Patent Application
20080019368
The foregoing aspects and many of the accompanying advantages of this invention will become more readily appreciated as the same becomes better understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein:
The present invention provides an apparatus and system for layer-2 to layer-7 search engine for high-speed network application.
Furthermore, a DMA (Direct Memory Access) engine 20 receives the data packets from the packet modifier 16 and transfers the data packets to a plurality of queues (queue 0, queue 1, queue 2 . . . queue N), which store the data packets for later access. A transmit buffer 22 stores some data packets transferred from DMA (Direct Memory Access) engine 20, then a transmit GMAC 21 transfers the data packets to the computer network.
When the packets are received from the receive GMAC 11, they will be temporally stored into the receive buffer 12. The packet parser 13 parses the received packets from the receive buffer 12 and then extracts the fields for some protocol search engines, such as protocol search engines 141, 142 and 143. The fields include layer-2 header fields such as MAC DA/SA (Destination/Source) address, VLAN-ID (Virtual Local Area Network-ID), Ethernet Type fields, PPPoE (Point-to-Point Protocol over Ethernet) session ID, layer-3 headers fields such as IPv4 or IPv6 source/destination IP address, TOS field (Type of Service), flow label etc., layer-4 bytes such as TCP/UDP source/destination port number, IPSec (IP Security) field, etc. and layer-7 bytes, such as application specified fields, etc.
With the results from the protocol search engines 141, 142 and 143, a search resolution engine 15 chooses the matching one with highest priority, which is programmable according to the applications.
The packet modifier 16 will then modify the packet header based on the action parameters of the search results. The actions include modifying MAC DA/SA address, inserting/replacing/removing the VLAN or PPPoE headers, modifying the source/destination IP address, decrementing TTL (Time to Live) field and modifying the TCP/UDP source/destination port numbers.
After packet header modification, the packet will be forwarded to the destination port/queue of the search results. It could be forwarded to the software-based queue for termination at the host CPU or to the hardware transmit queue for applications such as switching/routing/NAT (Network Address Translation). Also, the packet could be discarded based on the action of the search result.
With the hardware forwarding capability, after proper setup of the protocol matching rule table, packets could be searched, modified and forwarded from receive to transmit by hardware, without using CPU resource.
Table 1 shows the protocol matching rule format, in which, layer-2/3/4/7 can be individually enabled or disabled. Port identifier (PortID) can be the matching parameter. Since there might be multiple rules being matched for a received packet, the rule priority is used to select which rule will be taken when multiple rules are matched. For layer-2 and layer-3 headers, predefined fields (such as layer-2's MAC addresses or layer-3's IP addresses) are used for rule matching. For layer-4 and layer-7 headers, each byte can be individually selected starting from the first byte of the headers.
Table 2 shows the L2/L3/L4/L7 connection hash table format. Rule number specifies which rule the current hash entry belongs to. The hash key is variable length and used to match the incoming packets belonging to certain protocol search engine. Destination port/queue ID is used for the DMA (Direct Memory Access) engine 20 to send the packet to the destination, which can be the output queue of the outgoing port or the receive queues for software consumption. Actions and parameters are used to modify packet header contents by hardware, such as modifying layer-2 MAC address, layer-3 IP address, layer-4 TCP/UDP port numbers or decrementing IP header's TTL field.
Accordingly, the present invention provides a method for layer-2 to layer-7 search engine for high-speed network application. Referring to
With this hardware search engine data structure specified in Table 1 and 2, many different kinds of high speed networking functions may be implemented. For layer-2 switch, MAC DA address and IEEE802.1Q VLAN ID can be the hash key to find out the outgoing port ID/queue and packets will be forwarded to the destination by hardware. For layer-3 router, destination IP address with subnet mask will be used as hash key to search the destination and the IP header's TTL field will be decremented with header checksum recalculated. For firewall router, the source/destination IP address and/or source/destination TCP/UDP port numbers can be the hash key to filter out certain malicious hosts and applications. For NAT gateway, IP protocol number, source/destination IP address and source/destination TCP/UDP port number could be the hash key and the action could be replacing the MAC DA/SA address and replacing the source or destination IP and TCP/UDP port number. Packets will be forwarded to the hardware transmit port/queue in this case.
While the invention is susceptible to various modifications and alternative forms, a specific example thereof has been shown in the drawings and is herein described in detail. It should be understood, however, that the invention is not to be limited to the particular form disclosed, but to the contrary, the invention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the appended claims.
This application claims priority to U.S. provisional patent application Ser. No. 60/807,992, filed on Jul. 21, 2006, which is hereby incorporated by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 60807992 | Jul 2006 | US |
