Filtering and route lookup in a switching device
Methods and devices for processing packets are provided. The processing device may Include an input interface for receiving data units containing header information of respective packets; a first module configurable to perform packet filtering based on the received data units; a second module configurable to perform traffic analysis based on the received data units; a third module configurable to perform load balancing based on the received data units; and a fourth module configurable to perform route lookups based on the received data units.
1. A method performed by one or more devices, the method comprising:
filtering, by the one or more devices, received packets based on a filter rule associated with the received packets;
marking, for sampling, by the one or more devices, a first one of the received packets by setting a bit in a packet notification when the first received packet matches the filter rule; and
sampling, by the one or more devices, the marked packet based on a randomly generated number associated with the marked packet.
2. The method of claim 1 , where the sampling is performed based on a comparison of the randomly generated number to a predetermined threshold.
3. The method of claim 1 , where the received packets include header information comprising at least one of: a source Internet protocol (IP) address, a destination IP address, an IP type, a source port, a destination port, a differentiated service (DiffServ) byte, an IP fragmentation offset field, an IP fragmentation control field, or a transmission control protocol (TCP) control bit, and where the filtering is based on the header information.
4. The method of claim 1 , further comprising at least one of:
accepting the marked packet;
discarding the marked packet; or
rejecting the marked packet and transmitting an Internet control message protocol (ICMP) message.
5. The method of claim 1 , where the filtering comprises accepting an unmarked packet when the unmarked packet is not rejected based on the filter rule.
6. The method of claim 1 , further comprising:
writing header information associated with the sampled packet to a routing engine of the one or more devices.
7. The method of claim 1 , further comprising at least one of:
monitoring all logical interfaces associated with the one or more devices;
monitoring designated logical interfaces associated with the one or more devices;
monitoring designated protocols associated with the received packets;
monitoring a range of addresses associated with the received packets; or
monitoring individual addresses associated with the received packets.
8. The method of claim 1 , where the filtering identifies at least one of respective destinations of the received packets, a volume of the received packets, or respective contents of the received packets.
9. The method of claim 1 , further comprising:
logging the marked packet, a log entry associated with the logged packet being accessible for display via an interface associated with the one or more devices, the log entry including at least one of a log time, an input circuit, a protocol type, a source address, or a destination address.
10. The method of claim 1 , where the filtering comprises performing source address verification to prevent source address spoofing of a network operation center system.
11. The method of claim 1 , further comprising:
load balancing the received packets.
12. The method of claim 11 , where the load balancing comprises forwarding received packets associated with a designated source port or a designated source address to a designated destination port or a designated destination address.
13. The method of claim 12 , where the forwarding the received packets comprises maintaining an order and a travel path for a TCP session associated with the forwarded packets.
14. A method performed by one or more devices, comprising:
randomly sampling, by the one or more devices, received packets based on a predetermined sampling rate of 1/n, where n is a specified integer;
comparing, by the one or more devices, the predetermined sampling rate to a randomly generated number to form a resulting value; and
performing, by the one or more devices, the random sampling based on the resulting value.
15. A system comprising one or more devices to:
accept a packet, when the packet is not rejected by a filter, when a filtering criterion is satisfied, by setting a bit in a packet notification; and
mark the accepted packet for sampling when a randomly generated number is less than a predetermined value.
16. The system of claim 15 , where the one or more devices are further to:
discard the packet when the packet contains a spoofed network operation center source address.