Intrusion detection and prevention processing within network interface circuitry
View Patent ↗A network interface controller (NIC) is configured to couple a host to a network. The NIC coupled to the host via a host bus, and the host is configured to operate a plurality of virtual machines. The NIC is configured to receive at least one data frame, the at least one data frame including at least a source network address and indication of at least one destination network address; determine if the received data frame is a frame on which additional processing should occur; based on a result of the determining step, cause the frame to be provided to the host, via the host bus, for the host to perform the additional processing; and receive, via the host bus, the frame on which additional processing has been performed and steer the frame to a destination based on the at least one destination address.
1. A network interface controller (NIC) configured to couple a host to a network, the NIC coupled to the host via a host bus, and the host configured to operate a plurality of virtual machines, the NIC configured to:
receive at least one data frame, the at least one data frame including at least a source network address and indication of at least one destination network address,
determine if the received data frame is a frame on which additional processing should occur including filter processing on the received data frame;
based on a result of the determining step, cause the frame to be provided to the host, via the host bus, for the host to perform the additional processing, wherein the additional processing is intrusion detection processing; and
receive, via the host bus, the frame on which additional processing has been performed and steer the frame to a destination based on the at least one destination address.
2. The NIC of claim 1 , wherein:
being configured to steer the frame to a destination based on the at least one destination address includes steering the frame to one of the virtual machines being operated by the host.
3. The NIC of claim 1 , wherein:
the NIC being configured to cause the frame to be provided to the host, for the host to perform the additional processing, includes the NIC being configured to cause the frame to be provided to one of the virtual machines being operated by the host.
4. The NIC of claim 1 , wherein:
the NIC is configured to, when the destination address includes a broadcast indication, not replicate the frame for broadcast until after the additional processing, such that as the frame upon which additional processing has been performed is being steered to a destination, the frame is replicated for broadcast as indicated by the destination address.
5. The NIC of claim 1 , wherein:
the filter processing of the NIC is configurable based on result of the intrusion detection processing.
6. The NIC of claim 1 , wherein the filter processing is configured to at least one accept/reject actions to the received data frames.
7. The NIC of claim 6 , wherein the filter processing is further configured to add filtering rules to received data frames that are accepted as a result of the filter processing.
8. The NIC of claim 7 , wherein adding filtering rules to a received data frame includes modifying the received data frame.
9. The NIC of claim 7 , wherein adding filtering rules includes modifying the received data frame to cause unicast loopback of the frame to the host as result of the determining step.
10. The NIC of claim 1 , wherein the filter processing is responsive to at least a source of the received at least one data frame.
11. The NIC of claim 1 , wherein the additional processing includes replicating the received data frame and providing the resulting replicated data frames packets to destinations as indicated by the received data frame.
12. The NIC of claim 1 , wherein the NIC is configured to carry out filter processing at least in part based on rules that are configurable by the intrusion detection processing being performed on the host.
13. The NIC of claim 1 , wherein the NIC is further configured to:
for each data frame on which additional processing has been performed and that is a data frame destined for one of the virtual machines operated by the host and which is indicated as belonging to a connection for which the NIC is configured to offload protocol processing, performing protocol processing with respect to the data frame and the connection according to a state of the connection maintained in the NIC.
14. A network interface controller (NIC) configured to couple a host to a network, the NIC coupled to the host via a host bus, and the host configured to operate a plurality of virtual machines, the NIC configured to:
receive at least one data frame from one of the virtual machines, the at least one data frame including at least a source network address and indication of at least one destination network address,
determine if the received data frame is a frame on which additional processing should occur;
based on a result of the determining step, cause the frame to be provided to a different virtual machine, via the host bus, for the host to perform the additional processing, wherein the additional processing is intrusion detection processing; and
receive, via the host bus, the frame on which additional processing has been performed and steer the frame to a destination based on the at least one destination address.
15. The NIC of claim 14 , wherein steering the frame to a destination based on the at least one destination address includes steering the frame to a virtual machine.