Namespace routing
A network element employing multiple namespaces in performing IP packet routing. The network element maintaining two or more namespaces. A first namespace corresponds to an in-band network domain and a second namespace corresponds to an out-of-band network domain. The network element performing IP packet routing over the in-band network domain and the out-of-band network domain using said two or more namespaces. Embodiments allow operators to more easily implement separate routing tables for “in-band” and “out-of-band” communication. Having separate routing tables for in-band and out-of-band communication prevents malicious CPEs and hacked CMs from directly communicating to servers on the out-of-band network, thereby increasing security for CMTS operators.
1. A non-transitory computer-readable storage medium that stores one or more sequences of instructions for IP packet routing at a network element, which when executed, cause:
the network element maintaining two or more namespaces, wherein each of said two or more namespaces maintained by the network element has a separate routing table maintained by the network element, wherein a first namespace of the two or more namespaces corresponds to an in-band network domain for providing Internet access and video content to subscriber devices, and wherein a second namespace of the two or more namespaces corresponds to an out-of-band network domain for network traffic related to managing or configuring the network element,
wherein the network element is a Cable Modem Termination System (CMTS); and
the network element performing IP packet routing over the in-band network domain and the out-of-band network domain using said two or more namespaces, wherein the network element performs IP packet routing over the in-band network domain and the out-of-band network domain without performing policy based routing (PBR).
2. The non-transitory computer-readable storage medium of claim 1 , wherein said first namespace provides a Linux operating system alias to enable an operator to execute Linux commands against a routing table maintained by said second namespace.
3. The non-transitory computer-readable storage medium of claim 1 , wherein execution of the one or more sequences of instructions further cause:
when a particular user connects to the network element via a SSH session established with an IP address associated with the out-of-band network domain, the network element executing a Linux user profile script associated with the particular user to ascertain whether a set of routing tables associated with said first namespace should be made accessible to the SSH session for the particular user.
4. The non-transitory computer-readable storage medium of claim 1 , wherein each of said two or more namespaces are a Linux kernel container that identifies a set of Linux kernel interfaces.
5. The non-transitory computer-readable storage medium of claim 1 , wherein said first and second namespaces communicate with each other using virtual Ethernet interfaces created using the Linux operating system.
6. A network element for IP packet routing, comprising:
one or more processors; and
one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause:
the network element maintaining two or more namespaces, wherein each of said two or more namespaces maintained by the network element has a separate routing table maintained by the network element, wherein a first namespace of the two or more namespaces corresponds to an in-band network domain for providing Internet access and video content to subscriber devices, and wherein a second namespace of the two or more namespaces corresponds to an out-of-band network domain for network traffic related to managing or configuring the network element,
wherein the network element is a Cable Modem Termination System (CMTS); and
the network element performing IP packet routing over the in-band network domain and the out-of-band network domain using said two or more namespaces, wherein the network element performs IP packet routing over the in-band network domain and the out-of-band network domain without performing policy based routing (PBR).
7. The network element of claim 6 , wherein said first namespace provides a Linux operating system alias to enable an operator to execute Linux commands against a routing table maintained by said second namespace.
8. The network element of claim 6 , wherein execution of the one or more sequences of instructions further cause:
when a particular user connects to the network element via a SSH session established with an IP address associated with the out-of-band network domain, the network element executing a Linux user profile script associated with the particular user to ascertain whether a set of routing tables associated with said first namespace should be made accessible to the SSH session for the particular user.
9. The network element of claim 6 , wherein each of said two or more namespaces are a Linux kernel container that identifies a set of Linux kernel interfaces.
10. The network element of claim 6 , wherein said first and second namespaces communicate with each other using virtual Ethernet interfaces created using the Linux operating system.
11. A method for IP packet routing at a network element, comprising:
the network element maintaining two or more namespaces, wherein each of said two or more namespaces maintained by the network element has a separate routing table maintained by the network element, wherein a first namespace of the two or more namespaces corresponds to an in-band network domain for providing Internet access and video content to subscriber devices, and wherein a second namespace of the two or more namespaces corresponds to an out-of-band network domain for network traffic related to managing or configuring the network element,
wherein the network element is a Cable Modem Termination System (CMTS); and
the network element performing IP packet routing over the in-band network domain and the out-of-band network domain using said two or more namespaces, wherein the network element performs IP packet routing over the in-band network domain and the out-of-band network domain without performing policy based routing (PBR).
12. The method of claim 11 , wherein said first namespace provides a Linux operating system alias to enable an operator to execute Linux commands against a routing table maintained by said second namespace.
13. The method of claim 11 , wherein execution of the one or more sequences of instructions further cause:
when a particular user connects to the network element via a SSH session established with an IP address associated with the out-of-band network domain, the network element executing a Linux user profile script associated with the particular user to ascertain whether a set of routing tables associated with said first namespace should be made accessible to the SSH session for the particular user.
14. The method of claim 11 , wherein each of said two or more namespaces are a Linux kernel container that identifies a set of Linux kernel interfaces.
15. The method of claim 11 , wherein said first and second namespaces communicate with each other using virtual Ethernet interfaces created using the Linux operating system.