JP2000261487A - Device and system for packet filtering - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize high speed packet filtering independently of number of access lists. SOLUTION: Filter information to limit or permit passing of a specific packet is set to access lists 1-1-1-n. Packet information of a specific input packet is registered in a filter cache table 5. A generating means 4 generates a table key to be registered in the filter cache table 5 among filter information set to the access lists. A filter cache table registration means 3 registers the packet information coincident in the filter information listed in the access lists to the filter cache table 5 based on of a table key. A retrieval means 2 retrieves the filter cache table 5 on the basis of the table key of the packet information of the received packet and discriminates transfer or abort of the received packet according to contents of the filter cache table when the result of retrieval is hit or uses the contents of the access lists when the result of retrieval is not hit.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a filtering device such as a router and a switch in a packet communication system and a filtering method.

[0002]

2. Description of the Related Art In a packet communication system, MAC
In order to perform packet communication between networks having different (Media Access Control), IP (Internet Protocol) and protocols (protocol: communication protocol), these packet information is used as route information or filter information. It is known that filtering for determining a line of a transfer packet is performed.

[0003] The MAC is a transmission control technique essential for a LAN, and is an access control for a plurality of nodes to smoothly and jointly use a local cable. A protocol means a procedure or a contract between nodes, and is based on TCP (Transmission).
Control Protocol) and IP that performs specific communication. The MAC includes a source MAC and a destination MAC, and the IP also includes a source IP and a destination IP.

Conventionally, such filtering is performed by configuring a filtering rule including filter information as an access list and applying the access list to a received packet. When a plurality of access lists are set, one access list is applied to each received packet.

[0005] For example, as shown in FIG. 8, when n access lists are set, first, an access list 1-1 which uses destination MAC and transmission source IP as filter information is set for an input packet. Apply. As a result, if the destination MAC and the source IP in the access list 1-1 match the destination MAC and the source IP in the input packet, then the input packet is discarded / transferred by the header information in the input packet. To determine. MAC and I
If P does not match, the access list 1-2 using the destination MAC and protocol as filter information is applied. If the destination MAC and protocol in the access list match the destination MAC and protocol in the input packet, the next step is performed. To
The discard / transfer of the input packet is determined based on the header information in the input packet. Hereinafter, similarly, such filtering is repeatedly performed up to the access list 1-n.

[0006]

However, in the above-mentioned conventional packet filtering, when a plurality of access lists are set, the access lists are applied one by one for each received packet. When the access list is set, the access list is applied at most n times each time one packet is received, and there is a problem that the packet transfer performance is reduced.

[0007] Therefore, an object of the present invention is to provide a packet filtering apparatus and a packet filter that, after application of an access list, register the information in a filter cache table, thereby speeding up the application of a filter to successive packets subsequent to the second packet. It is to provide a ring method.

[0008]

According to a first aspect of the present invention, a packet filtering apparatus registers packet information of a first input packet in a filter cache table based on a filter cache table key generated from an access list. For the packet information of the second and subsequent input packets, the filter cache table is searched based on the filter cache table key, and if there is a hit, the input packet is transferred or discarded according to the contents of the filter cache table. In the case of a mishit, the access list is sequentially applied, and if they match, the registration of the packet information is performed, and the input packet is transferred or discarded according to the contents.

The packet filtering apparatus according to the second aspect of the present invention is configured such that at least one condition (filter information) for restricting or permitting the passage of a specific packet is set.
One access list, at least one filter cache table in which packet information of a specific input packet is registered, and a parameter (filter cache table key) to be registered in the filter cache table from the filter information set in the access list Filter cache table key generating means for generating the packet information of the input packet, filter packet table information registering means for registering packet information matching the filter information of the access list in the filter cache table based on the filter cache table key, In response to this, the filter cache table is searched based on the filter cache table key, and if there is a hit, the input packet is searched according to the contents of the filter cache table. Determining bets transfer or disposal, also characterized by having a filter cache table retrieving means for applying the access list to be hit.

Further, in a preferred embodiment of the packet filtering apparatus according to the present invention, the generation of the filter cache table key is obtained by performing a logical OR operation on the filter information parameters of the access list.

The packet filtering method according to the present invention further comprises a step of setting a condition (filter information) for restricting or permitting the passage of a specific packet in an access list, and a step of setting a filter cache table from among the set filter information. Generating a parameter (filter cache table key) to be registered in the filter cache table, and registering packet information matching the filter information in the filter cache table based on the filter cache table key when a packet is input; For the packet information of the packet, the filter cache table is searched based on the filter cache table key, and if there is a hit, the transfer or discard of the input packet is determined according to the contents of the filter cache table. If hit and having a procedure for applying the access list.

[0012]

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of a packet filtering apparatus according to the present invention, wherein n access lists 1-1 to 1-1 for registering conditions for restricting or permitting a specific packet to pass therethrough. -N is set, a filter cache table registration unit 3 that registers packet information to which the access list is applied in the filter cache table 5, and a parameter (filter cache table key) to be registered in the filter cache table 5 are determined. It has a filter cache table key generation unit 4, a filter cache table search unit 2 that determines transfer or discard of an input packet according to the filter cache table 5, and a filter cache table 5.

Each of the access lists 1-1 to 1-n includes filter information, and an input packet is to be filtered by the filter information. However, in the present invention, for the first packet,
As described above, the access lists 1-1 to 1-n are applied. However, before the second packet, the filter cache search unit 2 performs filtering on the packet information in the input packet using the filter cache table key. The cache table 5 is searched.

If a hit occurs, the input packet is transferred or discarded based on the instruction of the contents of the hit entry. If there is no hit, access list 1
-1 to 1-n are applied in order, and a normal filtering operation is performed. As a result, it is possible to speed up the filtering process of the second and subsequent packets.

The filter cache table key generating means 4 generates a filter cache table key from the filter information of the access lists 1-1 to 1-n. The filter cache table registration unit 3 applies the access lists 1-1 to 1-n for the first input packet,
The packet information is registered in the filter cache table 5 using the filter cache table key as a key,
In preparation for the search of the filter cache table 5 for the second and subsequent input packets.

Next, an embodiment of the present packet filtering apparatus will be described. It is assumed that n = 3, that is, three access lists 1-1, 1-2, and 1-3 have been set. The access list 1-1 uses the destination MAC and source IP as filter information, the access list 1-2 uses the destination MAC and protocol as filter information, and the access list 1-3 uses the destination IP and protocol as filter information. It is assumed that

FIG. 2 is a table showing the generation logic of the filter cache table key by the filter cache table key generation means 4 when n = 3. Referring to FIG. 2, it can be seen that the filter cache table key is generated by ORing the respective pieces of filter information of the three access lists 1-1, 1-2, and 1-3.
That is, the filter information parameter included in any of the access lists 1-1, 1-2, and 1-3 constitutes a filter cache table key. In this example, the destination M
The AC, source IP, destination IP, and protocol are the filter cache table keys.

Next, the operation of the present packet filtering apparatus will be described with reference to FIGS.

First, the filter cache table key generating means 4 performs an OR operation on the filter information parameters referred to in the access lists 1-1 to 1-n and uses the OR as a filter cache table key.

When the first packet is input, the filter cache table 5 is empty. Since the packet information about the filter cache table key of the input packet does not match each filter information of the access lists 1-1 to 1-3, the filter cache table registration unit 3 sets the filter cache as shown in FIG. The packet information of the packet is registered in the filter cache table 5 based on the table key. And
Incoming packets are forwarded or discarded.

Specifically, in the access list 1-1, the source IP of the filter information parameter and the source IP of the input packet are the same X, but the destination MACs do not match p and y. In the access list 1-2, the destination MAC matches with y, but the protocol does not match with γ and α. In the access list 1-3, the destination IP is Y
, But the protocol does not match between γ and α. As a result, based on the filter cache table key, the destination MAC “y” and the source IP in the packet information are stored in the filter cache table 5 as shown in FIG.
“X”, destination IP “Y”, and protocol “α” are registered.

When the filter cache table 5 is empty and matches one of the access lists, for example, as shown in FIG. 4, the access list 1-2 matches the packet information based on the filter cache table key. In this case, the information of the packet is registered in the filter cache table 5 based on the filter cache table key.

More specifically, the packet information of the input packet does not match the access list 1-1, but matches the access list 1-2. Therefore, as shown in FIG. , Destination MAC “y” in packet information, source IP “A”, destination IP
“Z” and protocol “γ” are registered.

Next, for the second and subsequent input packets, the filter cache table 5 is applied before the access lists 1-1 to 1-3. That is, the filter cache table search means 2 searches the filter cache table 5 for the packet information based on the filter cache key. FIG. 5 shows a case where a packet having packet information that matches the registered content of the filter cache table 5 shown in FIG. 4 is input. As described above, when a packet matching the registered contents of the filter cache table 5 is received, the packet is transferred or discarded based on the instruction of the filter cache table 5.

On the other hand, the filter cache table search means 2 searches the filter cache table 5 for packet information on the basis of the filter cache key.
1-3 are sequentially applied. Then, when any one of the access lists, for example, as shown in FIG. 6, matches the access list 1-1, the packet information is registered in the filter cache table 5 based on the filter cache key.

At this time, as shown in FIG. 4 or FIG. 5, if the filter cache table 5 already exists, the filter cache table 5-1 is newly added.
Is generated, and the leading address of the previous filter cache table 5-2 is set in the Next pointer. Thereafter, when a packet matching the filter cache table 5-1 or 5-2 is received, the packet is transferred or discarded based on the instruction in the table.

As described above, when there are a plurality of filter cache tables, it is efficient to retrieve the next referenced packet from the filter cache table that has been recently referred to, and to transfer and discard the packets in accordance with the search. FIG. 7 shows this state. As shown in FIG. 6, when the filter cache table 5-1 and the filter cache table 5-2 pointed to the table exist, the input packet is searched from the filter cache table 5-1. When hitting 5-2, the filter cache table 5-2 is searched next time. By doing this,
It is possible to improve the filtering ability of successive identical flow packets.

[0029]

According to the present invention, as described above, packet information that matches the access list is registered in the filter cache table, and for the next and subsequent input packets,
First, the filter cache table is searched, and if a hit is found, the input packet is transferred or discarded according to the contents of the table. Therefore, regardless of the number of registered access lists, there is an effect that the filtering speed of the continuous flow can be increased. . In particular, this effect is significant in a network such as an intranet where random traffic is small and burst traffic is large.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of a packet filtering device according to the present invention.

FIG. 2 is a diagram showing a filter cache table key generation logic according to the present invention.

FIG. 3 when the filter cache table is empty,
The figure which shows a mode when not matching all the access lists.

FIG. 4 shows a case where the filter cache table is empty.
The figure which shows a mode when it matches with the access list 1-2.

FIG. 5 is a diagram showing a state when a hit occurs in a filter cache table.

FIG. 6 is a diagram showing a state in which one filter cache table is registered and matches with another access list.

FIG. 7 is a diagram showing a state in which two filter cache tables are registered and one of them is hit.

FIG. 8 is a diagram showing a conventional filtering method.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Filtering table 2 Filter cache table search means 3 Filter cache table registration means 4 Filter cache table key generation means 5 Filter cache table 1-1 Access list 1-2 Access list 1-3 Access list 1-n Access list 5-1 Filter Cache table 5-2 Filter cache table

Claims (5)

[Claims] 1. A packet information of a first input packet is registered in a filter cache table on the basis of a filter cache table key generated from an access list. The filter cache table is searched based on the cache table key. If a hit is found, the input packet is forwarded or discarded according to the contents of the filter cache table. For example, the packet filtering device performs the registration of the packet information and transfers or discards the input packet according to the contents. 2. An at least one access list in which a condition (filter information) for restricting or permitting passage of a specific packet is set, and at least one filter cache table in which packet information of a specific input packet is registered. Filter cache table key generation means for generating a parameter (filter cache table key) to be registered in the filter cache table from among the filter information set in the access list, and packet information matching the filter information of the access list. Filter cache table registration means for registering in the filter cache table based on the filter cache table key; and Filter cache table search means for determining whether to forward or discard the input packet according to the contents of the filter cache table if a hit is found, and a filter cache table search means for applying the access list if no hit is found. Characteristic packet filtering device. 3. The packet filtering apparatus according to claim 1, wherein the filter cache table key is generated by performing a logical sum operation on a filter information parameter of the access list. 4. The packet filtering apparatus according to claim 1, wherein when a plurality of the filter cache tables exist, the search is performed from a hit filter cache table in the next and subsequent times. . 5. A procedure for setting a condition (filter information) for restricting or permitting passage of a specific packet in an access list, and a parameter (filter cache table) to be registered in a filter cache table from the set filter information Key), when a packet is input, a step of registering packet information that matches the filter information in the filter cache table based on the filter cache table key, and The filter cache table is searched based on the filter cache table key. If a hit is found, the transfer or discard of the input packet is determined according to the contents of the filter cache table. If no hit, the access list is applied. And a packet filtering method.