JP2001168911A - Packet filter device - Google Patents

Abstract

(57) [Problem] To provide a packet filter device capable of handling long or complex filter conditions with a simple configuration and capable of high-speed processing. SOLUTION: In a packet filter having a function of allowing an input packet to selectively pass according to filter conditions such as an address and a protocol, a memory 104 for dividing and storing filter conditions into a plurality of parts is provided, and the memory 104 is provided. Is read out at the same speed as the packet input speed, and the divided portion of the read out filter condition is compared with the divided portion of the packet to be compared, and all the divided portions match the filter condition. The circuit that passes the packet is configured by hardware.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a packet filter device for selecting a packet meeting a specific condition,
In particular, the present invention relates to a packet filter device having a simple configuration, capable of handling long or complex filter conditions, and capable of high-speed processing.

[0002]

2. Description of the Related Art LAN analyzers and RMON probes are devices that collect packets flowing on a network and create statistics on the types and frequencies of the packets. The LAN analyzers and RMON probes are used for monitoring traffic and investigating the causes of network problems. used. One of the functions of such a device is a packet capture function. The packet capture function is a function of saving a packet flowing on a network as it is. By reading the stored packet later, the contents of the packet can be analyzed in detail.

[0003] However, since a large amount of various types of packets are flowing on the network, it is difficult to store all of these packets due to limitations in the storage capacity and processing speed of the device. Therefore, a packet filter function is used to store only necessary packets.

[0004] The packet filter function is a function of selecting a packet according to conditions such as a specific address and a specific protocol. There are various types of packet filter devices that realize the packet filter function, depending on the intended use. Broadly speaking, there are two types: a soft filter in which the CPU performs filter processing using software, and a hardware filter without using the CPU. There is a hard filter for performing discard judgment.

First, a packet filter device using a soft filter will be described with reference to FIG. As shown in FIG. 4, the packet filter device includes a CPU 401, a program memory 402, a communication control LSI for performing packet reception control, DMA transfer to a buffer memory 404, and the like.
403, buffer memory 40 for storing packets
4. (1) (2) shown in the figure
(3) corresponds to the following procedure.

A packet capture operation in the packet filter device of FIG. 4 will be described.

(1) When the communication control LSI 403 receives a packet, the CPU 401 reads the packet from the communication control LSI 403.

(2) Filter conditions are compared with the packet in accordance with the program to determine whether to discard the packet.

(3) If the packet matches the filter condition, the packet is stored in the buffer memory 404.

[0010] There are various methods of reading and storing packets other than this example.
The filter condition is in the program, and packet discarding is determined by executing the program.

Next, a packet filter device using a hard filter will be described with reference to FIGS.

As shown in FIG. 5, the packet filter device comprises a CPU 501, a communication control LSI 502, a buffer memory 503, and a packet filter LSI 504. A packet filter LSI 504, which is hardware having a packet filter function, includes a comparison target detection unit 5 for detecting a portion to be compared with a packet.
05, a packet register 506 for storing a portion to be compared with a packet, a filter register 507 for storing a filter condition, and a mask condition for masking a portion of the filter condition not required for comparison. A mask register 508, a comparison circuit 50 that compares the three registers and outputs a packet discard determination result
9, a buffer memory control circuit 510.

As shown in FIG. 6, a comparison object detection unit 505 includes a byte counter 601 for counting the number of bytes of an input packet, an offset register 602 for indicating the number of bytes from the beginning of the packet to start comparison,
A comparison start signal generation circuit 603 is provided for comparing the offset register 602 and the byte counter 601 and sending a comparison start signal to the comparison circuit 509 when they match.

FIG. 7 shows an example of the internal circuit of the comparison circuit 509.
To the Nth bit and the filter register 507
The exclusive OR of each bit is obtained by using the first to Nth bits of the above, and the logical product of each bit is obtained by using each exclusive OR output and the first to Nth bits of the mask register 508. , N bits of the logical product output are taken as the packet discarding determination result. Therefore, if there is at least one bit in which the packet register 506 and the filter register 507 do not match with respect to the bit whose mask register 508 is 1 in the total length (= N bits) of the filter condition, the packet discarding determination result is 1 (Mismatch).

The packet capture operation in the packet filter device of FIG. 5 will be described.

The filter register 507, mask register 508, and offset register 602 have a CPU
Initial values are set in accordance with 501, and thereafter, (1) to
Perform step (3).

(1) When the communication control LSI 502 receives a packet, the packet filter LSI 504 reads the packet from the communication control LSI 502 and stores the packet in the buffer memory 503. At the same time, the comparison start signal generation circuit 603 compares the offset register 602 with the byte counter 601 and sends a comparison start signal to the comparison circuit 509 if they match.

(2) Upon receiving the comparison start signal, the comparison circuit 509 compares the packet register 506, the filter register 507, and the mask register 508, and notifies the buffer memory control circuit 510 of the packet discard decision result.

(3) When discarding (not passing) a packet, the buffer memory 503 overwrites the packet to be discarded with the next received packet.

[0020]

The above soft filter and hard filter have the following advantages, respectively.
There are disadvantages.

First, the soft filter can easily realize a filter process using a filter condition having a long bit length, and can easily perform a filter process using a complex filter condition such as a combination of a plurality of different filter conditions. Can be realized. That is, a long or complicated filter condition can be handled. However, the CPU 401
Performs various processes other than the filtering process, so that the processing speed of the filter alone cannot be increased. Also, C
Since the internal structure of the PU 401 is not made exclusively for the filter, the processing speed of the soft filter becomes very slow. For this reason, when the traffic of the network increases, the filtering process cannot be performed in time, and a large number of packets that have not been determined to be stored are discarded.

On the other hand, the processing speed of the hard filter is high because it performs hardware processing. However, it is difficult to form a circuit for processing a long filter condition or a complicated filter condition, and even if such a circuit can be realized, the circuit scale becomes very large.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a packet filter device which solves the above-mentioned problems, has a simple configuration, can handle long or complex filter conditions, and can perform high-speed processing.

[0024]

SUMMARY OF THE INVENTION In order to achieve the above object, the present invention provides a packet filter having a function of selectively passing an input packet according to filter conditions such as an address and a protocol. A memory for dividing and storing the filter conditions is provided, and the filter conditions stored in the memory are read out at the same speed as the packet input speed, and the read filter condition divided portions and the packet divided portions to be compared are compared. And a circuit for passing a packet whose divided portions match the filter condition is configured by hardware.

A buffer memory for storing the passed packets may be provided.

A plurality of sets of the memory and the hardware circuit may be provided, and when a packet matches a filter condition of any one of the memories, the packet may be passed.

[0027]

An embodiment of the present invention will be described below in detail with reference to the accompanying drawings.

As shown in FIG. 1, a packet filter device according to the present invention is a data collection device for collecting packets flowing on a network, and includes a CPU 100, a communication control LSI 101, a buffer memory 102, a packet filter LSI 103, and a filter memory. 104. The present invention integrates a filter memory 104 that divides a filter condition and a mask condition written from the CPU 100 into a plurality of portions and stores the filter condition and a mask condition, and a logic circuit for comparing the filter condition and the mask condition in the filter memory 104 with a packet. It is characterized by including a packet filter LSI 103.

The packet filter LSI 103 includes a packet register 105 for storing a divided portion of a packet to be compared, a filter memory control circuit 110 for controlling a filter memory 104, and a filter for storing a divided portion of a filter condition. Register 106, mask register 10 for storing divided parts of mask condition
7. A comparison circuit 108 for comparing the above three registers and outputting a packet discard judgment result, and a buffer memory control circuit 109 for operating overwriting in the buffer memory 102 based on the judgment result. This packet filter L
The SI 103 reads out the filter condition and the mask condition stored in the filter memory 104 at the same speed as the packet input speed, and divides the read out filter condition and the mask condition and the packet to be compared with the packet to be compared a plurality of times. Then, a packet in which all bits except the masked bits match the filter condition is passed.

FIG. 2 shows an example of the comparison circuit 108. This circuit includes a register comparison unit 201 and a result combination unit 2.
02. The register comparison unit 201 calculates an exclusive OR for each bit by using the first to Nth bits of the packet register 105 and the first to Nth bits of the filter register 106, and further outputs each exclusive OR. The logical AND of each bit is calculated by using the first and Nth bits of the mask register 107, and the logical sum of the logical product output of these N bits is obtained as the comparison result. The result combining unit 202 resets the flip-flop 203 before starting the comparison, and then the register comparing unit 201
Each time the comparison for bits is performed, the register comparison unit 20
The logical sum of the comparison result from 1 and the flip-flop output up to the previous time is stored in the flip-flop 203, and the flip-flop output is finally the comparison result. Therefore, if the bit in which the bit of the mask register 107 is 1 and the packet register 105 and the filter register 106 do not match each other is at least one bit in the total length of the filter condition (= the number of comparisons × N bits), then The discard judgment result is 1 (mismatch). If the packet and the filter condition for the bit whose mask condition bit is 1 match over the entire length, the result of discarding the packet is 0 (match).

The packet capture operation in the packet filter device of FIG. 1 will be described.

The filter memory 104 has a CPU 10
Initial values of the filter condition and the mask condition are set from 0. Thereafter, the procedures of (1) to (4) are performed. (1) to (4) shown in the figure correspond to this procedure.

(1) When the communication control LSI 101 receives a packet, the packet filter LSI 103 reads the packet from the communication control LSI 101 and stores the packet in the buffer memory 102. At the same time, the packet is stored in the packet register 105.

(2) Further, the filter memory control circuit 1
Reference numeral 10 reads the filter condition and the mask condition from the filter memory 104 at the same speed as the packet reading speed, and stores the filter condition and the mask condition in the filter register 106 and the mask register 107.

(3) Each of the packet register 105, the filter register 106, and the mask register 107 has 1
When the packet (N bits), the filter condition, and the mask condition are stored, the comparison circuit 108 compares the packet register 105, the filter register 106, and the mask register 107, and combines the comparison result with the previous comparison result. . Thereafter, (1), (2), and (3) are repeated until the entire length of the filter condition is completed. Then, when the total length of the filter condition is completed, the comparison result output from the flip-flop 203 is notified to the buffer memory control circuit 109.

(4) Under the control of the buffer memory control circuit 109, if the packet does not meet the filter condition, the buffer memory 102 overwrites the packet received in (1) with the next received packet. If the packet satisfies the filter condition, it means that the packet has passed the filter. Therefore, the next received packet is written in an area different from the packet saved in (1), or the packet saved in (1) is The packet stored in (1) can be read later by transferring it to another memory for collecting packets.

As can be seen from the above packet capture operation, in the packet filter device of the present invention, the comparison between the filter condition and the mask condition and the packet is performed by the logic circuit, so that the comparison result can be obtained instantaneously. Since the reading of the filter condition and the mask condition is performed at the same speed as the reading of the packet, the corresponding divided portion is stored in each register for comparison, and the comparison can be performed simultaneously with the reading. Therefore, the comparison for the entire length of the filter condition is performed at high speed. Further, in the conventional hard filter, it was necessary to increase the circuit scale of the packet register and the filter register in order to set a long filter condition. However, in the packet filter device of the present invention, the comparison is performed in a plurality of times. Therefore, even if the circuit scale of the packet register and the filter register is small, long filter conditions can be set, and the offset register and the byte counter are not required, so that the circuit scale can be reduced.

Next, another embodiment of the present invention will be described.
The packet filter device illustrated in FIG. 3 includes N packet filter LSIs 301-1 to 301-N and N filter memories 302-1 to 302-N. N
Packet filter LSIs 301-1 to 301 -N are connected and arranged, and the packet output of each stage packet filter LSI is connected to the packet input of the next stage packet filter LSI, and the final stage packet filter LSI 301.
The buffer memory 303 is connected to the −N packet output. The packet filter LSI 301 of each stage
-1 to 301-N include the filter memories 302-1 to 30-30.
2-N is connected. Last stage packet filter L
The SI 301-N receives the comparison result from another packet filter LSI, and if any of the comparison results indicates a match with the filter condition, determines that the packet is to be captured (passed). This allows
It is possible to realize a sophisticated packet filter function of setting a plurality of different filter conditions and passing packets that match any of the filter conditions.

As described above, by providing a plurality of sets of the filter memory and the packet filter LSI and connecting a plurality of stages, the packet filter device can easily set advanced filter conditions.

[0040]

The present invention exhibits the following excellent effects.

(1) Since the comparison between the packet and the filter condition is performed by a hardware circuit, high-speed processing becomes possible.

(2) Since the filter conditions divided into a plurality of parts and stored are compared a plurality of times, the circuit scale can be reduced.

(3) Since the filter conditions divided into a plurality of parts and stored are compared a plurality of times, a long filter condition can be set.

(4) By connecting hardware circuits having a packet filter function in a plurality of stages, advanced filter conditions can be set.

[Brief description of the drawings]

FIG. 1 is a circuit diagram of a packet filter device according to an embodiment of the present invention.

FIG. 2 is a circuit diagram of a comparison circuit according to the present invention.

FIG. 3 is a partial circuit diagram of a packet filter device according to another embodiment of the present invention.

FIG. 4 is a circuit diagram of a conventional packet filter device using a soft filter.

FIG. 5 is a circuit diagram of a conventional packet filter device using a hard filter.

6 is a circuit diagram of a comparison target detection unit of the packet filter device of FIG.

FIG. 7 is a circuit diagram of a comparison circuit of the packet filter device of FIG. 5;

[Explanation of symbols]

 REFERENCE SIGNS LIST 100 CPU 101 communication control LSI 102 buffer memory 103 packet filter LSI 104 filter memory 105 packet register 106 filter register 107 mask register 108 comparison circuit 109 buffer memory control circuit 110 filter memory control circuit

Claims (3)

[Claims] 1. A packet filter device having a function of selectively passing an input packet according to a filter condition such as an address and a protocol, and a memory for dividing and storing the filter condition into a plurality of portions.
The filter condition stored in the memory is read out at the same speed as the packet input speed, and the divided portion of the read out filter condition is compared with the divided portion of the packet to be compared, and all the divided portions are included in the filter condition. A packet filter device, wherein a circuit for passing matched packets is constituted by hardware. 2. The packet filter device according to claim 1, further comprising a buffer memory for storing the passed packets. 3. The packet filter device according to claim 2, wherein a plurality of sets of the memory and the hardware circuit are provided, and when a packet matches a filter condition of any one of the memories, the packet is passed. .