG.

The flow processing apparatus 400 receives the frame 600D of “OVID: N1, IVID: B3, transmission destination MAC address: M1, transmission source MAC address: M4” from the port 410D (S501).

In the flow processing device 400, the frame 600D proceeds to the processing of the MAC address table 420 by hitting (HIT) the VLAN entry 441A of the VLAN table 440 (S502).

The flow processing device 400 does not have an entry in the MAC address table 420 with “OVID: N1, destination MAC address: M1” corresponding to the frame 600D as a key. Therefore, the flow processing apparatus 400 registers the MAC entry 421A whose key is “OVID: N1, destination MAC address: M1” and “port 410D” is the output port (S503).

In the flow processing apparatus 400, immediately after the MAC entry 421A is registered in response to the reception of the frame 600D, the frame 600D of “OVID: N1, IVID: B3, transmission destination MAC address: M1” is as follows. The frame 600D hits (HIT) the MAC entry 421 of the MAC address table 420, and does not hit (HIT) because the MAC duplicate UC output entry 453 does not match the key, and hits (HIT) the UC output entry 451A. . Therefore, the frame 600D can be transmitted to the correct transmission destination (port 410D).

The flow processing device 400 executes a transfer process for the frame 600D according to the MAC entry 421D registered in the MAC address table 420 in advance and the UC output entry 451A in the access list table 450A of the transmission destination (S504).

The flow processing device 400 transmits the frame 600D to the frame processing unit 460 by the action of the monitoring entry 454A. The frame processing unit 460 notifies the frame 600D to the MAC duplication processing unit 470 (S505).

The MAC duplication processing unit 470 registers the MAC duplication entry 491C in the MAC duplication table 490 based on information (such as header information) included in the frame 600D. However, the MAC duplication processing unit 470 registers the MAC duplication entry 491C in the MAC duplication table 490 with “OVID: N1, IVID: B3, destination MAC address: M1” as a key, and the output port as “port 410D” ( S506).

The MAC duplication processing unit 470 instructs the hardware processing unit 480 to register the aging entry 431C and the MAC duplication UC output entry 453C (S507). The flow processing apparatus 400 transmits the frame 600D of “OVID: N1, IVID: B3, transmission MAC address: M1” to the correct output port 410D by registering the MAC duplicate UC output entry 453C. Is possible.

The MAC duplication processing unit 470 instructs the hardware processing unit 480 to delete the MAC entry 421A (S508). The hardware processing unit 480 instructs to delete the MAC entry 421A. Therefore, even when duplication occurs again by receiving another frame 600 including “OVID: N1, transmission source MAC address: M1”, the MAC entry 421A is deleted, and UC transfer can be performed. Note that the processing of the flow processing device 400 when the duplication occurs again is the same as the operation example illustrated in FIG.

FIG. 14 is a diagram illustrating a configuration example of the flow processing device 400 when the frame 600D is input from the port 410D in the state of FIG.

The flow processing device 400 learns the MAC entry 421A in the MAC address table 420 by receiving the frame 600D. Further, the flow processing device 400 hits (HIT) both the UC output entry 451A and the monitoring entry 454A in the access list table 450.

By hitting (HIT) the monitoring entry 454A, the frame 600D is notified to the frame processing unit 460.

The MAC duplication processing unit 470 registers the MAC duplication entry 491C, and registers the aging entry 431C and the MAC duplication UC output entry 453C via the hardware processing unit 480.

In addition, the hardware processing unit 480 instructs to delete the MAC entry 421A, and the MAC entry 421A is deleted.

FIG. 15 is a flowchart showing an operation example of the flow processing device 400 when the input of the frame 600D is stopped from the state of FIG. 14 and the hardware processing unit 480 detects the aging-out of the entry 431C for aging.

The hardware processing unit 480 detects the aging-out of the aging entry 431C by stopping the reception of the frame 600D in the flow processing device 400 (S601).

The hardware processing unit 480 notifies the age-out to the MAC duplication processing unit 470 (S602).

The hardware processing unit 480 deletes the MAC duplication entry 491C in the MAC duplication table 490 (S603).

The MAC duplication processing unit 470 determines that the MAC duplication continues because there are a plurality of entries with different IVIDs in the MAC duplication table 490 (S604).

The MAC duplication processing unit 470 instructs the hardware processing unit 480 to delete the aging entry 431C and the MAC duplication UC output entry 453C.

FIG. 16 shows an example of the configuration of the flow processing device 400 when the reception of the frame 600D to the flow processing device 400 is stopped and the hardware processing unit 480 detects the aging-out entry 431C in the state of FIG. FIG.

The MAC duplication processing unit 470 deletes the MAC duplication entry 491C that is no longer necessary, and deletes the aging entry 431C and the MAC duplication UC output entry 453C via the hardware processing unit 480.

FIG. 17 is a flowchart illustrating an operation example when the reception of the frame 600C in the flow processing device 400 is stopped from the state of FIG. 16 and the hardware processing unit 480 detects the aging-out of the entry 431B for aging.

If the hardware processing unit 480 stops receiving the frame 600C in the flow processing device 400, the hardware processing unit 480 detects the aging-out of the entry 431B for aging (S701).

The hardware processing unit 480 notifies the MAC duplication processing unit 470 of the detection of age-out (S702).

The hardware processing unit 480 deletes the MAC duplication entry 491B from the MAC duplication table 490 (S703).

The MAC duplication processing unit 470 determines that the MAC duplication has been resolved because there are not a plurality of entries with different IVIDs in the MAC duplication table 490 (S704).

The MAC duplication processing unit 470 deletes the MAC duplication entry 491A of the MAC duplication table 490.

The MAC duplication processing unit 470 instructs the hardware processing unit 480 to delete the aging entries 431A and 431B and the MAC duplication UC output entries 453A and 453B. When the MAC duplication processing unit 470 instructs the deletion, the flow processing device 400 can return to the MAC forwarding processing in the normal state in which the MAC duplication hardware entry is not used.

FIG. 18 shows an example of the configuration of the flow processing device 400 when the flow processing device 400 stops receiving the frame 600C and the hardware processing unit 480 detects the aging entry 431B age-out in the state of FIG. FIG.

The MAC duplication processing unit 470 determines that the MAC duplication has been eliminated, and deletes the MAC duplication entries 491A and 491B. Then, the MAC duplication processing unit 470 deletes the aging entries 431A and 431B, the MAC duplication UC output entries 453A and 453B, and the monitoring entry 454A via the hardware processing unit 480.

As described above, the flow processing apparatus 400 includes the MAC duplication table 490, and sets a transfer rule that considers “IVID” in response to occurrence of a duplicate MAC. Therefore, the flow processing apparatus 400 can transfer the frame 600 to the correct transmission destination even when MAC duplication occurs.

<Third Embodiment>
In the third embodiment of the present invention, the flow processing apparatus 400 in the case where a MAC movement occurs due to a different frame 600 having the same “OVID, IVID, MAC address” being input from different ports 410 is described. It is embodiment regarding a process. Note that the technique of the third embodiment can be applied to any of the first embodiment, the second embodiment, and the embodiments described later.

Since the configuration example of the communication system according to the third embodiment is the same as the configuration example of the communication system according to the second embodiment illustrated in FIG. 4, detailed description thereof is omitted. In addition, since the configuration example of the flow processing apparatus 400 of the third embodiment is the same as the configuration example of the flow processing apparatus 400 of the second embodiment illustrated in FIG. 5, detailed description is omitted.

The flow processing apparatus 400 creates the MAC entry 421A by inputting the frame 600C to the port 410C from the state after the completion of the processing in FIG. In this state, when the frame 600C is input from the port 410E (not shown), the port 410 is different from the “port 410C” designated by the action of the MAC entry 421A existing in the MAC address table 420, and therefore the MAC movement occurs. Therefore, the frame 600C is notified to the MAC duplication processing unit 470 again. The MAC duplication processing unit 470 updates the port of the MAC duplication entry 491B from “port 410C” to “port 410E” based on the information regarding the input port 410 included in the frame 600C. The subsequent operation example of the flow processing apparatus 400 is the same as the operation example of the flow processing apparatus 400 of the second embodiment.

Further, when the frame 600C is input from the port 410E instead of the port 410C from the state after the completion of the processing in FIG. 11, the flow processing device 400 operates as follows. The input port at the time of entry registration included in the key of the aging entry 431B corresponding to the frame 600C is 410C, and the frame 600C does not hit (HIT) the aging entry 431B. Therefore, the flow processing apparatus 400 performs MAC learning in the MAC address table 420 and registers the MAC entry 421A.

Also, the frame 600C hits (HIT) the monitoring entry 454A, and the MAC duplication processing unit 470 is notified of the frame 600C. The MAC duplication processing unit 470 updates the port information included in the MAC duplication entry 491B from “port 410C” to “port 410E” based on the information regarding the input port included in the frame 600C. In response to the update of the MAC duplication entry 491B, the MAC duplication processing unit 470 deletes / adds the aging entry 431B to the hardware processing unit 480 (deletion / addition is performed because the key port information is updated). The MAC duplication processing unit 470 also updates the action port 410 of the MAC duplication UC output entry 453B.

In the above processing, MAC flapping occurs due to the same “OVID, IVID, MAC address”, and the notification of the frame 600 to the software frequently occurs. Therefore, in order to reduce the load on the CPU of the flow processing device 400, it is desirable to provide a protection time for the entry and not to update the entry within the protection time.

As described above, when a MAC move occurs due to a different frame 600 having the same “OVID, IVID, MAC address” being input from different ports 410, the following occurs. That is, the MAC duplication processing unit 470 updates the port 410 of the MAC duplication entry 491 or the action port 410 of the MAC duplication UC output entry 453B. Therefore, erroneous transfer due to the occurrence of duplication of the frame 600 even when a MAC move occurs due to a different frame 600 having the same “OVID, IVID, MAC address” being input from different ports 410. Can be prevented.

<Fourth Embodiment>
The fourth embodiment of the present invention is an embodiment that suppresses an increase in the number of entries in the access list table 450. The technique of the fourth embodiment can be applied to any of the first embodiment, the second embodiment, and the third embodiment.

The configuration example of the communication system according to the fourth embodiment is the same as the configuration example of the communication system according to the second embodiment illustrated in FIG. Further, the configuration example of the flow processing apparatus 400 of the fourth embodiment is the same as the configuration example of the flow processing apparatus 400 of the second embodiment illustrated in FIG. 5, and thus detailed description thereof is omitted.

Note that VRRP (Virtual Router Redundancy Protocol) used in the following description is a protocol for making the default gateway redundant.

The access list table 450 generally has a smaller number of entries that can be registered than the MAC address table 420. In this case, for example, if VRRP routers are connected to a network and frames 600 for advertisement (the same MAC address) are exchanged between all the VLANs, a large amount of table resources are consumed. The access list table 450 may have fewer entries that can be registered than the MAC address table 420. In this case, for example, if a VRRP router is connected to a network and a frame 600 (the MAC address is the same) used for advertising is exchanged between all the VLANs, the resources of the access list table 450 are consumed much. End up. Therefore, the flow processing apparatus 400 according to the fourth embodiment avoids exhaustion of entry resources in the access list table 450 when duplicate MAC addresses are determined in advance in the network configuration or the like.

The flow processing apparatus 400 according to the fourth embodiment enables a static MAC duplication entry 491 to be registered in the access list table 450 by configuration.

The flow processing device 400 inputs the MAC address and the MAC address mask as parameters to the static MAC duplicate entry 491 of the access list table 450 according to the configuration.

The MAC duplication processing unit 470 registers the MAC learning cancel entry in the frame conversion table 430 via the frame processing unit 460 in accordance with the addition of the static MAC duplication entry 491 by the configuration. In addition, the MAC duplication processing unit 470 deletes the MAC entry 421 included in the MAC address / mask set by the configuration from the MAC address table 420.

In the MAC learning cancel entry, the key is “MAC address mask designation of source MAC address” and the action is “MAC learning cancel”. If the source MAC address of the input frame 600 is included in the key condition of the MAC learning cancellation entry by the MAC learning cancellation entry, the flow processing device 400 performs MAC learning in the MAC address table 420. No longer done. That is, since the MAC entry 421 does not exist, the frame 600 having the MAC address included in the “MAC address / mask” of the MAC learning cancel entry has a flooding operation.

The MAC learning cancellation entry competes with the dynamically added aging entry 431 and MAC duplicated UC output entry 453. Therefore, the MAC learning cancellation entry has priority over the statically set MAC duplication entry 491, and the aging entry 431 and the MAC duplication UC output entry 453 having the conditions included in the MAC address / mask need to be deleted. is there.

Note that, as described above, when a statically set MAC duplication entry 491 is used, a Flooding operation is performed. Therefore, it is desirable to set the minimum configuration in consideration of the communication band.

As described above, it is possible to suppress an increase in the number of entries in the access list table 450 by using the MAC duplicate entry 491 that is statically set.

As mentioned above, although embodiment of this invention was described, this invention is not limited to each above-mentioned embodiment. The present invention can be implemented based on modifications, substitutions, and adjustments of the embodiments. The present invention can also be implemented by arbitrarily combining the embodiments. That is, the present invention includes various modifications and corrections that can be realized in accordance with all the disclosed contents and technical ideas of the present specification. The present invention can also be applied to the technical field of SDN (Software-Defined Network).

This application claims priority based on Japanese Patent Application No. 2015-213566 filed on Oct. 30, 2015, the entire disclosure of which is incorporated herein.

DESCRIPTION OF SYMBOLS 100 Flow control apparatus 200 Edge node 300 Terminal 400 Flow processing apparatus 401 Control part 410 Port 420 MAC address table 421 MAC entry 430 Frame conversion table 431 Aging entry 440 VLAN table 441 VLAN entry 450 Access list table 451 UC output entry 452 Flooding output entry 453 MAC duplication UC output entry 454 Monitoring entry 460 Frame processing unit 470 MAC duplication processing unit 480 Hardware processing unit 490 MAC duplication table 491 MAC duplication entry 500 Physical network 600 frame

Claims (10)

1. A MAC address table in which MAC entries are registered;
   A MAC duplication table for registering duplicate entries including information related to the frame in response to the transmission destination information of the MAC entry being updated based on the received frame;
   An access list table for registering a transfer entry for transferring the frame related to the plurality of duplicate entries in response to registration of the plurality of duplicate entries related to each other in the MAC duplication table; Prepared,
   The flow processing apparatus, wherein the frame related to the plurality of duplicate entries is transferred according to the entry for transfer.
2. Control means for deleting, from the MAC address table, the MAC entries corresponding to the frames related to a plurality of duplicate entries, in response to registration of the plurality of duplicate entries related to each other in the MAC duplication table. The flow processing apparatus according to claim 1, further comprising:
3. In response to registration of the duplicate entry corresponding to each of the plurality of frames having the same Outer VLAN ID and MAC address in the MAC duplication table, each of the plurality of frames is registered in the access list table. The flow processing apparatus according to claim 1, wherein the transfer entry for transfer is registered.
4. In response to registration of a plurality of duplicate entries related to each other in the MAC duplication table, the entry for transfer using the Outer VLAN ID, the Inter VLAN ID, and the MAC address as keys is registered in the access list table. The flow processing apparatus according to claim 1, wherein the flow processing apparatus is configured as described above.
5. Registering the duplicate entry including the information related to the frame in the MAC duplication table in response to the update of the information regarding the destination port contained in the MAC entry based on the received frame. The flow processing apparatus according to claim 1, wherein the flow processing apparatus is characterized.
6. 6. The transmission destination information of the MAC entry in the MAC address table is updated in response to the input of different frames having the same OVID and transmission source MAC address from different ports. The flow processing apparatus according to any one of the above.
7. A frame conversion table for registering an entry for aging including an action for canceling transfer using the MAC entry included in the MAC address table with respect to the frame in which the entry for transfer is registered. The flow processing apparatus according to claim 1, wherein the flow processing apparatus is characterized.
8. A node that forwards a frame based on an instruction from the control device;
   A flow processing device that transfers the frame received from the node based on a MAC address table in which MAC entries are registered, and
   The flow processing apparatus includes:
   A MAC duplication table for registering duplication entries including information related to the frame in response to the transmission destination information of the MAC entry being updated based on the received frame;
   An access list table that registers transfer entries for transferring the frames related to the plurality of duplicate entries in response to registration of a plurality of duplicate entries related to each other in the MAC duplication table. ,
   The communication system, wherein the frame related to the plurality of duplicate entries is transferred according to the entry for transfer.
9. Register the MAC entry,
   In response to the destination information of the MAC entry being updated based on the received frame, register a duplicate entry including information related to the frame;
   In response to registration of a plurality of duplicate entries related to each other, a transfer entry for transferring the frame related to the plurality of duplicate entries is registered,
   Forwarding the frame associated with a plurality of the duplicate entries according to the entry for forwarding;
   A flow processing method characterized by the above.
10. The flow processing according to claim 9, wherein the MAC entry corresponding to the frame related to the plurality of duplicate entries is deleted in response to registration of the plurality of duplicate entries related to each other. Method.

Images