Method and apparatus for controlling packet flow in a packet-switched network
View Patent ↗A method and apparatus for controlling data packet flooding in a data-communication network to promote network security and provide for more efficient utilization of network resources. One or more network nodes include a flooding disable device, for example a disable bit in a L2 hardware lookup table associated with a particular device in an Ethernet application. When the disabler is set, packets from the particular device are not flooded on all ports even when the node cannot associate a particular port with the packets' intended destination. The flooding disable in the network node may be set statically or dynamically, either by a network operator or by a communication received from a server or other network device.
1. A method for controlling packet flow in a packet-switched network, comprising:
receiving at least one packet in a network node;
determining a destination associated with the at least one packet;
determining a source associated with the at least one packet;
determining whether flooding has been disabled for packets from the source associated with the at least one packet;
determining whether the destination is associated with a port of the network node;
discarding the at least one packet if flooding has been disabled for packets from the associated source and the destination is not associated with a port of the network node; and
setting a timer for a predetermined duration when the at least one packet is discarded.
2. The method of claim 1 , further comprising, if a port of the network node is determined to be associated with the destination, forwarding the at least one packet on the destination-associated port.
3. The method of claim 1 , further comprising, if it is determined that flooding has been disabled for packets from the associated source, discarding the at least one packet if the destination is not associated with a port of the network node.
4. The method of claim 1 , further comprising, if it is determined that flooding has been disabled for packets from the associated source, buffering the at least one packet if the destination is not associated with a port of the network node.
5. The method of claim 4 , further comprising forwarding the buffered at least one packet if, after a selected duration, it can be determined that the destination is associated with a port of the network node.
6. The method of claim 1 , further comprising flooding the at least one packet if the destination is not associated with a port of the network node and flooding has not been disabled for packets form the source associated with the at least one packet.
7. The method of claim 1 , further comprising setting a timer in the network node to indicate a duration after which flooding for packets from a specific source will be enabled.
8. The method of claim 1 , wherein flooding has been disabled for packets associated with a specific source by a communication from an authentication server in response to an authentication request from the source.
9. The method of claim 1 , wherein the packet-switched network is an Ethernet network.
10. The method of claim 9 , wherein an indication that flooding has been disabled is stored as a disable bit in a L2 hardware lookup table associated with the source MAC address.
11. A node for a packet-switched network, comprising:
a CPU;
a plurality of ports for receiving and forwarding packets;
a buffer coupled to the CPU for storing received packets until they are forwarded or discarded;
a packet examiner coupled to the CPU for determining the source and the intended destination of received packets;
an L2 hardware lookup table for maintaining a disable bit associated with the MAC address of a device to indicate whether the flooding of packets from a particular source by the node has been disabled; and
a timer for indicating a predetermined duration when the received packets are discarded upon determining that the flooding has been disabled for the packets from the associated source and that the destination of the received packets is not associated with a port of the node.
12. The node of claim 11 , further comprising a timer for indicating a duration after which flooding for packets from a particular source will be enabled.
13. The node of claim 12 , wherein the timer is further for indicating a duration after which flooding for packets from a particular source will be disabled.
14. The node of claim 11 , wherein the disable bit may be set statically or dynamically.