Patent Application
20100157806
1. Field of the Invention
The present invention relates to a method for processing data packets and an equipment thereof, and more particularly to a method for processing data packet load balancing and a network equipment thereof.
2. Related Art
With the development and popularization of the network technology, networks have become an indispensable part of the daily life. People can quickly exchange desired information via the networks with each other. However, the Internet is not as safe as expected. For example, a computer system may be intruded by a hacker who will steal the data or destroy the computer system. Currently, most users protect their computers from being infected by a computer virus or being intruded and destroyed by other people through anti-virus software and firewalls. A technology called intrusion detection system (IDS) can be used for monitoring network activities so as to protect computers within a network from malicious attacks and destruction. The IDS is a passive network security system, which detects abnormal network activities by analyzing data packets and warns the network administrator in real-time to handle/defend against the abnormal network activities. In order to defend against malicious intrusion attacks from the network immediately, an intrusion protection system (IPS) is developed as a network security technology for providing active protection. All data packets need to pass through a network IPS, and cannot be transmitted to an internal local area network (or a network segment) to be protected unless it is determined that the data packets neither induce abnormal activities nor contain suspicious contents. Compared with the network IDS, the network IPS blocks the network attacks before any malicious intrusion occurs, thereby protecting the computer systems within the network from being destroyed.
However, as the network technology advances and the amount of data to be exchanged increases, the excessive network traffic has become a burden of the network IPS. The network IPS has to intercept and analyze every data packet, and only allows the data packets to be further transmitted after determining that the data packets do not contain malicious contents. If the response capability of the network IPS cannot keep up with the network transmission rate, the continuity of the internal network in data access will be affected, resulting in a significant degradation in the performance of the internal network.
Hence, it is proposed to process different data packets by a plurality of controllers and work queues.
Accordingly, the present invention is directed to a method for processing data packet load balancing, which balances the load of a plurality of controllers in a network equipment.
In order to achieve the above objective, a method for processing data packet load balancing is provided. The method includes the following steps. A network equipment receives data packets. Define one of a plurality of controllers in the network equipment as an allocation controller, and define other controllers as processing controllers. Assign a storage queue for storing the received data packets and a completion queue for storing a completion message to the allocation controller. The allocation controller assigns different work queues for storing the data packets according to a work attribute of the data packets. The processing controllers perform a packet processing procedure on the data packets in the assigned work queues respectively. After completing the packet processing procedure, the processing controllers send the completion message to the completion queue. If the allocation controller detects that the completion queue contains the completion message, the allocation controller transmits the processed data packets to a host.
The present invention is also directed to a network equipment with load balancing, which processes a plurality of data packets received by the network equipment and transmits the processed data packets to a host.
In order to achieve the above objective, a network equipment with load balancing is provided. The network equipment with load balancing includes a receiving end, an allocation controller, processing controllers, work queues, a storage queue, a packet processing procedure, and a loading lookup table. The receiving end receives data packets. The plurality of processing controllers is electrically connected to the receiving end. The processing controllers are respectively linked to at least one work queue. The allocation controller is electrically connected to the receiving end, stores the data packets into the storage queue, and performs the following steps: the allocation controller assigning the work queues for storing the data packets according to a work attribute of the data packets; commanding the processing controllers to perform the packet processing procedure, and assigning the work queues to the processing controllers for processing the data packets therein; after completing the packet processing procedure, the processing controllers sending a completion message to the completion queue; and if the allocation controller detects that the completion queue contains the completion message, the allocation controller transmitting the processed data packets to the host.
To sum up, the method for processing data packet load balancing and the equipment thereof of the present invention can invoke idle controllers in real-time. Therefore, the network packets in a system can be processed at a higher speed, and thus the network transmission rate can be increased and the packet transmission delay can be reduced.
The present invention will become more fully understood from the detailed description given herein below for illustration only, and thus are not limitative of the present invention, and wherein:
The receiving end 221 is connected to the source 230 via the Internet for receiving data packets from the source 230. The storage unit 222 is electrically connected to the receiving end 221 for storing the data packets. Besides storing the data packets, the storage unit 222 is also used for storing the packet processing procedure 224 and the loading lookup table 225. The network equipment 220 of the present invention at least includes more than two controllers 223. To clearly illustrate the operation and functions of the controllers 223, one of the controllers 223 is defined as an allocation controller and other controllers 223 are defined as processing controllers. A storage queue for storing the data packets and a completion queue for storing a completion message are assigned to the allocation controller. At least one work queue is configured for the processing controllers. The work queue is used for registering the data packets to be processed by the processing controllers.
Referring to
After completing the packet processing procedure, the processing controllers send the completion message to the completion queue (Step S360).
The following example is given to clearly describe the operating process of the present invention, but numbers and parameters in this example are not intended to limit the present invention.
Firstly, a receiving end 221 starts to receive data packets and stores the data packets into the receiving queue 421 in a queued manner. The allocation controller 411 detects that new data packets arrive at the receiving queue 421. The allocation controller 411 performs a packet processing procedure 224 on each of the data packets, and distributes the data packets to the first work queue 423, the second work queue 424, or the third work queue 425 according to a work attribute of the data packets. The distribution destination is selected according to Equation 1 below.
CURRENT_CPU=((MSG_INDEX++)%3)+1 Equation 1
In the equation, CURRENT_CPU is the serial number of the selected controller, and MSG_INDEX is the serial number of the data packets received by the allocation controller 411.
Moreover, the allocation controller 411 may also select the distribution destination according to numbers of the data packets stored in other queues. It is assumed that each queue is capable of storing 100 data packets, with a loading threshold value of 80%. For example, if the first work queue 423 has stored 90 data packets therein and the distribution destination selected by the allocation controller 411 according to Equation 1 is still the first controller 412, the allocation controller 411 will redistribute the data packets so as to skip over the first work queue 423, thereby reducing the load of the first controller 412.
After processing the data packets in corresponding queues, the controllers send a completion message to the completion queue 422. If the allocation controller 411 detects that the completion queue 422 contains the completion message, the allocation controller 411 transmits the processed data packets to the host 210. In such a manner, each controller can operate independently and poll the queue thereof.
To sum up, the method for processing data packet load balancing and the equipment thereof of the present invention can invoke idle controllers in real-time. Therefore, the network packets in a system can be processed at a higher speed, and thus the network transmission rate can be increased and the packet transmission delay can be reduced.
