Control plane protection for various tables using storm prevention entries
The present disclosure discloses a method and network device for control plane protection for various tables using storm prevention entries. Specifically, the disclosed system receives a first packet, and creates an inactive entry in a table. The system then forwards the first packet from a first processor to a second processor for processing. Also, the system associates the inactive entry with a timestamp indicating when the first packet is forwarded to the second processor, and determines a configured interval (CI) associated with the table. Further, the system compares a difference between a current timestamp and the timestamp associated with the inactive entry against the CI upon receiving a second packet. If the difference is longer than the CI, the system associates the inactive entry with the current timestamp, and forwards the second packet to the second processor for processing. Otherwise, the system discards the second packet.
1. A method comprising:
receiving, by a first processor at a network device, a first packet;
determining whether a user entry corresponding to the first packet exists in a first table, wherein a second table having a missing entry is dependent upon the first table;
in response to the user entry existing in the first table, creating a session entry in the second table for the first packet based on the user entry;
in response to the user entry not existing in the first table, creating, by the first processor, an inactive entry in the first table, wherein the inactive entry includes a source Internet Protocol (IP) address associated with the first packet;
forwarding, by the first processor, the first packet to a second processor for processing;
receiving, by a processor of a plurality of processors, a second packet;
determining, by the processor of the plurality of processors, whether a source IP address of the second packet matches the source IP address of the inactive entry; and
in response to determining that the source IP address of the second packet matches the source IP address of the inactive entry,
discarding the second packet, wherein the inactive entry is an entry in the first table marked as inactive.
2. The method of claim 1 , further comprising:
associating, by the network device, the inactive entry with a timestamp indicating a time point when the first packet is forwarded to the second processor by the first processor.
3. The method of claim 2 , further comprising:
comparing, by the one of the plurality of processors, a current timestamp with the timestamp associated with the inactive entry in response to receiving the second packet; and
in response to a difference between the current timestamp and the timestamp associated with the inactive entry being longer than a configured interval (CI),
associating the inactive entry with the current timestamp; and
forwarding the second packet to the first processor for processing.
4. The method of claim 2 , further comprising:
determining, by the network device, a configured interval (CI) for each type of a table maintained by the network device to facilitate packet processing.
5. The method of claim 4 , wherein the CI is determined based on one or more of a packet type, an amount of time a respective processor takes to processing the first packet, and a relative frequency at which the same type of packets are received.
6. The method of claim 1 , wherein the inactive entry is created in the user table and in one or more of a port table, a route table, a virtual local area network (VLAN) table, a route cache, a bridge table, a session policy table, and a station table.
7. The method of claim 1 ,
wherein the first processor comprises an exception handling processor;
wherein the second processor comprises a control plane processor;
wherein the plurality of processors comprises a plurality of forwarding processors; and
wherein the first processor and the plurality of processors share access to a memory of the network device.
8. The method of claim 1 , wherein the inactive entry is created in response to a missing entry in a first table.
9. The method of claim 1 , wherein the first table comprises a session table that does not allow for inactive entry.
10. A network device having a symmetric multiprocessing architecture, the network device comprising:
a plurality of CPU cores comprising an exception handling CPU core;
a network interface to receive one or more data packets; and
a memory whose access is shared by the plurality of CPU cores;
wherein the plurality of CPU cores are to:
receive a first packet;
determine whether a user entry corresponding to the first packet exists in a first table, wherein a second table having a missing entry is dependent upon the first table;
in response to the user entry existing in the first table, create a session entry in the second table for the first packet based on the user entry;
in response to the user entry not existing in the first table, create an inactive entry in the first table, wherein the inactive entry includes a source Internet Protocol (IP) address associated with the first packet;
forward the first packet to a second processor for processing;
receive, by a processor of a plurality of processors, a second packet;
determine, by the processor of the plurality of processors, whether the source IP address of the second packet matches the source IP address of the inactive entry; and
in response to a determination that the source IP address of the second packet matches the source IP address of the inactive entry,
discard the second packet, wherein the inactive entry is an entry in the first table marked as inactive.
11. The network device of claim 10 , wherein the plurality of CPU cores are further to:
associate the inactive entry with a timestamp indicating a time point when the first packet is forwarded to the second processor by a first processor.
12. The network device of claim 11 , wherein the plurality of CPU cores are further to:
compare a current timestamp with the timestamp associated with the inactive entry in response to receiving the second packet; and
in response to a difference between the current timestamp and the timestamp associated with the inactive entry being longer than a configured interval (CI),
associate the inactive entry with the current timestamp; and
forward the second packet to the first processor for processing.
13. The network device of claim 11 , wherein the plurality of CPU cores are further to:
determine a configured interval (CI) for each type of a table maintained by the network device to facilitate packet processing.
14. The network device of claim 13 , wherein the CI is determined based on one or more of a packet type, an amount of time a respective processor takes to processing the first packet, and a relative frequency at which the same type of packets are received.
15. The network device of claim 10 , wherein the inactive entry is created in the user table and in one or more of a port table, a route table, a virtual local area network (VLAN) table, a route cache, a bridge table, a session policy table, and a station table.
16. The network device of claim 10 ,
wherein the second processor comprises a control plane processor;
wherein the plurality of processors comprises a plurality of forwarding processors; and
wherein the first processor and the plurality of processors share access to the memory of the network device.
17. The network device of claim 10 , wherein the inactive entry is created in response to a missing entry in a first table.
18. The network device of claim 10 , wherein the first table comprises a session table that does not allow for inactive entry.