Patent Application
20080080505
The present invention will be described with reference to illustrative embodiments. For this reason, numerous modifications can be made to these embodiments and the results will still come within the scope of the invention. No limitations with respect to the specific embodiments described herein are intended or should be inferred.
The term “network device” as used herein may comprise any type of electronic device capable of performing network operations on packets in a network. Such network devices may include, but are not limited to, routers, gateways, bridges, switches, hubs and repeaters. These devices and their many variants will be familiar to one skilled in the art. Examples of such network devices are also described in, for example, P. Seifert, The Switch Book: The Complete Guide to LAN Switching Technology, Wiley, 2000, which is incorporated herein by reference.
In addition, the term “packet of data” or “packet” as used herein is intended to encompass any unit of data for transmission in a network. No limitations as to the size, content or format of the data is intended by the use of this terminology.
For simplicity in describing the present invention, the invention will be illustrated with an embodiment comprising a router acting in conjunction with a simple LAN.
As is typical, a packet received by the router 100 will contain information populating various portions of the packet, namely, a header portion, a payload portion and a trailer portion. The header portion contains information populating various protocol header fields associated with the protocol stack for that particular packet. A packet in the internet, for example, will frequently comprise data populating protocol header fields corresponding to the HTTP, TCP, IP and Ethernet protocols. The payload portion, in turn, contains the actual data that the packet is delivering to its destination. The trailer portion of the packet contains a couple of bits that tell a receiving network device that it has reached the end of the packet. It should be noted that the packet need not be of this form. For example, it need not include a trailer portion.
In accomplishing its functions, the router 100 will determine which network operation to perform on a received packet of data and then actually perform that network operation. In this particular example, the router is tasked with providing a filtering function (e.g., firewalling function) based on the content of a received packet's payload. Accordingly, the router will first examine the payload of received packet to determine if the packet of data should be discarded or forwarded on to its next destination. If the packet is to be forwarded onward, the router will examine relevant portions of the packet's header portion (e.g., information in the packet's protocol header fields) and forward the packet onward in a conventional manner.
The examination of a received packet's payload by the router 100 will now be described with reference to
Now referring to
In accordance with an aspect of the invention, the table entry corresponding to any table input is determined based on a longest-prefix match algorithm. One skilled in the art will recognize that, after receiving a table input, a longest-prefix match algorithm will select the table entry with the greatest number of characters that match, in correct order starting at the beginning, the provided table input when determining which table entry corresponds to the provided table input. Longest-prefix match algorithms are used extensively in conventional routing tables which typically match next-hop addresses to destination addresses. Frequently, one destination address for a received packet may match more than one routing table entry. The most specific entry (i.e., the entry where the largest number of leading address bits in the table entry matches those of the provided destination address) is selected as the longest-prefix match.
It will be noted that the lookup table 220 comprises a table entry with an input comprising the value “else.” This “else-entry” is a default table entry and is selected by the lookup table when there is no longest-prefix match between a table input and any one of the other table entries. The else-entry may be implemented by, for example, leaving the input portion of a table entry blank. The purpose of the else-entry will become apparent to one skilled in the art when a more concrete example of table lookups is described below.
As stated above, a table entry in the lookup table 220 returns a new state value and possibly an action. In step 440, the packet processing circuitry sets the state value to the new state value returned from the lookup table and sets the payload input to that the next character in the packet payload. Next, in step 450, the packet processing circuitry executes any returned action. Depending on the type of action, the action may end the examination of the packet payload or allow the examination to continue. Step 460 asks if the end of the packet payload has been reached. If the answer is no, the packet processing circuitry returns to step 430 and again addresses the lookup table with a table input equal to a combination of the current state value and payload input. Alternatively, if the end of the packet payload has been reached, the packet processing circuitry executes a predetermined default action. The default action may, for example, direct the router 100 simply forward the packet onward in a conventional manner. Alternatively, the current state can be stored and used as the starting state for examining the contents of the next packet that is part of the same session or flow.
Reference to
It should be noted that it may be advantageous in some circumstances to have the packet processing circuitry 210 examine a received packet's header portion before beginning the examination of the packet's payload. The header portion of the received packet may indicate what type of information is contained within the packet's payload (e.g., whether the packet is a web request or part of an electronic mail message). This type information may be useful in determining whether or not to examine the packet's payload at all and in determining what particular type of examination should be conducted.
A more concrete example may be helpful in further describing the illustrative process flow described in
Let it even further be assumed that the router 100 receives a packet containing the text shown in
Next, in step 440, the state value is set to the returned state value (i.e., “0”) and the payload input is set to the next character in the received packet (“e”). In step 460, the packet processing circuitry determines that the end of the packet payload has not been reached and returns to step 430, where it addresses the lookup table again, this time with the table input “0e.”
Continuing to follow the process set forth in
The state value is maintained at state value “0” until the payload input is set to “c” in the word “credit.” At this point, the lookup table 220 again returns a new state value of“1.” When, the lookup table is next addressed with “1r,” it returns a state value of “2.” This stepping up of the state value as the packet processing circuitry 210 steps through the letters in “credit” continues until the packet processing circuitry finally addresses the lookup table with the string “5t.” At this point in the process, the lookup table returns an action in addition to a new state value. As shown in the lookup table in
It should be noted that if the received packet had not contained the word “credit,” the above described sequence would have progressed until the packet processing circuitry 210 reached the end of the packet's payload. At this point, the router 100 would have executed a default action in accordance with step 480, for example, forwarding the packet in a conventional manner.
While the previous example was limited to the detection of a single word in a packet payload, one skilled in the art will recognize that the above-described method can be configured to detect any combination of letters, symbols, and numbers encoded within a packet's payload. Furthermore, the action specified can include adding, removing, and examining data on a stack such as would be used to parse a context-free grammar. Examples of using a table and a stack to parse a context-free grammar are also described in, for example, A. Aho. et. al., Compilers. Principles, Techniques, and Tools, Addison-Wesley, 1986, which is incorporated herein by reference.
Moreover, in addition to discarding a packet, there are many other network operations that a network device may be called upon to perform on a packet in response to the content of that packet's payload. A lookup table may direct a network device, for example, to redirect the received packet to new destination address or even to alter the content of the packet.
The lookup table 220 may take on various physical forms and still come within the scope of the invention. For example, the lookup table may be implemented in a volatile dynamic random access memory (DRAM) device or non-volatile flash-type memory. Nevertheless it may be advantageous to implement the lookup table in other types of hardware since many network devices such as routers may not have access to these types of general purpose memories. Moreover, these types of memories may not be optimized for search-intensive tasks.
It may be advantageous, for example, to implement the lookup table 220 in a Ternary CAM (TCAM). TCAMs are frequently implemented for search-intensive tasks like lookup functions because they are much faster than algorithmic approaches to search-intensive applications. TCAMs are typically composed of conventional semiconductor memory, usually synchronous random-access memory (SRAM), with added comparison circuitry that enables a search operation to be completed in a single clock cycle. TCAMs, moreover, are easily configured for lookups that use a longest-prefix match algorithm.
Alternatively, the lookup table may be implemented in an algorithmic search engine formed into an application-specific integrated circuit (ASIC) or application-specific standard product (ASSP). These types of specialized integrated circuits will be familiar to one skilled in the art. Like TCAMs, these types of integrated circuits can be configured for lookups that use a longest-prefix match algorithm.
It should again be emphasized that the above-described embodiments of the invention are intended to be illustrative only. Other embodiments can use different types and arrangements of elements and steps for implementing the described functionality. These numerous alternative embodiments will fall within the scope of this invention and will be apparent to one skilled in the art.
