WO2022062956A1 - 一种流量处理方法、装置和网络设备 - Google Patents

一种流量处理方法、装置和网络设备 Download PDF

Info

Publication number
WO2022062956A1
WO2022062956A1 PCT/CN2021/118136 CN2021118136W WO2022062956A1 WO 2022062956 A1 WO2022062956 A1 WO 2022062956A1 CN 2021118136 W CN2021118136 W CN 2021118136W WO 2022062956 A1 WO2022062956 A1 WO 2022062956A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
entry
network device
routing
routing table
Prior art date
Application number
PCT/CN2021/118136
Other languages
English (en)
French (fr)
Other versions
WO2022062956A8 (zh
Inventor
庄顺万
王海波
顾钰楠
Original Assignee
华为云计算技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为云计算技术有限公司 filed Critical 华为云计算技术有限公司
Priority to EP21871327.9A priority Critical patent/EP4203427A4/en
Publication of WO2022062956A1 publication Critical patent/WO2022062956A1/zh
Publication of WO2022062956A8 publication Critical patent/WO2022062956A8/zh
Priority to US18/188,016 priority patent/US11924103B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H04L45/748—Address table lookup; Address filtering using longest matching prefix
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/302—Route determination based on requested QoS
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/033—Topology update or discovery by updating distance vector protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/24—Multipath
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/302—Route determination based on requested QoS
    • H04L45/306—Route determination based on the nature of the carried application
    • H04L45/3065—Route determination based on the nature of the carried application for real time traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a traffic processing method, apparatus, and network device.
  • the network device will establish a FlowSpec forwarding table based on the obtained border gateway protocol flow rule (English: Border Gateway Protocol Flow Specification, referred to as: BGP FlowSpec) information for traffic that needs to be specially controlled, and the FlowSpec forwarding table includes filter conditions.
  • the filter conditions may include the autonomous system (English: Autonomous System, abbreviation: AS) number
  • the network device also has a forwarding information base (English: Forwarding Information Base, abbreviation: FIB) Table, the entry in the FIB table includes the correspondence between the prefix, the AS number and the next hop.
  • FIB Forwarding Information Base
  • a network device when a network device receives traffic, it first searches the FIB to determine the FIB entry that matches the traffic, wherein the FIB table that matches the traffic The entry means that the destination address of the flow matches the prefix in the FIB entry; then, look up the FlowSpec forwarding table, if it is determined that there is a FlowSpec forwarding entry corresponding to the AS number in the matched FIB entry, then, based on the The action in the matching FlowSpec forwarding entry controls the flow.
  • the network device needs to perform multiple table look-up operations on the received traffic, which results in a low processing efficiency of the network device on the traffic and affects the performance of the network device.
  • the embodiments of the present application provide a traffic processing method, apparatus, device, and network device.
  • the network device optimizes the FIB table that guides traffic forwarding, so that only one table lookup operation is required to process the received traffic according to the BGP FlowSpec information. Actions are controlled, and there is no need to process traffic through multiple table lookups, which improves the processing efficiency of network equipment.
  • an embodiment of the present application provides a traffic processing method.
  • the traffic processing process in the method may include: a network device acquires BGP FlowSpec information including filter conditions and actions, and the BGP FlowSpec information is used to indicate that the matching The flow of the filter condition performs the action, wherein the filter condition includes the attribute of the destination address; in this way, the network device can generate the first FIB entry including the first prefix and the action based on the BGP FlowSpec information, the first FIB entry The entry is used to instruct the network device to perform the action on the traffic matching the first prefix, where the attribute of the first prefix is the same as the attribute of the destination address in the filter condition.
  • the network device only needs to check the FIB table for the received traffic, determine that the destination address of the traffic matches the first prefix in the first FIB entry, and then complete the pairing according to the actions in the first FIB entry.
  • Traffic processing can realize the processing of traffic based on BGP FlowSpec without performing multiple table lookup operations on the received traffic, which greatly improves the processing efficiency of network equipment and improves the performance of network equipment.
  • the way that the network device obtains the BGP FlowSpec information can be that the network device receives a control message sent by the control and management device, and the control message carries the BGP FlowSpec information, and the control and management device can be, for example, a controller or a forwarding device.
  • the method for the network device to obtain the BGP FlowSpec information may also be that the network device obtains the BGP FlowSpec information from the local configuration information.
  • the BGP FlowSpec information may refer to the information carried in the BGP FlowSpec route obtained by the network device.
  • the filter condition in the BGP FlowSpec information can be used to indicate a destination address with a specific attribute, then, the traffic matching the filter condition is the traffic with the destination address having the specific attribute.
  • the attribute of the destination address may be the AS number to which the destination address belongs, or may be a set of AS numbers corresponding to the destination address, or may be a community attribute corresponding to the destination address.
  • the action in the BGP FlowSpec information is the operation to be implemented in the BGP FlowSpec information for the traffic matching the filter condition.
  • the action in the BGP FlowSpec information may include any one of the following actions: redirection, packet loss, speed limit, or setting a quality of service (English: Quality of Service, QoS for short) level.
  • the process that the network device generates the first FIB entry based on the BGP FlowSpec information may include: first, the network device generates a FlowSpec routing table entry based on the BGP FlowSpec information, and the route selection priority of the FlowSpec routing table entry is higher than that of other routing tables other routing table entries are obtained based on other routing protocols or static configuration, among which other routing protocols include but are not limited to Border Gateway Protocol (English: Border Gateway Protocol, referred to as: BGP) or Interior Gateway Protocol ( English: Interior Gateway Protocol, referred to as: IGP); then, the network device can send the FlowSpec routing table entry to the routing management (English: Router Management, referred to as: RM) routing table, as the RM routing table entry in the RM routing table; Finally, the network device sends the RM routing entry in the RM routing table (including the FlowSpec routing entry generated based on the BGP FlowSpec information) to the FIB table according to the routing priority of each entry in the RM routing table , as the first
  • the RM routing table entry in the RM routing table is sent to the FIB table, for example, the RM routing table entries corresponding to various route selection priorities in the RM routing table are sent to the FIB table, and
  • the FIB table reflects the route selection priority of each RM routing entry corresponding to the FIB entry, and the FIB entry with the highest route selection priority in the FIB table is the first FIB entry;
  • the RM routing entries whose route selection priority is lower than the preset threshold in the routing table are sent to the FIB table, and the route selection priority of each RM routing entry corresponding to the FIB entry is reflected in the FIB table.
  • the FIB entry of the route priority is the first FIB entry; or, it can also be: sending the RM routing entry with the highest route selection priority in the RM routing table (that is, the FlowSpec routing entry) into the FIB table, Then, the FlowSpec routing entry in the FIB table is the first FIB entry. It should be noted that saving at least two FIB entries with the same prefix in the FIB table can ensure that when a link indicated by a FIB entry or a network device on the link fails, other FIB tables with the same prefix can be used. The item guides the forwarding of traffic.
  • the route selection priority in this example may be a value set by the network device for various routes according to actual requirements and used to determine the priority order of each route.
  • the route selection priority of each route can be 0 to 255. The smaller the value of the route selection priority, the higher the route selection priority of the corresponding route.
  • the traffic processing process in this example may further include: the network device obtains the first revocation information, and the first revocation The information is used to instruct the BGP FlowSpec information to perform a revocation operation; in this way, the network device revokes the FlowSpec routing table entry based on the first revocation information.
  • the RM routing table entry corresponding to the FlowSpec routing table entry in the RM routing table can also be deleted, and the FIB entry corresponding to the BGP FlowSpec information can also be deleted, or the FIB entry corresponding to the FlowSpec information can be set as invalid .
  • the routing table entry and FIB table entry corresponding to the BGP FlowSpec route can be cancelled in batches, which simplifies the cost of configuration and maintenance, makes the flow control based on BGP FlowSpec more flexible, and improves the user experience of network equipment.
  • the process of the network device generating the first FIB entry based on the BGP FlowSpec information may further include: first, the network device generates a first RM routing entry based on the BGP FlowSpec information, and the selection of the first RM routing entry is The route priority is higher than the route selection priority of the second RM routing table entry, and the second RM routing table entry is obtained based on other routing protocols or static configuration, wherein the other routing protocols include but are not limited to: BGP or IGP; then , the network device can send the first RM routing entry to the FIB table as the first FIB entry according to the route selection priority of the first RM routing entry and the second RM routing entry.
  • the second RM routing table entry may also be sent to the FIB table, but the FIB table needs to reflect the routing priority of the FIB table entry corresponding to the second RM routing table entry. It should be noted that, if the first RM routing table and the second RM routing table have multiple identical routing entries with different routing priorities, except that only one RM routing entry with the highest routing priority can be placed under the same routing table entry.
  • the RM routing table entry with the non-highest routing priority can also be delivered to the FIB table. In this way, the FIB entry with the non-highest routing priority can be used as the corresponding FIB with the highest routing priority.
  • the backup entry of the entry when the FIB entry with the highest routing priority is revoked, the backup entry with the non-highest routing priority can take over the task of forwarding traffic in time, which improves the forwarding performance of the network device.
  • the network device may include multiple RM routing tables
  • the second RM routing table may also be called a general routing table or an Internet Protocol (English: Internet Protocol, IP) routing table
  • the first RM routing table is A newly created and maintained routing table.
  • the network device may also include only one RM routing table, and various routing protocols use labels to indicate the RM routing table entries corresponding to the routing protocols in the RM routing table.
  • the route selection priority in this example may be a value set for various RM routing tables according to actual requirements and used to determine the priority order of each RM routing table.
  • the route selection priority of each RM routing table can be flexible. The smaller the value of the route selection priority, the higher the route selection priority of the corresponding RM routing table.
  • the route selection priority in this example can also be a value set by the network device for various routes according to actual needs and used to determine the priority of each route.
  • the route selection priority is reflected in the RM forwarding of each RM forwarding table. In the published item, the routing priority of the RM routing table entry is represented by the routing priority of the corresponding route.
  • the traffic processing process in this example may further include: the network device obtains the second revocation information, the second revocation The information is used to instruct to perform a revocation operation on the BGP FlowSpec information; thus, the network device can revoke the first RM routing table entry based on the second revocation information. Therefore, the network device can also delete the FIB entry corresponding to the BGP FlowSpec information, or set the FIB entry corresponding to the FlowSpec information to be invalid.
  • routing table entry and FIB table entry corresponding to the BGP FlowSpec route can be cancelled in batches, which simplifies the cost of configuration and maintenance, makes the flow control based on BGP FlowSpec more flexible, and improves the user experience of network equipment.
  • the network device can generate multiple FIB entries after acquiring the BGP FlowSpec information. For example, the network device can generate the first FIB entry based on the BGP FlowSpec information, and can also generate the first FIB entry based on the BGP FlowSpec information. generating a second FIB entry, where the second FIB entry includes a correspondence between the second prefix and the action, and the second FIB entry is used to instruct the network device to perform the action on the traffic matching the second prefix, The attributes of the second prefix are the same as the attributes of the destination address, and the second prefix is different from the first prefix.
  • the process of processing traffic may further include a process of processing specific packets by the network device. For example, when the network device receives the first packet, it can first determine whether the destination address of the first packet matches the first prefix of the first FIB entry. the action of processing the first packet. For another example, when the network device receives the second packet, it may first determine whether the destination address of the second packet matches the second prefix of the second FIB entry. The actions in , process the second packet. It can be seen that the processing of traffic based on BGP FlowSpec can be realized through one table lookup operation (that is, the operation of looking up the FIB table), which greatly improves the processing efficiency of network equipment and improves the performance of network equipment.
  • an embodiment of the present application further provides a network device, where the network device may at least include: a first acquiring unit and a first generating unit.
  • the first obtaining unit is configured to obtain BGP FlowSpec information, where the BGP FlowSpec information includes a filter condition and an action, and the BGP FlowSpec information is used to instruct the flow that matches the filter condition to perform the action, and the filter condition Including the attribute of the destination address;
  • a first generating unit configured to generate a first forwarding information base FIB entry based on the BGP FlowSpec information, the first FIB entry includes the first prefix and the corresponding relationship of the action, the The first FIB entry is used to instruct the network device to perform the action on the traffic matching the first prefix, where the attribute of the first prefix is the same as the attribute of the destination address.
  • the network device may further include: a receiving unit, a determining unit, and a processing unit.
  • the receiving unit is configured to receive the message;
  • the determining unit is configured to determine that the destination address of the message matches the first prefix of the first FIB entry;
  • the processing unit is configured to, according to the action, The message is processed.
  • the first obtaining unit is specifically configured to: receive a control message sent by a control and management device, where the control message carries the BGP FlowSpec information, and the control and management device includes a controller or a forwarding device.
  • the first obtaining unit is specifically configured to: obtain the BGP FlowSpec information from the local configuration information.
  • the attribute of the destination address in the filter condition may be the AS number to which the destination address belongs or a set of AS numbers corresponding to the destination address.
  • the attribute of the destination address in the filter condition may also be the community attribute corresponding to the destination address.
  • the action in the BGP FlowSpec information includes any one of the following actions: redirection, packet loss, speed limit or setting QoS level.
  • the first generating unit may include: a first generating subunit, a first sending subunit, and a second sending subunit.
  • the first generating subunit is configured to generate a FlowSpec routing table entry based on the BGP FlowSpec information.
  • the routing priority of the FlowSpec routing table entry is higher than the routing priority of other routing table entries. Item is obtained based on other routing protocols or static configuration;
  • the first sending subunit is used to send the FlowSpec routing table entry to the routing management RM routing table, as the RM routing table entry in the RM routing table;
  • the second A sending subunit configured to send the RM routing entry in the RM routing table to the FIB table according to the routing priority of each entry in the RM routing table, as the first FIB entry.
  • the network device may further include: a second acquisition unit and a first revocation unit.
  • the second obtaining unit is configured to obtain first revocation information, where the first revocation information is used to instruct a revocation operation to be performed on the BGP FlowSpec information; the first revocation unit is configured to revoke all revocation information based on the first revocation information Describe the FlowSpec routing table entry.
  • the first generating unit may also include: a second generating unit and a third sending subunit.
  • the second generation subunit is used to generate a first route management RM routing table entry based on the BGP FlowSpec information, and the route selection priority of the first RM routing table entry is higher than the route selection priority of the second RM routing table entry Priority, the second RM routing entry is obtained based on other routing protocols or static configuration;
  • the third sending subunit is used for selecting according to the first RM routing entry and the second RM routing entry. route priority, and send the first RM routing entry to the FIB table as the first FIB entry.
  • the network device may further include: a third acquisition unit and a second revocation unit.
  • the third obtaining unit is used to obtain second revocation information, where the second revocation information is used to instruct to perform a revocation operation on the BGP FlowSpec information; the second revocation unit is used to revoke the second revocation information based on the second revocation information the first RM routing table entry.
  • the network device may further include: a third revocation unit.
  • the third revocation unit is used to delete the FIB entry corresponding to the BGP FlowSpec information, or set the FIB entry corresponding to the FlowSpec information to be invalid.
  • routing protocols in the above implementation manner may include: BGP or IGP.
  • the network device may further include: a second generating unit.
  • the second generating unit is configured to generate a second FIB entry based on the BGP FlowSpec information, where the second FIB entry includes a correspondence between the second prefix and the action, and the second FIB entry is used to indicate The network device performs the action on the traffic matching the second prefix, the attribute of the second prefix is the same as the attribute of the destination address, and the second prefix is different from the first prefix.
  • network device provided in the second aspect is used to perform the related operations mentioned in the above-mentioned first aspect.
  • an embodiment of the present application further provides a network device, including: a memory and a processor.
  • the memory is used for storing program codes or instructions; the processor is used for running the program codes or instructions, so that the network device executes the method provided in the first aspect above.
  • embodiments of the present application further provide a computer-readable storage medium, where program codes or instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer can execute any of the above-mentioned first aspects.
  • an embodiment of the present application further provides a computer program product, which, when the computer program product runs on a network device, enables the network device to execute the method provided in any possible implementation manner of the first aspect.
  • FIG. 1 is a schematic structural diagram of a network 10 involved in an application scenario in an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a traffic processing method 100 in an embodiment of the present application
  • FIG. 3 is a schematic flowchart of an implementation manner of S102 in the embodiment of the present application.
  • FIG. 4 is a schematic diagram of various entries in a network device according to an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another implementation manner of S102 in the embodiment of the present application.
  • FIG. 6 is a schematic diagram of various entries in another network device in an embodiment of the present application.
  • FIG. 7 is a signaling flowchart of a traffic processing method 200 in an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a network device 800 in an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a network device 900 in an embodiment of the present application.
  • the BGP FlowSpec is standardized in the Request for Comments (English: Request for Comments, RFC for short) 5575, which specifically refers to the correspondence between filter conditions and actions carried by the extended BGP network layer reachability information type and extended community attributes.
  • the traffic matching the filtering condition is made to execute the action corresponding to the filtering condition, so as to achieve the purpose of traffic control.
  • the network device needs to perform multiple table lookup operations on the received traffic, which consumes the performance of the network device and reduces the network device's processing efficiency for traffic.
  • a traffic processing method where a network device can generate a first FIB entry based on the acquired BGP FlowSpec information, where the first FIB entry includes a correspondence between a first prefix and an action , the action is an action included in the BGP FlowSpec information, and the first prefix is a prefix with the same attribute as the destination address indicated by the filter condition included in the BGP FlowSpec information.
  • the BGP FlowSpec information is used to instruct to perform the action on the traffic matching the filter condition
  • the generated first FIB entry is used to instruct the network device to perform the action on the traffic matching the first prefix, so that the received
  • the network device only needs to check the FIB table to determine that the traffic matches the first prefix in the first FIB entry, then the traffic can be processed according to the actions in the first FIB entry, and there is no need to process the received traffic.
  • the received traffic needs to perform multiple table lookup operations to realize the traffic processing based on BGP FlowSpec, which greatly improves the traffic processing efficiency of network devices and improves the performance of network devices.
  • the network 10 may include a network domain 1, a network domain 2 and a network domain 3, wherein the AS numbers corresponding to the network domain 1, the network domain 2 and the network domain 3 64596, 64597 and 64598 respectively.
  • the network domain 2 includes a network device 11 , a network device 12 and a network device 13
  • the network 10 may also include a control and management device 20 . Assuming that the network device 11 is connected to the network domain 1 through the interface I1, the network device 12 is connected through the interface O2, and the network device 13 is connected through the interface O3, the control and management device 20 can manage and control each network device in the network 10.
  • the network device 11 includes FIB entry 1, and the FIB entry 1 includes: prefix 1 and O2 (ie, the next hop outbound interface identifier from the network device 11 to the network device 12).
  • the packet 1 includes the destination address 1.
  • the network device 11 processes the packet 1 as follows: S11, the network device 11 Check the FIB table, confirm that the destination address 1 matches the prefix 1 in FIB entry 1, and obtain the next hop outbound interface O2 in the FIB entry 1: S12, the network device 11 forwards the packet 1 from the outbound interface O2 to the network on device 12. In this way, the network device 11 can forward the traffic based on the FIB table.
  • Scenarios where the network device 11 redirects traffic to the network device 13 include but are not limited to: Scenario 1, the traffic carried on the network device 12 is large and the packet loss is serious, while the traffic carried on the network device 13 is less, out of traffic
  • Scenario 1 the traffic carried on the network device 12 is large and the packet loss is serious, while the traffic carried on the network device 13 is less, out of traffic
  • the traffic received by the network device 11 can be redirected to the network device 13; in scenario 2, in order to prevent attacks, the network device 11 redirects the received traffic to the network device 13 for traffic cleaning, improving the network safety.
  • the network device 11 redirects the traffic to the network device 13, which may be after the control and management device 20 sends the BGP FlowSpec information to the network device 11, and the network device 11 performs the traffic received by the network device 11 based on the BGP FlowSpec information. Handling operations.
  • the preprocessing process that needs to be performed may include: S21, the control and management device 20 sends the BGP FlowSpec information 1 to the network device 11, and the BGP FlowSpec information 1 includes: 64598 (that is, the destination address corresponds to The corresponding relationship between the AS number) and redirection to the network device 13 (ie, the action) is used to instruct the network device 11 to redirect all traffic destined for AS64598 to the network device 13; S22, the network device 11 is based on the BGP FlowSpec information 1 generates a BGP FlowSpec routing table entry, and adds entry 1 in the BGP FlowSpec forwarding table.
  • the added BGP FlowSpec forwarding table entry 1 includes: 64598 and O3 (that is, the next route from network device 11 to network device 13 Jump out the interface identifier); S23, the network device 11 receives the BGP route advertised by the network domain 3, and associates the FIB entry generated based on these BGP routes in the FIB table with the AS number (that is, associates to 64598), for example, generates an associated FIB entry.
  • the FIB entry 1' of the AS number includes: prefix 1, 64598, and O2 (ie, the identifier of the next hop outbound interface from the network device 11 to the network device 12).
  • the network device 11 may process the packet 1 as follows: S24, the network device 11 checks the In the FIB table, it is determined that the destination address 1 matches the prefix 1 in the FIB entry 1', and the AS number 64598 in the FIB entry 1' is obtained; S25, the network device 11 checks the BGP FlowSpec forwarding table, and determines the BGP whose AS number is 64598 FlowSpec forwarding entry 1, obtain the next hop outbound interface O3 in the BGP FlowSpec forwarding entry 1; S26, the network device 11 forwards the packet 1 from the outbound interface O3, and sends it to the network domain 3 through the network device 13. It can be seen that, based on the current BGP FlowSpec, at least two table look-up operations need to be performed for traffic processing, and there is a performance loss to the network device 11.
  • the preprocessing process that needs to be performed may include: S21, the control and management device 20 sends the BGP FlowSpec information 1 to the network device 11, and the BGP FlowSpec information 1 is sent to the network device 11.
  • the FlowSpec information 1 includes: 64598 and the correspondence between redirection to the network device 13 (for example, it can be the next hop outbound interface identifier O3 from the network device 11 to the network device 13); S22, the network device 11 is based on the BGP FlowSpec information 1 A BGP FlowSpec routing table entry is generated; S23, the network device 11 receives the BGP route advertised by the network domain 3, and generates the FIB table entry 2 based on the BGP routes and the BGP FlowSpec information 1 in the FIB table.
  • the FIB table entry 2 includes: Prefix 2 and O3.
  • the network device 11 may process the packet 2 as follows: S24, the network device 11 checks In the FIB table, it is determined that the destination address 2 matches the prefix 2 in the FIB entry 2, and the next-hop outbound interface identifier O3 in the FIB entry 1 is obtained; S25, the network device 11 forwards the packet 2 from the outbound interface O3, and passes the The network device 13 sends to the network domain 3 .
  • a control management device refers to a device or functional module that has the function of generating BGP FlowSpec information and sending BGP FlowSpec information to each network device, such as a controller, a server, a network device, or a control management module in a network device.
  • FIG. 2 is a signaling flowchart of a traffic processing method 100 in an embodiment of the present application.
  • the method 100 is applied to a network device, for example, it can be applied to the network device 11 shown in FIG. 1 to realize the processing of the traffic sent from the network domain 1 through the network device 11 in the network domain 2 to the network domain 3
  • it can also be applied to the network device 13 shown in FIG. 1 to realize the processing of the traffic sent from the network domain 3 to the network domain 1 through the network device 13 in the network domain 2 .
  • the method 100 may include, for example, the following S101 to S102:
  • BGP FlowSpec information includes a filter condition and an action
  • the BGP FlowSpec information is used to instruct the flow that matches the filter condition to perform the action
  • the filter condition includes the attribute of the destination address.
  • the BGP FlowSpec information may refer to the information carried in the BGP FlowSpec route obtained by the network device.
  • the filter condition in the BGP FlowSpec information can be used to indicate a destination address with a specific attribute, then, the traffic matching the filter condition is the traffic with the destination address having the specific attribute.
  • the action in the BGP FlowSpec information is the operation to be implemented in the BGP FlowSpec information for the traffic matching the filter condition.
  • the filter condition may also be the AS number to which the destination address belongs.
  • the filter condition in the BGP FlowSpec information obtained by the network device 11 may be the AS number of the network domain 3: 64598, the BGP FlowSpec information is used to instruct to perform the corresponding action on the traffic whose AS number is 64598 to which the destination address belongs.
  • the filter condition may be the set of AS numbers corresponding to the destination address. For example, if the traffic sent from network domain 0 needs to pass through network domain 1, network domain 2 and network domain 3 to reach network domain 4, then network domain
  • the filter conditions in the BGP FlowSpec information obtained by the network device in 1 may be the set of AS numbers corresponding to network domain 2, network domain 3 and network domain 4: ⁇ 64597, 64598, 64599 ⁇ , the BGP FlowSpec information is used to indicate Perform corresponding actions on traffic matching the AS number set.
  • the traffic matching the AS number set may mean that the destination address of the traffic matches at least one AS number in the AS number set, or it may mean that the destination address of the traffic matches each AS number in the AS number set.
  • the filter condition can be an ordered set of AS numbers (also called AS-Path) ⁇ 64599, 64598, 64597 ⁇ , indicating that only the traffic transmitted through all the network domains indicated by the AS number set is eligible If the filter condition is set, after the network device receives the traffic, only the destination address of the traffic matches all the AS numbers in the AS-Path, the traffic will be processed according to the action corresponding to the AS-Path in the BGP FlowSpec information. .
  • AS-Path also called AS-Path
  • the filter condition may also be the community attribute corresponding to the destination address.
  • the community attribute corresponding to the destination address may refer to the community attribute or the information carried in the extended community attribute carried in the BGP packet used to advertise the BGP route when the BGP route corresponding to the destination address is advertised. Used to indicate at least one destination address that meets some or some of the same characteristics.
  • the filter condition can be the community attribute 100:100, where 100:100 is used to indicate the address set of all network devices in network domain 1 and network domain 2, that is, to publish the addresses of all network devices in network domain 1 and network domain 2
  • the community attribute carried in the BGP packet is 100:100. After the network device receives the traffic, if the community attribute corresponding to the destination address of the traffic is 100:100, it is considered that the traffic meets the filtering condition, and the traffic can be processed according to the actions in the BGP FlowSpec information.
  • the action in the BGP FlowSpec information can be any achievable processing operation on the traffic, for example, it can include any of the following actions: redirection, packet loss, speed limit or setting quality of service (English: Quality of Service, Abbreviation: QoS) level.
  • Redirection refers to directing the traffic that meets the filtering conditions to a specific network device.
  • the traffic received by the network device 11 whose destination address belongs to AS64598 can be directed to On the network device 13, the action performed in this process is redirection, and the action in the BGP FlowSpec information may specifically be: redirecting to the IP address of the network device 13.
  • Packet loss refers to the processing of packet loss for traffic that meets the filtering conditions.
  • Speed limit refers to the speed limit processing of traffic that meets the filtering conditions.
  • Setting the QoS level refers to setting the corresponding QoS level for the traffic that meets the filtering conditions.
  • the control and management device sends a control packet to the network device, and the network device obtains the BGP FlowSpec carried in the control packet by parsing the received control packet. information.
  • the control management device may be a controller, or may be other network devices (also referred to as forwarding devices) other than the network device executing the method 100 .
  • a control and management module may be integrated in the network device, then the network device may obtain the BGP FlowSpec information from its own control and management module.
  • the BGP FlowSpec information can also be configured locally on the network device. Then, the network device can obtain the BGP FlowSpec information from the local configuration information.
  • the network device obtains the BGP FlowSpec information, which provides a data basis for executing S102, making it possible to use the BGP FlowSpec to process traffic.
  • S102 Generate a first FIB entry based on the BGP FlowSpec information, where the first FIB entry includes a correspondence between a first prefix and the action, and the first FIB entry is used to indicate that the network device pair matches the first FIB entry.
  • the traffic of a prefix performs the action, and the attributes of the first prefix are the same as the attributes of the destination address.
  • the network device can generate multiple FIB entries based on the BGP FlowSpec information, and the attributes of the prefix of each FIB entry in the generated multiple FIB entries are the same as the filter conditions.
  • the properties of the destination address are the same.
  • the network device generates the first FIB entry and the second FIB entry based on the BGP FlowSpec information, as shown in Table 1 below:
  • Table 1 FIB entries generated based on BGP FlowSpec information
  • the attributes of the first prefix are the same as the attributes of the second prefix, and both are the same as the attributes of the destination address included in the filter condition. For example, if the attribute of the destination address included in the filter condition is AS number 64598, then both the first prefix and the second prefix belong to the AS corresponding to the AS number 64598. For another example, if the attribute of the destination address included in the filter condition is the AS number set ⁇ 64596, 64597, 64598 ⁇ , then both the first prefix and the second prefix belong to the AS number set. 64596, 64597 and 64598 match.
  • the attribute of the destination address included in the filter condition is the community attribute 100:100 corresponding to the destination address
  • the first prefix and the second prefix both belong to the prefix range indicated by the 100:100.
  • the actions in Table 1 can be flexibly represented. For example, if the action is redirecting to the network device 13 , the action in the FIB entry may specifically be the IP address of the network device 13 .
  • S102 may be shown in FIG. 3 , and may specifically include: S102a1, generating a FlowSpec routing table entry based on BGP FlowSpec information, and the route selection priority of the FlowSpec routing table entry is higher than that of other protocol routing table entries. Priority, in which other protocol routing entries are obtained based on other routing protocols or static configuration; S102a2, send the FlowSpec routing entry to the routing management (English: Router Management, referred to as: RM) routing table, as the RM routing table The RM routing table entry; S102a3, according to the routing priority of each table entry in the RM routing table, send the RM routing table entry in the RM routing table to the FIB table as the first FIB table entry.
  • S102a1 generating a FlowSpec routing table entry based on BGP FlowSpec information, and the route selection priority of the FlowSpec routing table entry is higher than that of other protocol routing table entries.
  • S102a3 may be, for example: sending the RM routing table entries corresponding to various route selection priorities in the RM routing table to the FIB table, and reflecting the FIB table entries corresponding to each RM routing table entry in the FIB table.
  • route selection priority may also be: sending the RM routing table entry whose route selection priority is lower than the preset threshold in the RM routing table to the FIB table, and reflecting the FIB corresponding to each RM routing table entry in the FIB table
  • the route selection priority of the entry may also be: send the RM routing entry (ie, the FlowSpec routing entry) with the highest route selection priority in the RM routing table to the FIB table, then the FIB table
  • the FlowSpec routing entry in is the first FIB entry in S102.
  • Saving at least two FIB entries with the same prefix in the FIB table can ensure that when a link indicated by a FIB entry or a network device on the link fails, traffic forwarding is guided based on other FIB entries with the same prefix .
  • the route selection priority in this example may be a value set by the network device for various routes according to actual requirements and used to determine the priority order of each route.
  • the route selection priority of each route can be 0 to 255. The smaller the value of the route selection priority, the higher the route selection priority of the corresponding route.
  • the network device can establish a FlowSpec routing table, and set the routing priority of the FlowSpec routing table to be higher than that of other routing tables.
  • OSPF Open Shortest Path First
  • ISIS Intermediate System to Intermediate System
  • static routing table if the routing priority of the static routing table is 5.
  • the routing priority of the OSPF routing table is 10, the routing priority of the ISIS routing table is 15, and the routing priority of the BGP routing table is 160.
  • the routing priority of the FlowSpec routing table can be set to 2.
  • the route selection priority is higher than that of other routing tables.
  • the network device may include multiple routing tables, and different routing protocols may maintain the routing tables corresponding to the routing protocols respectively; or, the network device may also include only one routing table, and various routing protocols
  • the routing table indicates the routing table entry corresponding to the routing protocol through a label. The following description takes as an example that each routing protocol corresponds to a routing table.
  • the network device includes BGP routing table 1, ISIS routing table 2, static routing table 3 and FlowSpec routing table 4, and BGP routing table 1, ISIS routing table 2 and static routing table 3 respectively include prefix 1 Corresponding BGP routing table entry 1, ISIS routing table entry 2, and static routing table entry 3.
  • the network device receives the BGP FlowSpec information, it generates a FlowSpec routing table entry 4 corresponding to the prefix 1 in the FlowSpec routing table, wherein the attribute of the prefix 1 and the attribute of the destination address included in the filter condition in the BGP FlowSpec information.
  • the BGP routing table 1, ISIS routing table 2, static routing table 3, and FlowSpec routing table 4 in the network device can all store the BGP routing table entry 1, ISIS routing table entry 2, static routing table entry 3 and FlowSpec corresponding to prefix 1.
  • Routing table entry 4 is sent to RM routing table 5 as RM routing table entries 1 to 4 in RM routing table 5; the RM routing table 5 converts the RM routing table
  • the RM routing table entry 4 (that is, FlowSpec routing table entry 4) with the highest route selection priority among items 1 to 4 is sent to the FIB table, that is, the FIB table includes FIB table entry 1 (that is, RM routing table entry 4 or FlowSpec routing table). item 4).
  • the network device can perform corresponding processing on the received message whose destination address matches the prefix 1 based on the action in the FIB entry 1 in the FIB table.
  • routing table entries sent to the RM routing table from routing tables such as the BGP routing table, the ISIS routing table, the static routing table, and the FlowSpec routing table can be all routing table entries with the same prefix in each routing table, or each routing table. Each of them selects a preset number of routing table entries from routing table entries of the same prefix.
  • S102 may be shown in FIG. 5, and may specifically include: S102b1, generating a first RM routing table entry based on the BGP FlowSpec information, and the route selection priority of the first RM routing table entry is higher than that of the second RM
  • the route selection priority of the routing table entry, the second RM routing table entry is obtained based on other routing protocols or static configuration; S102b2, according to the route selection priority of the first RM routing table entry and the second RM routing table entry,
  • the first RM routing entry is sent to the FIB table as the first FIB entry.
  • the second RM routing table entry may also be sent to the FIB table, but the FIB table needs to reflect the routing priority of the FIB table entry corresponding to the second RM routing table entry.
  • the network device may include multiple RM routing tables, the routing table obtained based on other routing protocols and the routing table statically configured correspond to the second RM routing table, and the routing table obtained based on the BGP FlowSpec information corresponds to the first RM routing table. surface.
  • the second RM routing table may also be called a general routing table or an IP routing table, and the first RM routing table is a newly established and maintained routing table.
  • the network device may also include only one RM routing table, and various routing protocols use labels to indicate the RM routing table entries corresponding to the routing protocols in the RM routing table. The following description takes two RM routing tables as an example.
  • the route selection priority in this example may be a value set for various RM routing tables according to actual requirements and used to determine the priority order of each RM routing table.
  • the route selection priority of each RM routing table can be flexible. The smaller the value of the route selection priority, the higher the route selection priority of the corresponding RM routing table.
  • the route selection priority in this example can also be a value set by the network device for various routes according to actual needs and used to determine the priority of each route.
  • the route selection priority is reflected in the RM forwarding of each RM forwarding table. In the published item, the routing priority of the RM routing table entry is represented by the routing priority of the corresponding route.
  • the network device can establish the FlowSpec routing table and the first RM routing table, and set the routing priority of the first RM routing table to be higher than the routing priority of the first RM routing table.
  • BGP routing table, OSPF routing table, ISIS routing table, and static routing table exist, and the BGP routing table, OSPF routing table, ISIS routing table, and static routing table all send routing performance to the second RM routing table, and the second RM If the route selection priority of the routing table is 100, then the route selection priority of the first RM routing table can be set to 17, which is higher than the route selection priority of the second routing table.
  • the network device includes BGP routing table 1, ISIS routing table 2, static routing table 3 and FlowSpec routing table 4, and BGP routing table 1, ISIS routing table 2 and static routing table 3 respectively include prefix 1 Corresponding BGP routing table entry 1, ISIS routing table entry 2 and static routing table entry 3, and BGP routing table 1, ISIS routing table 2 and static routing table 3 respectively deliver the table entries to RM routing table 2, that is,
  • the RM routing table 2 includes RM routing table entries 21 to 23 (corresponding to BGP routing table entry 1, ISIS routing table entry 2, and static routing table entry 3 respectively).
  • the network device When the network device receives the BGP FlowSpec information, it generates a FlowSpec routing table entry 4 corresponding to the prefix 1 in the FlowSpec routing table, wherein the attribute of the prefix 1 and the attribute of the destination address included in the filter condition in the BGP FlowSpec information.
  • the network device can send FlowSpec routing table entry 4 to RM routing table 1 as RM routing table entry 11 in RM routing table 1; in this way, the network device can obtain the selection of RM routing table 1 and RM routing table 2 route priority, determine that the route selection priority of RM routing table 1 is higher, then send RM routing table entry 11 (ie FlowSpec routing table entry 4) in RM routing table 1 to the FIB table, that is, in the FIB table Including FIB entry 1 (ie, RM routing entry 11 or FlowSpec routing entry 4). In this way, the network device can perform corresponding processing on the received message whose destination address matches the prefix 1 based on the action in the FIB entry 1 in the FIB table.
  • the RM routing table entry with the non-highest routing priority can also be delivered to the FIB table. In this way, the FIB entry with the non-highest routing priority can be used as the corresponding FIB entry with the highest routing priority.
  • the backup entry with the non-highest routing priority can take over the task of forwarding traffic in time, which improves the forwarding performance of network devices.
  • routing protocols described in the above examples may include: BGP or IGP
  • IGP may include, for example, but not limited to, the ISIS protocol and the OSPF protocol mentioned above.
  • the network device After S102, the network device combines the BGP FlowSpec information into the FIB entry whose prefix meets the filtering conditions in the FIB table, so as to prepare for the network device to process traffic based on the BGP FlowSpec.
  • the network device After S102, when the network device receives the packet, and the destination address of the packet matches the first prefix in the first FIB entry, the network device will, according to the action in the first FIB entry, send the packet to the packet. text is processed. Or, when the network device receives the packet, and the destination address of the packet matches the second prefix in the second FIB entry, the network device performs the packet processing according to the action in the second FIB entry. deal with.
  • the network device can generate the first FIB entry based on the acquired BGP FlowSpec information, where the first FIB entry includes the correspondence between the first prefix and the action, and the action is the BGP FlowSpec
  • the action included in the information, the first prefix is a prefix with the same attribute as the destination address indicated by the filter condition included in the BGP FlowSpec information.
  • the BGP FlowSpec information is used to instruct to perform the action on the traffic matching the filter condition
  • the generated first FIB entry is used to instruct the network device to perform the action on the traffic matching the first prefix, so that the received
  • the network device only needs to check the FIB table to determine that the traffic matches the first prefix in the first FIB entry, then the traffic can be processed according to the actions in the first FIB entry, and there is no need to process the received traffic.
  • the received traffic needs to perform multiple table lookup operations to realize the traffic processing based on BGP FlowSpec, which greatly improves the traffic processing efficiency of network devices and improves the performance of network devices.
  • the network generates and maintains BGP FlowSpec routes in batches, and generates FIB entries in the FIB table that take into account the BGP FlowSpec routes, which simplifies the cost of configuration and maintenance.
  • the network device can not only generate FIB entries corresponding to BGP FlowSpec routes in batches, but also can cancel BGP FlowSpec routes, thereby canceling the routing table entries and FIB entries corresponding to the BGP FlowSpec routes in batches.
  • the user experience of network equipment During specific implementation, an embodiment of the present application provides a traffic processing method 200. As shown in FIG. 7, after S102, the method 200 may further include:
  • the network device may receive the revocation information sent by the control and management device, or may be the revocation information configured on the network device, that is, the revocation information obtained by the network device from local configuration information.
  • S104 may include, for example, that the network device revokes the FlowSpec routing table entry based on the revocation information.
  • the RM routing entry corresponding to the FlowSpec routing entry in the RM routing table can be deleted, and the FIB entry corresponding to the BGP FlowSpec information can also be deleted, or the FIB entry corresponding to the FlowSpec information can be set as invalid.
  • the various entries shown in FIG. 1 For example, for the various entries shown in FIG.
  • the FlowSpec routing table 4 deletes the FlowSpec routing entry 4, the RM routing table 5 deletes the RM routing entry 4, and the FIB table deletes the FIB entry 1 or set FIB entry 1 to an invalid state.
  • S104 may include, for example, that the network device withdraws the first RM routing table entry based on the withdrawal information. Therefore, the FIB entry corresponding to the BGP FlowSpec information may be deleted, or the FIB entry corresponding to the FlowSpec information may be set to be invalid. For example, for the various entries shown in FIG. 6 in the network device, after the method 200, the FlowSpec routing table 4 deletes the FlowSpec routing entry 4, the RM routing table 1 deletes the RM routing entry 11, and the FIB table deletes the FIB entry 1 or set FIB entry 1 to an invalid state.
  • the "FIB entry corresponding to the BGP FlowSpec information" mentioned in S105 refers to all or part of the FIB entry generated based on the BGP FlowSpec information.
  • the attributes of the prefixes in the FIB entries corresponding to the BGP FlowSpec information are the same as the attributes of the destination addresses included in the filter conditions in the BGP FlowSpec information, or it can also be considered that the prefixes in the FIB entries corresponding to the BGP FlowSpec information meet the Filter conditions in BGP FlowSpec information.
  • the network device can not only generate the corresponding FIB entry based on the obtained BGP FlowSpec information, but also instruct the network device to execute the BGP FlowSpec information on the traffic matching the prefix in the generated FIB entry.
  • the corresponding actions in make it possible to process the traffic based on the BGP FlowSpec through a table lookup, and can also withdraw the BGP FlowSpec route based on the obtained withdrawal information, thereby batch withdrawing the corresponding routing table entries and the BGP FlowSpec routes.
  • FIB entry simplifies the cost of configuration and maintenance, makes the flow control based on BGP FlowSpec more flexible, and improves the user experience of network devices.
  • an embodiment of the present application further provides a network device 800, as shown in FIG. 8 .
  • the network device 800 includes: a first obtaining unit 801 and a first generating unit 802 .
  • the first obtaining unit 801 is configured to obtain BGP FlowSpec information, where the BGP FlowSpec information includes a filter condition and an action, and the BGP FlowSpec information is used to instruct to perform the action on the traffic matching the filter condition, and the filter Conditions include attributes of the destination address.
  • the first obtaining unit 801 may execute S101 shown in FIG. 2 .
  • a first generating unit 802 configured to generate a first forwarding information base FIB entry based on the BGP FlowSpec information, where the first FIB entry includes a correspondence between a first prefix and the action, and the first FIB entry is used to instruct the network device to perform the action on the traffic matching the first prefix, where the attribute of the first prefix is the same as the attribute of the destination address.
  • the first generating unit 802 may execute S102 shown in FIG. 2 .
  • the network device 800 may further include: a receiving unit, a determining unit, and a processing unit.
  • the receiving unit is configured to receive the message;
  • the determining unit is configured to determine that the destination address of the message matches the first prefix of the first FIB entry;
  • the processing unit is configured to, according to the action, The message is processed.
  • the first obtaining unit 801 is specifically configured to: receive a control message sent by a control and management device, where the control message carries the BGP FlowSpec information, and the control and management device includes a controller or a forwarding device. Or, the first obtaining unit 801 is specifically configured to: obtain the BGP FlowSpec information from the local configuration information.
  • the attribute of the destination address in the filter condition may be the AS number to which the destination address belongs or a set of AS numbers corresponding to the destination address.
  • the attribute of the destination address in the filter condition may also be the community attribute corresponding to the destination address.
  • the action in the BGP FlowSpec information includes any one of the following actions: redirection, packet loss, speed limit or setting QoS level.
  • the first generating unit 802 may include: a first generating subunit, a first sending subunit, and a second sending subunit.
  • the first generating subunit is configured to generate a FlowSpec routing table entry based on the BGP FlowSpec information.
  • the routing priority of the FlowSpec routing table entry is higher than the routing priority of other routing table entries.
  • the Item is obtained based on other routing protocols or static configuration; the first sending subunit is used to send the FlowSpec routing table entry to the routing management RM routing table, as the RM routing table entry in the RM routing table; the second A sending subunit, configured to send the RM routing entry in the RM routing table to the FIB table according to the routing priority of each entry in the RM routing table, as the first FIB entry.
  • the network device 800 may further include: a second acquisition unit and a first revocation unit.
  • the second obtaining unit is configured to obtain first revocation information, where the first revocation information is used to instruct a revocation operation to be performed on the BGP FlowSpec information; the first revocation unit is configured to revoke all revocation information based on the first revocation information Describe the FlowSpec routing table entry.
  • the first generating unit 802 may also include: a second generating unit and a third sending subunit.
  • the second generation subunit is used to generate a first route management RM routing table entry based on the BGP FlowSpec information, and the route selection priority of the first RM routing table entry is higher than the route selection priority of the second RM routing table entry Priority, the second RM routing entry is obtained based on other routing protocols or static configuration;
  • the third sending subunit is used for selecting according to the first RM routing entry and the second RM routing entry. route priority, and send the first RM routing entry to the FIB table as the first FIB entry.
  • the network device 800 may further include: a third acquisition unit and a second revocation unit.
  • the third obtaining unit is used to obtain second revocation information, where the second revocation information is used to instruct to perform a revocation operation on the BGP FlowSpec information; the second revocation unit is used to revoke the second revocation information based on the second revocation information the first RM routing table entry.
  • the network device 800 may further include: a third revocation unit.
  • the third revocation unit is used to delete the FIB entry corresponding to the BGP FlowSpec information, or set the FIB entry corresponding to the FlowSpec information to be invalid.
  • routing protocols in the above implementation manner may include: BGP or IGP.
  • the network device 800 may further include: a second generating unit.
  • the second generating unit is configured to generate a second FIB entry based on the BGP FlowSpec information, where the second FIB entry includes a correspondence between the second prefix and the action, and the second FIB entry is used to indicate The network device performs the action on the traffic matching the second prefix, the attribute of the second prefix is the same as the attribute of the destination address, and the second prefix is different from the first prefix.
  • the network device 800 shown in FIG. 8 may be the network device in the example shown in FIG. 2 or FIG. 7 . Therefore, for various specific embodiments of the network device 800, reference may be made to the method 100 corresponding to FIG. 2 . As well as the related introduction of the method 200 corresponding to FIG. 7 , details are not repeated in this embodiment.
  • an embodiment of the present application provides a network device 900 .
  • the network device 900 may be the network device in any of the foregoing embodiments, for example, may be the network device 11 in the embodiment shown in FIG. 1 , or may be the network device in the embodiment shown in FIG. 2 .
  • the network device 900 includes at least one processor 901 , a bus system 902 , a memory 903 and at least one transceiver 904 .
  • the network device 900 is a device with a hardware structure, and can be used to implement the functional modules in the network device 800 shown in FIG. 8 .
  • the first generating unit 802 in the network device 800 shown in FIG. 8 can be implemented by calling the code in the memory 903 by the at least one processor 901, and the first generating unit 802 in the network device 800 shown in FIG.
  • the first obtaining unit 801 can be implemented by the transceiver 904 .
  • the network device 900 may also be used to implement the functions of the network device in any of the foregoing embodiments.
  • processor 901 may be a general-purpose central processing unit (central processing unit, CPU), a network processor (network processor, NP), a microprocessor, an application-specific integrated circuit (application-specific integrated circuit, ASIC) , or one or more integrated circuits used to control the execution of the program of this application.
  • CPU central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the bus system 902 described above may include a path to transfer information between the above described components.
  • the above transceiver 904 is used to communicate with other devices or communication networks.
  • the above-mentioned memory 903 can be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, a random access memory (random access memory, RAM) or other types of storage devices that can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • Types of dynamic storage devices which can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), or other optical storage, CD-ROM storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by Any other medium accessed by the computer, but not limited to this.
  • the memory can exist independently and be connected to the processor through a bus.
  • the memory can also be integrated with the processor.
  • the memory 903 is used for storing the application program code for executing the solution of the present application, and the execution is controlled by the processor 901 .
  • the processor 901 is used to execute the application program code stored in the memory 903, so as to realize the functions in the method of this patent.
  • the processor 901 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 9 .
  • the network device 900 may include multiple processors, such as the processor 901 and the processor 907 in FIG. 9 .
  • processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • an embodiment of the present application also provides a computer-readable storage medium, where program codes or instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer can execute the implementation shown in FIG. 2 or FIG. 7 above. The method in any of the implementations in the example.
  • the embodiments of the present application also provide a computer program product, which, when running on a computer, causes the computer to execute any one of the implementation manners of the foregoing method 100 , or causes the computer to execute any one of the foregoing methods 200 . method of implementation.
  • determining B based on A does not mean that B is only determined according to A, and B can also be determined according to A and/or other information.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例公开了一种流量处理方法、装置和网络设备，该方法包括：网络设备获取BGP FlowSpec信息，并基于该BGP FlowSpec信息生成包括第一前缀与动作的第一FIB表项，该BGP FlowSpec信息用于指示对匹配过滤条件的流量执行动作，过滤条件包括目的地址的属性，该第一FIB表项用于指示该网络设备对匹配第一前缀的流量执行动作，第一前缀的属性与过滤条件中目的地址的属性相同。如此，网络设备转发流量时仅需要查看FIB表，就能够按照FlowSpec信息中的动作完成对流量的处理，无需再通过多次查表操作转发，提高了网络设备对流量的处理效率。

Description

一种流量处理方法、装置和网络设备
本申请要求于2020年9月22日提交中国国家知识产权局、申请号为202011002452.5、申请名称为“一种流量处理方法、装置和网络设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种流量处理方法、装置和网络设备。
背景技术
目前，网络设备对需要进行特别控制的流量，会通过获取到的边界网关协议流规则(英文：Border Gateway Protocol Flow Specification，简称：BGP FlowSpec)信息，建立FlowSpec转发表，该FlowSpec转发表包括过滤条件和动作之间的对应关系，其中，过滤条件可以包括自治系统(英文：Autonomous System，简称：AS)号，此外，该网络设备上还具有转发信息库(英文：Forwarding Information Base，简称：FIB)表，该FIB表中的表项包括前缀、AS号和下一跳之间的对应关系。以该FlowSpec转发表包括AS号和动作之间的对应关系为例，当网络设备接收到流量时，首先，查找FIB，确定与该流量匹配的FIB表项，其中，与该流量匹配的FIB表项是指该流量的目的地址与该FIB表项中的前缀匹配；接着，查找FlowSpec转发表，如果确定存在与所匹配的FIB表项中的AS号对应的FlowSpec转发表项，则，基于所匹配的FlowSpec转发表项中的动作对该流量进行控制。
上述流量控制方式中，网络设备对接收到的流量需要执行多次查表的操作，导致网络设备对流量的处理效率较低，影响网络设备的性能。
发明内容
本申请实施例提供了一种流量处理方法、装置、设备及网络设备，网络设备优化指导流量转发的FIB表，使得仅需要一次查表操作，即可对接收到的流量按照BGP FlowSpec信息中的动作进行控制，无需通过多次查表处理流量，提高了网络设备的处理效率。
第一方面，本申请实施例提供了一种流量处理方法，该方法中流量处理的过程可以包括：网络设备获取包括过滤条件和动作的BGP FlowSpec信息，该BGP FlowSpec信息用于指示对匹配所述过滤条件的流量执行所述动作，其中，过滤条件包括目的地址的属性；这样，网络设备即可基于该BGP FlowSpec信息生成包括第一前缀与所述动作的第一FIB表项，该第一FIB表项用于指示该网络设备对匹配第一前缀的流量执行所述动作，其中，第一前缀的属性与所述过滤条件中目的地址的属性相同。如此，网络设备对所接收到的流量，仅需要查看FIB表，确定该流量的目的地址与该第一FIB表项中第一前缀匹配，就能够按照该第一FIB表项中的动作完成对流量的处理，无需再对所接收到的流量进行多次查表操作就能够实现基于BGP FlowSpec对流量的处理，大大的提高了网络设备对流量的处理效率，提升了网络设备的性能。
其中，网络设备获取BGP FlowSpec信息的方式，可以是网络设备接收控制管理设备发 送的控制报文，该控制报文中携带BGP FlowSpec信息，该控制管理设备例如可以是控制器或转发设备。或者，网络设备获取BGP FlowSpec信息的方式，也可以是网络设备从本地配置信息中获取BGP FlowSpec信息。
其中，BGP FlowSpec信息可以指网络设备获取到的BGP FlowSpec路由中携带的信息。该BGP FlowSpec信息中的过滤条件可以用于指示具有特定属性的目的地址，那么，匹配所述过滤条件的流量即为目的地址具有该特定属性的流量。例如，目的地址的属性可以为所述目的地址所属的AS号，也可以为所述目的地址对应的AS号的集合，还可以为所述目的地址对应的团体属性。该BGP FlowSpec信息中的动作，即为该BGP FlowSpec信息中对匹配过滤条件的流量所要实施的操作。例如，BGP FlowSpec信息中的动作可以包括下述动作中的任意一种：重定向、丢包、限速或设置服务质量(英文：Quality of Service，简称：QoS)等级。
作为一个示例，网络设备基于BGP FlowSpec信息生成第一FIB表项的过程可以包括：首先，网络设备基于BGP FlowSpec信息生成FlowSpec路由表项，该FlowSpec路由表项的选路优先级高于其他路由表项的选路优先级，其他路由表项是基于其他路由协议或静态配置获得的，其中，其他路由协议包括但不限于边界网关协议(英文：Border Gateway Protocol，简称：BGP)或内部网关协议(英文：Interior Gateway Protocol，简称：IGP)；接着，网络设备可以将FlowSpec路由表项发送到路由管理(英文：Router Management，简称：RM)路由表，作为该RM路由表中的RM路由表项；最后，网络设备按照该RM路由表中各表项的选路优先级，将该RM路由表中的所述RM路由表项(包括基于BGP FlowSpec信息所生成的FlowSpec路由表项)发送到FIB表，作为所述第一FIB表项。其中，将该RM路由表中的所述RM路由表项发送到FIB表中，例如可以是：将RM路由表中各种选路优先级对应的RM路由表项均发送到FIB表中，并在FIB表中体现各RM路由表项对应FIB表项的选路优先级，该FIB表中的最高选路优先级的FIB表项即为第一FIB表项；或者，也可以是：将RM路由表中选路优先级低于预设阈值的RM路由表项发送到FIB表中，并在FIB表中体现各RM路由表项对应FIB表项的选路优先级，该FIB表中的最高选路优先级的FIB表项即为第一FIB表项；又或者，还可以是：将RM路由表中选路优先级最高的RM路由表项(即，FlowSpec路由表项)发送到FIB表中，那么，该FIB表中的该FlowSpec路由表项即为第一FIB表项。需要说明的是，在FIB表中保存相同前缀的至少两条FIB表项，可以确保某个FIB表项所指示的链路或链路上的网络设备发生故障时，基于前缀相同的其他FIB表项指导流量的转发。
该示例下的选路优先级，可以是网络设备根据实际需求为各种路由设置的、用于确定各路由优先次序的值。通常，各路由的选路优先级可以取0～255，选路优先级的值越小，对应的路由的选路优先级越高。
如果网络设备需要撤销该BGP FlowSpec路由，从而批量撤销该BGP FlowSpec路由对应的路由表项和FIB表项，该示例下的流量处理过程还可以包括：网络设备获取第一撤销信息，该第一撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；这样，网络设备基于第一撤销信息，撤销FlowSpec路由表项。从而，还可以删除RM路由表中该FlowSpec 路由表项对应的RM路由表项，而且，还可以删除BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。如此，实现批量撤销该BGP FlowSpec路由对应的路由表项和FIB表项，简化了配置和维护的成本，使得基于BGP FlowSpec对流量的控制更加灵活，提高了网络设备给用户的使用体验。
作为另一个示例，网络设备基于BGP FlowSpec信息生成第一FIB表项的过程还可以包括：首先，网络设备基于所述BGP FlowSpec信息生成第一RM路由表项，该第一RM路由表项的选路优先级高于第二RM路由表项的选路优先级，该第二RM路由表项为基于其他路由协议或静态配置获得的，其中，其他路由协议包括但不限于：BGP或IGP；接着，网络设备即可按照第一RM路由表项和第二RM路由表项的选路优先级，将第一RM路由表项发送到FIB表，作为所述第一FIB表项。需要说明的是，也可以将第二RM路由表项也发送到FIB表中，但需要在该FIB表中体现该第二RM路由表项对应FIB表项的选路优先级。需要说明的是，如果第一RM路由表和第二RM路由表中均存在多条不同选路优先级的相同路由表项，除了可以只将最高的选路优先级的一条RM路由表项下发到FIB表外，还可以将非最高选路优先级的RM路由表项也下发到FIB表中，这样，非最高选路优先级的FIB表项可以作为对应的最高选路优先级FIB表项的备份表项，当最高选路优先级的FIB表项被撤销时，非最高选路优先级的那条备份表项能够及时承担起转发流量的任务，提高了网络设备的转发性能。
需要说明的是，网络设备中可以包括多张RM路由表，第二RM路由表也可以称为通用路由表或互联网协议(英文：Internet Protocol，简称：IP)路由表，第一RM路由表是新建立并维护的路由表。或者，网络设备中也可以仅包括一张RM路由表，各种不同的路由协议在该RM路由表中通过标签指示该路由协议对应的RM路由表项。
该示例下的选路优先级，可以是根据实际需求为各种RM路由表设置的、用于确定各RM路由表优先次序的值。通常，各RM路由表的选路优先级可以灵活设备，选路优先级的值越小，对应的RM路由表的选路优先级越高。或者，该示例下的选路优先级，也可以是网络设备根据实际需求为各种路由设置的、用于确定各路由优先次序的值，该选路优先级体现在各RM转发表的RM转发表项中，RM路由表项的选路优先级通过其对应的路由的选路优先级表征。
如果网络设备需要撤销该BGP FlowSpec路由，从而批量撤销该BGP FlowSpec路由对应的路由表项和FIB表项，该示例下的流量处理过程还可以包括：网络设备获取第二撤销信息，该第二撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；从而，网络设备即可基于所述第二撤销信息，撤销第一RM路由表项。从而，网络设备还可以删除BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。如此，实现批量撤销该BGP FlowSpec路由对应的路由表项和FIB表项，简化了配置和维护的成本，使得基于BGP FlowSpec对流量的控制更加灵活，提高了网络设备给用户的使用体验。
在一些可能的实现方式中，网络设备获取到BGP FlowSpec信息后，可以生成多条FIB表项，例如，网络设备除了可以基于该BGP FlowSpec信息生成第一FIB表项，还可以基于 该BGP FlowSpec信息生成第二FIB表项，该第二FIB表项包括第二前缀与所述动作的对应关系，该第二FIB表项用于指示网络设备对匹配所述第二前缀的流量执行所述动作，该第二前缀的属性与所述目的地址的属性相同，所述第二前缀与所述第一前缀不同。
作为一个示例，该流量处理的过程还可以包括网络设备对具体报文的处理过程。例如，当网络设备接收到第一报文时，可以先判断该第一报文的目的地址与该第一FIB表项的第一前缀是否匹配，如果匹配，则按照该第一FIB表项中的所述动作，对第一报文进行处理。又例如，当网络设备接收到第二报文时，可以先判断该第二报文的目的地址与该第二FIB表项的第二前缀是否匹配，如果匹配，则按照该第二FIB表项中的所述动作，对第二报文进行处理。可见，通过一次查表操作(即查FIB表的操作)即可实现基于BGP FlowSpec对流量的处理，大大的提高了网络设备对流量的处理效率，提升了网络设备的性能。
第二方面，本申请实施例还提供了一种网络设备，该网络设备至少可以包括：第一获取单元和第一生成单元。其中，第一获取单元，用于获取BGP FlowSpec信息，所述BGP FlowSpec信息包括过滤条件和动作，所述BGP FlowSpec信息用于指示对匹配所述过滤条件的流量执行所述动作，所述过滤条件包括目的地址的属性；第一生成单元，用于基于所述BGP FlowSpec信息生成第一转发信息库FIB表项，所述第一FIB表项包括第一前缀与所述动作的对应关系，所述第一FIB表项用于指示所述网络设备对匹配所述第一前缀的流量执行所述动作，所述第一前缀的属性与所述目的地址的属性相同。
作为一个示例，该网络设备还可以包括：接收单元、确定单元和处理单元。其中，接收单元，用于接收报文；确定单元，用于确定所述报文的目的地址匹配所述第一FIB表项的所述第一前缀；处理单元，用于按照所述动作，对所述报文进行处理。
作为一个示例，第一获取单元，具体用于：接收控制管理设备发送的控制报文，所述控制报文中携带所述BGP FlowSpec信息，所述控制管理设备包括控制器或转发设备。或者，该第一获取单元，具体用于：从本地配置信息中获取所述BGP FlowSpec信息。
其中，过滤条件中目的地址的属性可以为所述目的地址所属的AS号或所述目的地址对应的AS号的集合。或者，过滤条件中目的地址的属性也可以为所述目的地址对应的团体属性。
BGP FlowSpec信息中的所述动作包括下述动作中的任意一种：重定向、丢包、限速或设置QoS等级。
在一些可能的实现方式中，第一生成单元可以包括：第一生成子单元、第一发送子单元和第二发送子单元。其中，第一生成子单元，用于基于所述BGP FlowSpec信息生成FlowSpec路由表项，所述FlowSpec路由表项的选路优先级高于其他路由表项的选路优先级，所述其他路由表项是基于其他路由协议或静态配置获得的；第一发送子单元，用于将所述FlowSpec路由表项发送到路由管理RM路由表，作为所述RM路由表中的RM路由表项；第二发送子单元，用于按照所述RM路由表中各表项的选路优先级，将所述RM路由表中的所述RM路由表项发送到FIB表，作为所述第一FIB表项。
该实现方式中，网络设备还可以包括：第二获取单元和第一撤销单元。该第二获取单元，用于获取第一撤销信息，所述第一撤销信息用于指示对所述BGP FlowSpec信息执行撤 销操作；第一撤销单元，用于基于所述第一撤销信息，撤销所述FlowSpec路由表项。
在另一种可能的实现方式中，第一生成单元也可以包括：第二生成单元和第三发送子单元。其中，第二生成子单元，用于基于所述BGP FlowSpec信息生成第一路由管理RM路由表项，所述第一RM路由表项的选路优先级高于第二RM路由表项的选路优先级，所述第二RM路由表项为基于其他路由协议或静态配置获得的；第三发送子单元，用于按照所述第一RM路由表项和所述第二RM路由表项的选路优先级，将所述第一RM路由表项发送到FIB表，作为所述第一FIB表项。
该实现方式中，网络设备还可以包括：第三获取单元和第二撤销单元。其中，第三获取单元，用于获取第二撤销信息，所述第二撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；第二撤销单元，用于基于所述第二撤销信息，撤销所述第一RM路由表项。
此外，上述两种可能的实现方式中，网络设备还可以包括：第三撤销单元。该第三撤销单元，用于删除所述BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。
上述实现方式中的其他路由协议可以包括：BGP或IGP。
作为一个示例，该网络设备还可以包括：第二生成单元。该第二生成单元，用于基于所述BGP FlowSpec信息生成第二FIB表项，所述第二FIB表项包括第二前缀与所述动作的对应关系，所述第二FIB表项用于指示所述网络设备对匹配所述第二前缀的流量执行所述动作，所述第二前缀的属性与所述目的地址的属性相同，所述第二前缀与所述第一前缀不同。
需要说明的是，该第二方面提供的网络设备用于执行上述第一方面提及的相关操作，其具体实现方式以及达到的效果，均可以参见上述第一方面的相关描述，在此不再赘述。
第三方面，本申请实施例还提供了一种网络设备，包括：存储器和处理器。其中，存储器用于存储程序代码或指令；处理器用于运行程序代码或指令，使得网络设备执行以上第一方面提供的方法。
第四方面，本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质中存储有程序代码或指令，当其在计算机上运行时，使得计算机执行以上第一方面提供的任意一种可能的实现方式中提供的方法。
第五方面，本申请实施例还提供了一种计算机程序产品，当该计算机程序产品在网络设备上运行时，使得网络设备执行第一方面的任意一种可能的实现方式中提供的方法。
附图说明
图1为本申请实施例中一应用场景所涉及的网络10的结构示意图；
图2为本申请实施例中一种流量处理方法100的流程示意图；
图3为本申请实施例中S102的一种实现方式的流程示意图；
图4为本申请实施例中一种网络设备中各种表项的示意图；
图5为本申请实施例中S102的另一种实现方式的流程示意图；
图6为本申请实施例中另一种网络设备中各种表项的示意图；
图7为本申请实施例中一种流量处理方法200的信令流程图；
图8为本申请实施例中一种网络设备800的结构示意图；
图9为本申请实施例中一种网络设备900的结构示意图。
具体实施方式
在请求意见稿(英文：Request for Comments，简称：RFC)5575中标准化了BGP FlowSpec，具体是指通过扩展的BGP网络层可达信息类型和扩展团体属性携带过滤条件和动作之间的对应关系，使得匹配该过滤条件的流量执行该过滤条件对应的动作，以达到流量控制的目的。目前，为了简化FlowSpec在控制平面的表项数量，出现了针对一组去往同一个AS的目的地址进行优化的方案。在该方案中，使用BGP FlowSpec对流量进行处理时，网络设备对接收到的流量需要执行多次查表操作，损耗网络设备的性能，降低网络设备对流量的处理效率。
基于此，在本申请实施例中，提供了一种流量处理方法，网络设备能够基于所获取的BGP FlowSpec信息生成第一FIB表项，该第一FIB表项包括第一前缀与动作的对应关系，该动作为BGP FlowSpec信息所包括的动作，该第一前缀为与BGP FlowSpec信息中所包括的过滤条件所指示的目的地址具有相同属性的前缀。其中，BGP FlowSpec信息用于指示对匹配过滤条件的流量执行所述动作，生成的第一FIB表项用于指示网络设备对匹配该第一前缀的流量执行所述动作，从而，对所接收到的流量，网络设备仅需要查看FIB表，确定该流量与该第一FIB表项中第一前缀匹配，则可以按照该第一FIB表项中的动作完成对流量的处理，无需再对所接收到的流量进行多次查表操作才实现基于BGP FlowSpec对流量的处理，大大的提高了网络设备对流量的处理效率，提升了网络设备的性能。
举例来说，以图1所示的网络10为例，该网络10中可以包括网络域1、网络域2和网络域3，其中，网络域1、网络域2和网络域3对应的AS号分别为64596、64597和64598。网络域2中包括网络设备11、网络设备12和网络设备13，该网络10还可以包括控制管理设备20。假设网络设备11通过接口I1连接网络域1，通过接口O2连接网络设备12，通过接口O3连接网络设备13，控制管理设备20能够对网络10中的各网络设备进行管控。
目前，网络设备11上包括FIB表项1，该FIB表项1包括：前缀1和O2(即从网络设备11到网络设备12的下一跳出接口标识)。这样，当网络设备11接收到来自网络域1的报文1时，该报文1中包括目的地址1，此时，网络设备11对该报文1的处理过程可以包括：S11，网络设备11查看FIB表，确定目的地址1和FIB表项1中的前缀1匹配，获取该FIB表项1中的下一跳出接口O2：S12，网络设备11将报文1从出接口O2转出到网络设备12上。如此，网络设备11能够基于FIB表对流量进行转发处理。
假设从网络域1接收的流量需要经过网络域2到达网络域3，而流量从网络设备11进入网络域2后，在许多场景下，需要将流量重定向到网络设备13，由网络设备13将转出网络域2进入网络域3。网络设备11将流量重定向到网络设备13的场景，包括但不限于：场景一，网络设备12上承载的流量较大，丢包严重，而网络设备13上承载的流量较少，出于流量均衡调度的目的，可以将网络设备11接收到的流量重定向到网络设备13；场景二， 网络设备11为了防止攻击，将所接收到的流量重定向到网络设备13上进行流量清洗，提高网络安全性。具体而言，网络设备11将流量重定向到网络设备13，可以是控制管理设备20对网络设备11发送BGP FlowSpec信息后，网络设备11基于该BGP FlowSpec信息对网络设备11所接收的流量进行的处理操作。网络设备使用BGP FlowSpec信息进行流量处理之前，需要进行的预处理过程可以包括：S21，控制管理设备20向网络设备11发送BGP FlowSpec信息1，该BGP FlowSpec信息1包括：64598(即，目的地址对应的AS号)和重定向到网络设备13(即，动作)之间的对应关系，用于指示网络设备11将所有去往AS64598的流量重定向到网络设备13；S22，网络设备11基于该BGP FlowSpec信息1生成一条BGP FlowSpec路由表项，并在BGP FlowSpec转发表中增加表项1，所增加的BGP FlowSpec转发表项1包括：64598和O3(即从网络设备11到网络设备13的下一跳出接口标识)；S23，网络设备11接收网络域3发布的BGP路由，将FIB表中基于这些BGP路由生成的FIB表项关联到AS号(即，关联到64598)，例如，生成一个关联了AS号的FIB表项1’中包括：前缀1、64598和O2(即从网络设备11到网络设备12的下一跳出接口标识)。这样，当网络设备11接收到来自网络域1的报文1，该报文1中包括目的地址1，此时，网络设备11对该报文1的处理过程可以包括：S24，网络设备11查看FIB表，确定目的地址1和FIB表项1’中的前缀1匹配，获取该FIB表项1’中的AS号64598；S25，网络设备11查看BGP FlowSpec转发表，确定AS号为64598的BGP FlowSpec转发表项1，获取该BGP FlowSpec转发表项1中的下一跳出接口O3；S26，网络设备11将报文1从出接口O3转出，通过网络设备13发送到网络域3。可见，基于目前的BGP FlowSpec对流量处理至少需要执行2次查表操作，对网络设备11存在性能损耗。
作为一个示例，基于本申请实施例提供的流量处理方法，使用BGP FlowSpec进行流量处理之前，需要进行的预处理过程可以包括：S21，控制管理设备20向网络设备11发送BGP FlowSpec信息1，该BGP FlowSpec信息1包括：64598和重定向到网络设备13(例如可以是从网络设备11到网络设备13的下一跳出接口标识O3)之间的对应关系；S22，网络设备11基于该BGP FlowSpec信息1生成一条BGP FlowSpec路由表项；S23，网络设备11接收网络域3发布的BGP路由，在FIB表中基于这些BGP路由和BGP FlowSpec信息1生成的FIB表项2，该FIB表项2中包括：前缀2和O3。这样，当网络设备11接收到来自网络域1的报文2，该报文2中包括目的地址2，此时，网络设备11对该报文2的处理过程可以包括：S24，网络设备11查看FIB表，确定目的地址2和FIB表项2中的前缀2匹配，获取该FIB表项1中的下一跳出接口标识O3；S25，网络设备11将报文2从出接口O3转出，通过网络设备13发送到网络域3。可见，基于本申请实施例提供的方法，使用BGP FlowSpec对流量处理仅需要执行1次查表操作，即，仅需查看FIB表就能够对流量进行准确的转发，提高了网络设备的处理效率。
需要说明的是，上述网络设备是指具有报文转发功能的路由器、交换机、防火墙等设备。控制管理设备是指具有生成BGP FlowSpec信息并向各网络设备发送BGP FlowSpec信息功能的设备或功能模块，例如可以是控制器、服务器、网络设备或网络设备中的控制管理模块。
下面结合附图，通过实施例来详细说明本申请实施例中一种流量处理方法的具体实现方式。
图2为本申请实施例中一种流量处理方法100的信令流程图。参见图2，该方法100应用于网络设备，例如可以应用在图1所示的网络设备11中，实现对从网络域1经过网络域2中的网络设备11向网络域3发送的流量的处理；又例如也可以应用在图1所示的网络设备13中，实现对从网络域3经过网络域2中的网络设备13向网络域1发送的流量的处理。具体实现时，该方法100例如可以包括下述S101～S102：
S101，获取BGP FlowSpec信息，该BGP FlowSpec信息包括过滤条件和动作，该BGP FlowSpec信息用于指示对匹配所述过滤条件的流量执行所述动作，过滤条件包括目的地址的属性。
其中，BGP FlowSpec信息可以指网络设备获取到的BGP FlowSpec路由中携带的信息。该BGP FlowSpec信息中的过滤条件可以用于指示具有特定属性的目的地址，那么，匹配所述过滤条件的流量即为目的地址具有该特定属性的流量。该BGP FlowSpec信息中的动作，即为该BGP FlowSpec信息中对匹配过滤条件的流量所要实施的操作。
作为一个示例，过滤条件也可以为目的地址所属的AS号，例如，在图1所示的网络10中，网络设备11获取到的BGP FlowSpec信息中的过滤条件可以为网络域3的AS号：64598，该BGP FlowSpec信息用于指示对目的地址所属的AS号为64598的流量执行相应的动作。
作为另一个示例，过滤条件可以为目的地址对应的AS号集合，例如，假设对于从网络域0发出的流量需要经过网络域1、网络域2和网络域3到达网络域4，那么，网络域1中的网络设备获取到的BGP FlowSpec信息中的过滤条件可以为网络域2、网络域3和网络域4对应的AS号的集合：{64597，64598，64599}，该BGP FlowSpec信息用于指示对匹配该AS号集合的流量执行相应的动作。其中，匹配AS号集合的流量，可以是指流量的目的地址和该AS号集合中的至少一个AS号匹配，也可以是指流量的目的地址和该AS号集合中的各个AS号均匹配。例如，该过滤条件可以是一组AS号的有序集合(也称为AS-Path){64599，64598，64597}，表征只有依次经过该AS号集合所指示的所有网络域传输的流量才符合该过滤条件，那么，网络设备接收到流量后，只有该流量的目的地址与该AS-Path中的所有AS号均匹配，才按照该BGP FlowSpec信息中AS-Path对应的动作对该流量进行处理。
作为又一个示例，过滤条件也可以是目的地址对应的团体属性。其中，目的地址对应的团体属性，可以是指用于发布目的地址对应的BGP路由时，该用于发布BGP路由的BGP报文中所携带的团体属性或扩展团体属性中携带的信息，该信息用于指示符合某个或某些相同特征的至少一个目的地址。例如，过滤条件可以是团体属性100:100，该100:100用于指示网络域1和网络域2中的所有网络设备的地址集合，即发布网络域1和网络域2中的所有网络设备的地址对应的BGP路由时，BGP报文中所携带的团体属性均为100:100。当网络设备接收到流量后，如果该流量的目的地址对应的团体属性为100:100，则，认为该流 量满足该过滤条件，可以按照该BGP FlowSpec信息中的动作对该流量进行处理。
BGP FlowSpec信息中的动作，可以是任意可以实现的对流量的处理操作，例如可以包括下述动作中的任意一种：重定向、丢包、限速或设置服务质量(英文：Quality of Service，简称：QoS)等级。重定向，是指将符合过滤条件的流量定向发送到某个特定的网络设备，例如，在图1所示的网络10中，可以将网络设备11接收到的目的地址属于AS64598的流量定向发送到网络设备13上，该过程中执行的动作即为重定向，该BGP FlowSpec信息中的动作具体可以是：重定向到网络设备13的IP地址。丢包，是指对符合过滤条件的流量进行丢包处理。限速，是指对符合过滤条件的流量进行限速处理。设置QoS等级，是指对符合过滤条件的流量设置对应的QoS等级。
对于S101中获取BGP FlowSpec信息的实现方式，一种情况下，控制管理设备向网络设备发送控制报文，该网络设备通过解析所接收到的控制报文，获取该控制报文中携带的BGP FlowSpec信息。其中，该控制管理设备可以是控制器，也可以是除了执行该方法100的网络设备以外的其他网络设备(也可以称为转发设备)。另一种情况下，网络设备内可以集成有控制管理模块，那么，网络设备可以从自身的控制管理模块中获取该BGP FlowSpec信息。又一种情况下，也可以在网络设备上本地进行配置BGP FlowSpec信息，那么，网络设备可以从本地的配置信息中获取BGP FlowSpec信息。
通过S101，网络设备获取到BGP FlowSpec信息，为执行S102提供了数据基础，使得使用BGP FlowSpec对流量进行处理成为了可能。
S102，基于该BGP FlowSpec信息生成第一FIB表项，该第一FIB表项包括第一前缀与所述动作的对应关系，该第一FIB表项用于指示所述网络设备对匹配所述第一前缀的流量执行所述动作，第一前缀的属性与目的地址的属性相同。
需要说明的是，网络设备获取BGP FlowSpec信息后，可以基于该BGP FlowSpec信息生成多条FIB表项，所生成的多条FIB表项中每条FIB表项的前缀的属性均与过滤条件中包括的目的地址的属性相同。例如，网络设备基于该BGP FlowSpec信息生成第一FIB表项和第二FIB表项，参见下表1所示：
表1基于BGP FlowSpec信息生成的FIB表项
第一FIB表项 第一前缀 动作
第二FIB表项 第二前缀 动作
其中，该第一前缀的属性和第二前缀的属性相同，均与过滤条件所包括的目的地址的属性相。例如，过滤条件所包括的目的地址的属性为AS号64598，那么，第一前缀和第二前缀均属于AS号为64598对应的AS。又例如，过滤条件所包括的目的地址的属性为AS号集合{64596，64597，64598}，那么，第一前缀和第二前缀均属于AS号集合，如，第一前缀和第二前缀同时和64596、64597和64598匹配。再例如，过滤条件所包括的目的地址的属性为目的地址对应的团体属性100:100，则，第一前缀和第二前缀均属于该100:100所指示的前缀范围。表1中的动作可以灵活表示，例如，该动作为重定向到网络设备13，则，该FIB表项中的动作具体可以是网络设备13的IP地址。
下文中以基于BGP FlowSpec信息生成第一FIB表项为例，对基于BGP FlowSpec信息 生成FIB表项的实现方式进行示例性的说明。
作为一个示例，S102的实现可以参加图3所示，具体可以包括：S102a1，基于BGP FlowSpec信息生成FlowSpec路由表项，该FlowSpec路由表项的选路优先级高于其他协议路由表项的选路优先级，其中，其他协议路由表项是基于其他路由协议或静态配置获得的；S102a2，将FlowSpec路由表项发送到路由管理(英文：Router Management，简称：RM)路由表，作为RM路由表中的RM路由表项；S102a3，按照该RM路由表中各表项的选路优先级，将RM路由表中的所述RM路由表项发送到FIB表，作为所述第一FIB表项。需要说明的是，S102a3例如可以是：将RM路由表中各种选路优先级对应的RM路由表项均发送到FIB表中，并在FIB表中体现各RM路由表项对应FIB表项的选路优先级；或者，S102a3例如也可以是：将RM路由表中选路优先级低于预设阈值的RM路由表项发送到FIB表中，并在FIB表中体现各RM路由表项对应FIB表项的选路优先级；又或者，S102a3例如还可以是：将RM路由表中选路优先级最高的RM路由表项(即，FlowSpec路由表项)发送到FIB表中，那么，该FIB表中的该FlowSpec路由表项即为S102中的第一FIB表项。在FIB表中保存相同前缀的至少两条FIB表项，可以确保某个FIB表项所指示的链路或链路上的网络设备发生故障时，基于前缀相同的其他FIB表项指导流量的转发。
其中，该示例下的选路优先级，可以是网络设备根据实际需求为各种路由设置的、用于确定各路由优先次序的值。通常，各路由的选路优先级可以取0～255，选路优先级的值越小，对应的路由的选路优先级越高。
该示例中，网络设备可以建立FlowSpec路由表，并设置该FlowSpec路由表的选路优先级高于其他路由表的选路优先级，例如，假设网络设备中存在BGP路由表、开放式最短路径优先(英文：Open Shortest Path First，简称：OSPF)路由表、中间系统到中间系统(英文：Intermediate System to Intermediate System，简称：ISIS)路由表和静态路由表，如果静态路由表的选路优先级为5，OSPF路由表的选路优先级为10，ISIS路由表的选路优先级为15，BGP路由表的选路优先级为160，则，可以设置FlowSpec路由表的选路优先级为2，高于其他路由表的选路优先级。
需要说明的是，网络设备中可以包括多张路由表，不同路由协议可以分别维护该路由协议对应的路由表；或者，网络设备中也可以仅包括一张路由表，各种不同的路由协议在该路由表中通过标签指示该路由协议对应的路由表项。下文中以每个路由协议对应一张路由表为例进行描述。
如图4所示，假设网络设备中包括BGP路由表1、ISIS路由表2、静态路由表3和FlowSpec路由表4，BGP路由表1、ISIS路由表2和静态路由表3中分别包括前缀1对应的BGP路由表项1、ISIS路由表项2和静态路由表项3。当网络设备接收到BGP FlowSpec信息时，在FlowSpec路由表生成前缀1对应的FlowSpec路由表项4，其中，前缀1的属性和BGP FlowSpec信息中过滤条件所包括的目的地址的属性。这样，网络设备中BGP路由表1、ISIS路由表2、静态路由表3和FlowSpec路由表4均可以将前缀1对应的BGP路由表项1、ISIS路由表项2、静态路由表项3和FlowSpec路由表项4发送到RM路由表5，作为RM路由表5中的RM路由表项1～4；该RM路由表5基于接收到的各路由表项对应 的选路优先级，将RM路由表项1～4中选路优先级最高的RM路由表项4(即FlowSpec路由表项4)发送到FIB表中，即，FIB表中包括FIB表项1(即RM路由表项4或FlowSpec路由表项4)。如此，网络设备对于所接收的目的地址和该前缀1匹配的报文，即可基于该FIB表中的FIB表项1中的动作对该报文进行相应的处理。
其中，BGP路由表、ISIS路由表、静态路由表和FlowSpec路由表等路由表发送到RM路由表的路由表项，可以是各路由表中相同前缀的所有路由表项，也可以是各路由表各自从相同前缀的路由表项中选择预设条数的路由表项。
作为另一个示例，S102的实现可以参加图5所示，具体可以包括：S102b1，基于BGP FlowSpec信息生成第一RM路由表项，该第一RM路由表项的选路优先级高于第二RM路由表项的选路优先级，该第二RM路由表项为基于其他路由协议或静态配置获得的；S102b2，按照第一RM路由表项和第二RM路由表项的选路优先级，将第一RM路由表项发送到FIB表，作为第一FIB表项。需要说明的是，也可以将第二RM路由表项也发送到FIB表中，但需要在该FIB表中体现该第二RM路由表项对应FIB表项的选路优先级。
需要说明的是，网络设备中可以包括多张RM路由表，基于其他路由协议获得的路由表和静态配置的路由表对应第二RM路由表，基于BGP FlowSpec信息获得的路由表对应第一RM路由表。其中，第二RM路由表也可以称为通用路由表或IP路由表，第一RM路由表是新建立并维护的路由表。或者，网络设备中也可以仅包括一张RM路由表，各种不同的路由协议在该RM路由表中通过标签指示该路由协议对应的RM路由表项。下文中以2张RM路由表为例进行描述。
其中，该示例下的选路优先级，可以是根据实际需求为各种RM路由表设置的、用于确定各RM路由表优先次序的值。通常，各RM路由表的选路优先级可以灵活设备，选路优先级的值越小，对应的RM路由表的选路优先级越高。或者，该示例下的选路优先级，也可以是网络设备根据实际需求为各种路由设置的、用于确定各路由优先次序的值，该选路优先级体现在各RM转发表的RM转发表项中，RM路由表项的选路优先级通过其对应的路由的选路优先级表征。
该示例中，网络设备可以建立FlowSpec路由表和第一RM路由表，并设置该第一RM路由表的选路优先级高于第一RM路由表的选路优先级，例如，假设网络设备中存在BGP路由表、OSPF路由表、ISIS路由表和静态路由表，且该BGP路由表、OSPF路由表、ISIS路由表和静态路由表均将路由表现发送到第二RM路由表中，第二RM路由表的选路优先级为100，则，可以设置第一RM路由表的选路优先级为17，高于第二路由表的选路优先级。
如图6所示，假设网络设备中包括BGP路由表1、ISIS路由表2、静态路由表3和FlowSpec路由表4，BGP路由表1、ISIS路由表2和静态路由表3中分别包括前缀1对应的BGP路由表项1、ISIS路由表项2和静态路由表项3，且BGP路由表1、ISIS路由表2和静态路由表3分别将表项下发到RM路由表2中，即，该RM路由表2中包括RM路由表项21～23(分别对应BGP路由表项1、ISIS路由表项2、静态路由表项3)。当网络设备接收到BGP FlowSpec信息时，在FlowSpec路由表生成前缀1对应的FlowSpec路由表项4， 其中，前缀1的属性和BGP FlowSpec信息中过滤条件所包括的目的地址的属性。这样，网络设备可以将FlowSpec路由表项4发送到RM路由表1，作为RM路由表1中的RM路由表项11；这样，该网络设备即可获取RM路由表1和RM路由表2的选路优先级，确定RM路由表1的选路优先级更高，则，将RM路由表1中的RM路由表项11(即FlowSpec路由表项4)发送到FIB表中，即，FIB表中包括FIB表项1(即RM路由表项11或FlowSpec路由表项4)。如此，网络设备对于所接收的目的地址和该前缀1匹配的报文，即可基于该FIB表中的FIB表项1中的动作对该报文进行相应的处理。
在一些情况下，如果RM路由表1和RM路由表2中均存在多条不同选路优先级的相同路由表项，除了可以只将最高的选路优先级的一条RM路由表项下发到FIB表外，还可以将非最高选路优先级的RM路由表项也下发到FIB表中，这样，非最高选路优先级的FIB表项可以作为对应的最高选路优先级FIB表项的备份表项，当最高选路优先级的FIB表项被撤销时，非最高选路优先级的那条备份表项能够及时承担起转发流量的任务，提高了网络设备的转发性能。
需要说明的是，上述示例中所述的其他路由协议可以包括：BGP或IGP，IGP例如可以包括但不限于上文提及的ISIS协议和OSPF协议。
经过S102，网络设备将BGP FlowSpec信息结合到FIB表中前缀符合过滤条件的FIB表项中，为网络设备基于BGP FlowSpec实现对流量的处理做好了准备。
在S102后，当网络设备接收到报文，且该报文的目的地址和第一FIB表项中的第一前缀匹配，则，网络设备按照该第一FIB表项中的动作，对该报文进行处理。或者，当网络设备接收到报文，且该报文的目的地址和第二FIB表项中的第二前缀匹配，则，网络设备按照该第二FIB表项中的动作，对该报文进行处理。
可见，通过本申请实施例提供的方法100，网络设备能够基于所获取的BGP FlowSpec信息生成第一FIB表项，该第一FIB表项包括第一前缀与动作的对应关系，该动作为BGP FlowSpec信息所包括的动作，该第一前缀为与BGP FlowSpec信息中所包括的过滤条件所指示的目的地址具有相同属性的前缀。其中，BGP FlowSpec信息用于指示对匹配过滤条件的流量执行所述动作，生成的第一FIB表项用于指示网络设备对匹配该第一前缀的流量执行所述动作，从而，对所接收到的流量，网络设备仅需要查看FIB表，确定该流量与该第一FIB表项中第一前缀匹配，则可以按照该第一FIB表项中的动作完成对流量的处理，无需再对所接收到的流量进行多次查表操作才实现基于BGP FlowSpec对流量的处理，大大的提高了网络设备对流量的处理效率，提升了网络设备的性能。而且，该方法100中，网络批量生成并维护BGP FlowSpec路由，并在FIB表中生成考虑了BGP FlowSpec路由的FIB表项，简化了配置和维护的成本。
在一些可能的实现方式中，该网络设备除了可以批量生成BGP FlowSpec路由对应的FIB表项，还可以撤销BGP FlowSpec路由，从而批量撤销该BGP FlowSpec路由对应的路由表项和FIB表项，提高了网络设备给用户的使用体验。具体实现时，本申请实施例提供了一种流量处理方法200，如图7所示，该方法200在S102之后，还可以包括：
S103，获取撤销信息，该撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；
S104，基于所述撤销信息，撤销该BGP FlowSpec信息对应的路由表项；
S105，删除所述BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。
对于S103，可以是网络设备接收控制管理设备发送的撤销信息，也可以是在网络设备上配置的撤销信息，即，网络设备从本地的配置信息中获取的撤销信息。
对于S104，一种情况下，如果S102通过图3所示的S102a1～S102a3实现，则，S104例如可以包括：网络设备基于撤销信息，撤销FlowSpec路由表项。从而，可以删除RM路由表中该FlowSpec路由表项对应的RM路由表项，而且，还可以删除BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。例如，对于网络设备中图4所示的各种表项，经过方法200后，FlowSpec路由表4删除FlowSpec路由表项4，RM路由表5中删除RM路由表项4，FIB表删除FIB表项1或将FIB表项1设置为无效状态。
另一种情况下，如果S102通过图5所示的S102b1和S102b2实现，则，S104例如可以包括：网络设备基于撤销信息，撤销第一RM路由表项。从而，可以删除BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。例如，对于网络设备中图6所示的各种表项，经过方法200后，FlowSpec路由表4删除FlowSpec路由表项4，RM路由表1中删除RM路由表项11，FIB表删除FIB表项1或将FIB表项1设置为无效状态。
需要说明的是，S105中提及的“BGP FlowSpec信息对应的FIB表项”，是指基于该BGP FlowSpec信息生成的全部或部分FIB表项。BGP FlowSpec信息对应的FIB表项中的前缀的属性，均与BGP FlowSpec信息中过滤条件所包括的目的地址的属性相同，或者也可以认为，BGP FlowSpec信息对应的FIB表项中的前缀，均符合BGP FlowSpec信息中过滤条件。
可见，通过本申请实施例提供的方法200，网络设备不仅能够基于所获取的BGP FlowSpec信息生成对应的FIB表项，用于指示网络设备对匹配所生成FIB表项中前缀的流量执行BGP FlowSpec信息中对应的动作，使得通过一次查表即可基于BGP FlowSpec对流量进行处理成为可能，而且，还能够基于获取的撤销信息，撤销BGP FlowSpec路由，从而批量撤销该BGP FlowSpec路由对应的路由表项和FIB表项，简化了配置和维护的成本，使得基于BGP FlowSpec对流量的控制更加灵活，提高了网络设备给用户的使用体验。
相应的，本申请实施例还提供了一种网络设备800，如图8。该网络设备800包括：第一获取单元801和第一生成单元802。
其中，第一获取单元801，用于获取BGP FlowSpec信息，所述BGP FlowSpec信息包括过滤条件和动作，所述BGP FlowSpec信息用于指示对匹配所述过滤条件的流量执行所述动作，所述过滤条件包括目的地址的属性。所述第一获取单元801可以执行图2所示的S101。
第一生成单元802，用于基于所述BGP FlowSpec信息生成第一转发信息库FIB表项，所述第一FIB表项包括第一前缀与所述动作的对应关系，所述第一FIB表项用于指示所述 网络设备对匹配所述第一前缀的流量执行所述动作，所述第一前缀的属性与所述目的地址的属性相同。所述第一生成单元802可以执行图2所示的S102。
作为一个示例，该网络设备800还可以包括：接收单元、确定单元和处理单元。其中，接收单元，用于接收报文；确定单元，用于确定所述报文的目的地址匹配所述第一FIB表项的所述第一前缀；处理单元，用于按照所述动作，对所述报文进行处理。
作为一个示例，第一获取单元801，具体用于：接收控制管理设备发送的控制报文，所述控制报文中携带所述BGP FlowSpec信息，所述控制管理设备包括控制器或转发设备。或者，该第一获取单元801，具体用于：从本地配置信息中获取所述BGP FlowSpec信息。
其中，过滤条件中目的地址的属性可以为所述目的地址所属的AS号或所述目的地址对应的AS号的集合。或者，过滤条件中目的地址的属性也可以为所述目的地址对应的团体属性。
BGP FlowSpec信息中的所述动作包括下述动作中的任意一种：重定向、丢包、限速或设置QoS等级。
在一些可能的实现方式中，第一生成单元802可以包括：第一生成子单元、第一发送子单元和第二发送子单元。其中，第一生成子单元，用于基于所述BGP FlowSpec信息生成FlowSpec路由表项，所述FlowSpec路由表项的选路优先级高于其他路由表项的选路优先级，所述其他路由表项是基于其他路由协议或静态配置获得的；第一发送子单元，用于将所述FlowSpec路由表项发送到路由管理RM路由表，作为所述RM路由表中的RM路由表项；第二发送子单元，用于按照所述RM路由表中各表项的选路优先级，将所述RM路由表中的所述RM路由表项发送到FIB表，作为所述第一FIB表项。
该实现方式中，网络设备800还可以包括：第二获取单元和第一撤销单元。该第二获取单元，用于获取第一撤销信息，所述第一撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；第一撤销单元，用于基于所述第一撤销信息，撤销所述FlowSpec路由表项。
在另一种可能的实现方式中，第一生成单元802也可以包括：第二生成单元和第三发送子单元。其中，第二生成子单元，用于基于所述BGP FlowSpec信息生成第一路由管理RM路由表项，所述第一RM路由表项的选路优先级高于第二RM路由表项的选路优先级，所述第二RM路由表项为基于其他路由协议或静态配置获得的；第三发送子单元，用于按照所述第一RM路由表项和所述第二RM路由表项的选路优先级，将所述第一RM路由表项发送到FIB表，作为所述第一FIB表项。
该实现方式中，网络设备800还可以包括：第三获取单元和第二撤销单元。其中，第三获取单元，用于获取第二撤销信息，所述第二撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；第二撤销单元，用于基于所述第二撤销信息，撤销所述第一RM路由表项。
此外，上述两种可能的实现方式中，网络设备800还可以包括：第三撤销单元。该第三撤销单元，用于删除所述BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。
上述实现方式中的其他路由协议可以包括：BGP或IGP。
作为一个示例，该网络设备800还可以包括：第二生成单元。该第二生成单元，用于基于所述BGP FlowSpec信息生成第二FIB表项，所述第二FIB表项包括第二前缀与所述动作的对应关系，所述第二FIB表项用于指示所述网络设备对匹配所述第二前缀的流量执行所述动作，所述第二前缀的属性与所述目的地址的属性相同，所述第二前缀与所述第一前缀不同。
需要说明的是，图8所示的网络设备800可以是图2或图7所示的示例中的网络设备，因此，网络设备800的各种具体实施例方式，可以参见图2对应的方法100以及图7对应的方法200的相关介绍，本实施例不再赘述。
参见图9，本申请实施例提供了一种网络设备900。该网络设备900可以是上述任一实施例中的网络设备，例如可以是图1所示所示实施例中的网络设备11，也可以是图2所示实施例中的网络设备。该网络设备900包括至少一个处理器901，总线系统902，存储器903以及至少一个收发器904。
该网络设备900是一种硬件结构的装置，可以用于实现图8所示的网络设备800中的功能模块。例如，本领域技术人员可以想到图8所示的网络设备800中的第一生成单元802可以通过该至少一个处理器901调用存储器903中的代码来实现，图8所示的网络设备800中的第一获取单元801可以通过该收发器904来实现。
可选的，该网络设备900还可用于实现上述任一实施例中网络设备的功能。
可选的，上述处理器901可以是一个通用中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
上述总线系统902可包括一通路，在上述组件之间传送信息。
上述收发器904，用于与其他设备或通信网络通信。
上述存储器903可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器903用于存储执行本申请方案的应用程序代码，并由处理器901来控制执行。处理器901用于执行存储器903中存储的应用程序代码，从而实现本专利方法中的功能。
在具体实现中，作为一种实施例，处理器901可以包括一个或多个CPU，例如图9中的CPU0和CPU1。
在具体实现中，作为一种实施例，该网络设备900可以包括多个处理器，例如图9中 的处理器901和处理器907。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
此外，本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质中存储有程序代码或指令，当其在计算机上运行时，使得计算机执行以上图2或图7所示实施例中任意一种实现方式下的方法。
此外，本申请实施例还提供了一种计算机程序产品，当其在计算机上运行时，使得计算机执行前述方法100中任意一种实现方式的方法，或者，使得计算机执行前述方法200中任意一种实现方式的方法。
本申请实施例中提到的“第一前缀”、“第一FIB表项”等名称中的“第一”只是用来做名字标识，并不代表顺序上的第一。该规则同样适用于“第二”等。
应理解，本申请实施例中提到的“基于根据A确定B”并不意味着仅仅根据A确定B，还可以根据A和/或其它信息确定B。
通过以上的实施方式的描述可知，本领域的技术人员可以清楚地了解到上述实施例方法中的全部或部分步骤可借助软件加通用硬件平台的方式来实现。基于这样的理解，本申请的技术方案可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如只读存储器(英文：read-only memory，ROM)/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者诸如路由器等网络通信设备)执行本申请各个实施例或者实施例的某些部分所述的方法。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例和设备实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的设备及系统实施例仅仅是示意性的，其中作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅是本申请的优选实施方式，并非用于限定本申请的保护范围。应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请的前提下，还可以作出若干改进和润饰，这些改进和润饰也应视为本申请的保护范围。

Claims (29)

  1. 一种流量处理方法，其特征在于，应用于网络设备，所述方法包括：
    获取边界网关协议流规则BGP FlowSpec信息，所述BGP FlowSpec信息包括过滤条件和动作，所述BGP FlowSpec信息用于指示对匹配所述过滤条件的流量执行所述动作，所述过滤条件包括目的地址的属性；
    基于所述BGP FlowSpec信息生成第一转发信息库FIB表项，所述第一FIB表项包括第一前缀与所述动作的对应关系，所述第一FIB表项用于指示所述网络设备对匹配所述第一前缀的流量执行所述动作，所述第一前缀的属性与所述目的地址的属性相同。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    接收报文；
    确定所述报文的目的地址匹配所述第一FIB表项的所述第一前缀；
    按照所述动作，对所述报文进行处理。
  3. 根据权利要求1或2所述的方法，其特征在于，所述获取边界网关协议流规则BGP FlowSpec信息，包括：
    接收控制管理设备发送的控制报文，所述控制报文中携带所述BGP FlowSpec信息，所述控制管理设备包括控制器或转发设备。
  4. 根据权利要求1或2所述的方法，其特征在于，所述获取边界网关协议流规则BGP FlowSpec信息，包括：
    从本地配置信息中获取所述BGP FlowSpec信息。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述目的地址的属性为所述目的地址所属的自治系统AS号或所述目的地址对应的AS号的集合。
  6. 根据权利要求1-4任一项所述的方法，其特征在于，所述目的地址的属性为所述目的地址对应的团体属性。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述动作包括下述动作中的任意一种：重定向、丢包、限速或设置服务质量QoS等级。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，所述基于所述BGP FlowSpec信息生成第一转发信息库FIB表项，包括：
    基于所述BGP FlowSpec信息生成FlowSpec路由表项，所述FlowSpec路由表项的选路优先级高于其他路由表项的选路优先级，所述其他路由表项是基于其他路由协议或静态配置获得的；
    将所述FlowSpec路由表项发送到路由管理RM路由表，作为所述RM路由表中的RM路由表项；
    按照所述RM路由表中各表项的选路优先级，将所述RM路由表中的所述RM路由表项发送到FIB表，作为所述第一FIB表项。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    获取第一撤销信息，所述第一撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；
    基于所述第一撤销信息，撤销所述FlowSpec路由表项。
  10. 根据权利要求1-7任一项所述的方法，其特征在于，所述基于所述BGP FlowSpec信息生成第一转发信息库FIB表项，包括：
    基于所述BGP FlowSpec信息生成第一路由管理RM路由表项，所述第一RM路由表项的选路优先级高于第二RM路由表项的选路优先级，所述第二RM路由表项为基于其他路由协议或静态配置获得的；
    按照所述第一RM路由表项和所述第二RM路由表项的选路优先级，将所述第一RM路由表项发送到FIB表，作为所述第一FIB表项。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    获取第二撤销信息，所述第二撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；
    基于所述第二撤销信息，撤销所述第一RM路由表项。
  12. 根据权利要求9或11所述的方法，其特征在于，所述方法还包括：
    删除所述BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。
  13. 根据权利要求8或10所述的方法，其特征在于，所述其他路由协议包括：边界网关协议BGP或内部网关协议IGP。
  14. 根据权利要求1-13任一项所述的方法，其特征在于，所述方法还包括：
    基于所述BGP FlowSpec信息生成第二FIB表项，所述第二FIB表项包括第二前缀与所述动作的对应关系，所述第二FIB表项用于指示所述网络设备对匹配所述第二前缀的流量执行所述动作，所述第二前缀的属性与所述目的地址的属性相同，所述第二前缀与所述第一前缀不同。
  15. 一种网络设备，其特征在于，包括：
    第一获取单元，用于获取边界网关协议流规则BGP FlowSpec信息，所述BGP FlowSpec信息包括过滤条件和动作，所述BGP FlowSpec信息用于指示对匹配所述过滤条件的流量执行所述动作，所述过滤条件包括目的地址的属性；
    第一生成单元，用于基于所述BGP FlowSpec信息生成第一转发信息库FIB表项，所述第一FIB表项包括第一前缀与所述动作的对应关系，所述第一FIB表项用于指示所述网络设备对匹配所述第一前缀的流量执行所述动作，所述第一前缀的属性与所述目的地址的属性相同。
  16. 根据权利要求15所述的网络设备，其特征在于，所述网络设备还包括：
    接收单元，用于接收报文；
    确定单元，用于确定所述报文的目的地址匹配所述第一FIB表项的所述第一前缀；
    处理单元，用于按照所述动作，对所述报文进行处理。
  17. 根据权利要求15或16所述的网络设备，其特征在于，所述第一获取单元，具体用于：
    接收控制管理设备发送的控制报文，所述控制报文中携带所述BGP FlowSpec信息，所 述控制管理设备包括控制器或转发设备。
  18. 根据权利要求15或16所述的网络设备，其特征在于，所述第一获取单元，具体用于：
    从本地配置信息中获取所述BGP FlowSpec信息。
  19. 根据权利要求15-18任一项所述的网络设备，其特征在于，所述目的地址的属性为所述目的地址所属的自治系统AS号或所述目的地址对应的AS号的集合。
  20. 根据权利要求15-18任一项所述的网络设备，其特征在于，所述目的地址的属性为所述目的地址对应的团体属性。
  21. 根据权利要求15-20任一项所述的网络设备，其特征在于，所述动作包括下述动作中的任意一种：重定向、丢包、限速或设置服务质量QoS等级。
  22. 根据权利要求15-21任一项所述的网络设备，其特征在于，所述第一生成单元，包括：
    第一生成子单元，用于基于所述BGP FlowSpec信息生成FlowSpec路由表项，所述FlowSpec路由表项的选路优先级高于其他路由表项的选路优先级，所述其他路由表项是基于其他路由协议或静态配置获得的；
    第一发送子单元，用于将所述FlowSpec路由表项发送到路由管理RM路由表，作为所述RM路由表中的RM路由表项；
    第二发送子单元，用于按照所述RM路由表中各表项的选路优先级，将所述RM路由表中的所述RM路由表项发送到FIB表，作为所述第一FIB表项。
  23. 根据权利要求22所述的网络设备，其特征在于，所述网络设备还包括：
    第二获取单元，用于获取第一撤销信息，所述第一撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；
    第一撤销单元，用于基于所述第一撤销信息，撤销所述FlowSpec路由表项。
  24. 根据权利要求15-21任一项所述的网络设备，其特征在于，所述第一生成单元，包括：
    第二生成子单元，用于基于所述BGP FlowSpec信息生成第一路由管理RM路由表项，所述第一RM路由表项的选路优先级高于第二RM路由表项的选路优先级，所述第二RM路由表项为基于其他路由协议或静态配置获得的；
    第三发送子单元，用于按照所述第一RM路由表项和所述第二RM路由表项的选路优先级，将所述第一RM路由表项发送到FIB表，作为所述第一FIB表项。
  25. 根据权利要求24所述的网络设备，其特征在于，所述网络设备还包括：
    第三获取单元，用于获取第二撤销信息，所述第二撤销信息用于指示对所述BGP FlowSpec信息执行撤销操作；
    第二撤销单元，用于基于所述第二撤销信息，撤销所述第一RM路由表项。
  26. 根据权利要求23或25所述的网络设备，其特征在于，所述网络设备还包括：
    第三撤销单元，用于删除所述BGP FlowSpec信息对应的FIB表项，或者，将所述FlowSpec信息对应的FIB表项设置为无效。
  27. 根据权利要求22或24所述的网络设备，其特征在于，所述其他路由协议包括：边界网关协议BGP或内部网关协议IGP。
  28. 根据权利要求15-27任一项所述的网络设备，其特征在于，所述网络设备还包括：
    第二生成单元，用于基于所述BGP FlowSpec信息生成第二FIB表项，所述第二FIB表项包括第二前缀与所述动作的对应关系，所述第二FIB表项用于指示所述网络设备对匹配所述第二前缀的流量执行所述动作，所述第二前缀的属性与所述目的地址的属性相同，所述第二前缀与所述第一前缀不同。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有程序代码或指令，当所述程序代码或指令在计算机上运行时，使得所述计算机执行以上权利要求1-14中任意一项所述的方法。
PCT/CN2021/118136 2020-09-22 2021-09-14 一种流量处理方法、装置和网络设备 WO2022062956A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21871327.9A EP4203427A4 (en) 2020-09-22 2021-09-14 TRAFFIC PROCESSING METHOD, APPARATUS AND NETWORK APPARATUS
US18/188,016 US11924103B2 (en) 2020-09-22 2023-03-22 Traffic processing method, apparatus, and network device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011002452.5 2020-09-22
CN202011002452.5A CN114257544A (zh) 2020-09-22 2020-09-22 一种流量处理方法、装置和网络设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/188,016 Continuation US11924103B2 (en) 2020-09-22 2023-03-22 Traffic processing method, apparatus, and network device

Publications (2)

Publication Number Publication Date
WO2022062956A1 true WO2022062956A1 (zh) 2022-03-31
WO2022062956A8 WO2022062956A8 (zh) 2022-04-21

Family

ID=80789642

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/118136 WO2022062956A1 (zh) 2020-09-22 2021-09-14 一种流量处理方法、装置和网络设备

Country Status (4)

Country Link
US (1) US11924103B2 (zh)
EP (1) EP4203427A4 (zh)
CN (1) CN114257544A (zh)
WO (1) WO2022062956A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117424882A (zh) * 2022-07-08 2024-01-19 中兴通讯股份有限公司 数据传输方法、数据处理方法、电子设备、可读介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101043428A (zh) * 2006-05-30 2007-09-26 华为技术有限公司 一种路由转发的方法和系统
CN106341423A (zh) * 2016-10-26 2017-01-18 杭州华三通信技术有限公司 一种报文处理方法和装置
US20190028381A1 (en) * 2016-03-21 2019-01-24 Huawei Technologies Co., Ltd. Flow specification protocol-based communications method, device, and system
US20190140947A1 (en) * 2016-07-01 2019-05-09 Huawei Technologies Co., Ltd. Service Function Chaining SFC-Based Packet Forwarding Method, Apparatus, and System
CN110808913A (zh) * 2018-08-30 2020-02-18 华为技术有限公司 报文处理的方法、装置及相关设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107404439B (zh) * 2016-05-18 2020-02-21 华为技术有限公司 用于重定向数据流的方法和系统、网络设备和控制设备
CN107566298B (zh) * 2016-06-30 2021-11-19 华为技术有限公司 一种生成表项的方法和设备
US11245622B2 (en) * 2018-01-05 2022-02-08 Telefonaktiebolaget Lm Ericsson (Publ) Data center failure management in an SDN deployment using border gateway node control

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101043428A (zh) * 2006-05-30 2007-09-26 华为技术有限公司 一种路由转发的方法和系统
US20190028381A1 (en) * 2016-03-21 2019-01-24 Huawei Technologies Co., Ltd. Flow specification protocol-based communications method, device, and system
US20190140947A1 (en) * 2016-07-01 2019-05-09 Huawei Technologies Co., Ltd. Service Function Chaining SFC-Based Packet Forwarding Method, Apparatus, and System
CN106341423A (zh) * 2016-10-26 2017-01-18 杭州华三通信技术有限公司 一种报文处理方法和装置
CN110808913A (zh) * 2018-08-30 2020-02-18 华为技术有限公司 报文处理的方法、装置及相关设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
1 August 2009 (2009-08-01), P. MARQUES CISCO SYSTEMS N. SHETH JUNIPER NETWORKS R. RASZUK CISCO SYSTEMS B. GREENE JUNIPER NETWORKS J. MAUCH NTT AMERICA D. MCPH: "Dissemination of Flow Specification Rules; rfc5575.txt", XP015065653, Database accession no. RFC 5575 *
See also references of EP4203427A4

Also Published As

Publication number Publication date
US11924103B2 (en) 2024-03-05
EP4203427A4 (en) 2024-02-28
CN114257544A (zh) 2022-03-29
WO2022062956A8 (zh) 2022-04-21
EP4203427A1 (en) 2023-06-28
US20230239242A1 (en) 2023-07-27

Similar Documents

Publication Publication Date Title
US9369347B2 (en) Service to node resolution
US8902766B2 (en) Method and apparatus to improve LDP convergence using hierarchical label stacking
US7564803B1 (en) Point to multi-point label switched paths with label distribution protocol
EP3399703B1 (en) Method for implementing load balancing, apparatus, and network system
US20070008949A1 (en) Method for automatic route aggregation in a communication system
EP1913731B1 (en) Method and apparatus for enabling routing of label switched data packets
EP2860882B1 (en) Service processing method, device and system
CN110798403B (zh) 通信方法、通信设备和通信系统
US20070030852A1 (en) Method and apparatus for enabling routing of label switched data packets
JP2005130228A (ja) Ａｓ間の経路制御を行う通信装置およびその経路制御方法
WO2011044828A1 (zh) 一种路由撤销的方法、装置和系统
WO2017107814A1 (zh) 一种传播QoS策略的方法、装置及系统
US9515916B2 (en) Redirection of requests for target addresses
WO2022062956A1 (zh) 一种流量处理方法、装置和网络设备
CN106576076B (zh) 互联网交换点的路由控制方法
CN110881006B (zh) 发送报文的方法、网络设备及计算机存储介质
US8305959B2 (en) Hierarchical mobility label-based network
US20220150167A1 (en) Bier packet processing method, network device, and system
WO2022037330A1 (zh) 传输虚拟专用网的段标识vpn sid的方法、装置和网络设备
WO2023098703A1 (zh) 路径通告方法、拓扑算法组合生成方法、路径计算方法、数据传输方法、电子设备和计算机可读存储介质
US10924395B2 (en) Seamless multipoint label distribution protocol (mLDP) transport over a bit index explicit replication (BIER) core
WO2022257773A1 (zh) 路由检测方法、设备、系统及存储介质
JP2011035686A (ja) 経路情報管理システム、経路情報管理方法、およびプログラム
TW202232920A (zh) 網路運算環境之最佳路徑運算卸載系統及其方法與非暫態電腦可讀取儲存媒體
CN116781618A (zh) 路由生成方法、数据报文的转发方法及装置

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2021871327

Country of ref document: EP

Effective date: 20230324

NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21871327

Country of ref document: EP

Kind code of ref document: A1