Method and mechanism for port redirects in a network switch
A method for selectively redirecting a data packet to a port on a switching device which is associated with a corresponding network service. In one embodiment, the data packet is redirected to an intrusion prevention service (IPS) for security analysis of the data packet. In another embodiment, the switching device performs a data link layer redirecting of the data packet based at least in part on whether the data packet is to be flooded from the switching device.
1. A method at a switching device in a network, the method comprising:
receiving a data packet to be directed to one or more destinations in the network;
determining whether a condition of the network indicates that the received data packet is associated with a redirect port of the switching device, wherein the redirect port is associated with a network service configured to return a redirected data packet to the switching device based on an analysis of the redirected data packet;
determining whether the received data packet is to be flooded from multiple ports of the switching device, wherein the received data packet is to be flooded from the multiple ports of the switching device if it is determined that the received data packet includes a broadcast destination address, or if it is determined that the received data packet includes a destination address which fails to correspond to any entry in a forwarding database;
where it is determined that the received data packet is to be flooded, flooding the received data packet from the multiple ports of the switching device, wherein the redirect port is isolated from the flooding of the received data packet; and
where it is determined that the condition of the network indicates that the received data packet is associated with the redirect port and where it is determined that the received data packet is not to be flooded from the switching device, redirecting the received data packet to the redirect port.
2. The method of claim 1 , wherein the condition of the network includes a traffic type of the received data packet.
3. The method of claim 1 , wherein determining whether the received data packet is to be flooded from the switching device comprises at least one of,
determining whether the received data packet includes a broadcast media access control (MAC) destination address, and
determining whether the received data packet includes a media access control (MAC) destination address which fails to correspond to any entry in the forwarding database.
4. The method of claim 1 , wherein determining whether the data packet is to be flooded from the switch comprises determining whether the received data packet includes an internet protocol (IP) multicast destination address.
5. The method of claim 1 , wherein the flooding the received data packet from the switching device is performed without sending the received data packet to any redirect port of the switching device.
6. The method of claim 5 , wherein the redirect port is isolated from any flooding of data packets from the switching device.
7. The method of claim 6 , wherein the redirect port is excluded from a set of ports supporting a Virtual Local Area Network (VLAN).
8. The method of claim 5 , wherein it is determined that the condition of the network indicates that the received data packet is associated with a redirect port of the switching device, and wherein flooding the received data packet from the switching device comprises replacing an indication that the received data packet is to be sent to the redirect port of the switching device with an indication that the received data packet is to be flooded to at least one other port of the switching device.
9. The method of claim 8 , wherein replacing an indication that the received data packet is to be sent to the redirect port of the switching device with an indication that the received data packet is to be flooded to at least one other port of the switching device comprises executing one or more commands stored in a sequence control table (SCT) to retrieve an identifier of the at least one other port of the switching device.
10. The method of claim 5 , wherein it is determined that the condition of the network indicates that the received data packet is associated with a redirect port of the switching device, and wherein flooding the received data packet from the switching device comprises enforcing a rule of an access control list for the redirect port of the switching device, the rule to prevent redirection to the redirect port of the switching device of any data packets having an internet protocol (IP) multicast destination address.
11. A non-transitory machine-readable storage medium having stored thereon a set of instructions which when executed by one or more processors cause the one or more processors to perform a method comprising:
receiving a data packet to be directed to one or more destinations in the network;
determining whether a condition of the network indicates that the received data packet is associated with a redirect port of the switching device, wherein the redirect port is associated with a network service configured to return a redirected data packet to the switching device based on a result of an analysis of the redirected data packet;
determining whether the recieved data packet is to be flooded from multiple ports of the switching device, wherein the received data packet is to be flooded from the multiple ports of the switching device if it is determined that the received data packet includes a broadcast destination address, or if it is determined that the received data packet includes a destination address which fails to correspond to any entry in a forwarding database;
where it is determined that the received data packet is to be flooded, flooding the received data packet from the multiple ports of the switching device, wherein the redirect port is isolated from the flooding of the received data packet; and
where it is determined that the condition of the network indicates that the received data packet is associated with the redirect port and where it is determined that the received data packet is not to be flooded from the switching device, redirecting the received data packet to the redirect port.
12. The machine-readable storage medium of claim 11 , wherein the condition of the network includes a traffic type of the received data packet.
13. The machine-readable storage medium of claim 11 , wherein determining whether the received data packet is to be flooded from the switching device comprises at least one of,
determining whether the received data packet includes a broadcast media access control (MAC) destination address,
determining whether the received data packet includes a media access control (MAC) destination address which fails to correspond to any entry in the forwarding database, and
determining whether the received data packet includes an internet protocol (IP) multicast destination address.
14. The machine-readable storage medium of claim 11 , wherein the flooding the received data packet is performed without sending the received data packet to any redirect port of the switching device.
15. The machine-readable storage medium of claim 14 , wherein flooding the received data packet from the switching device without sending the received data packet to any redirect port of the switching device comprises excluding the redirect port of the switching device from a set of ports supporting a Virtual Local Area Network (VLAN).
16. The machine-readable storage medium of claim 14 , wherein a condition of the network indicates that the received data packet is associated with a redirect port of the switching device, and wherein flooding the received data packet from the switching device comprises replacing an indication that the received data packet is to be sent to the redirect port of the switching device with an indication that the received data packet is to be flooded to at least one other port of the switching device.
17. A switching device comprising:
multiple ports;
a redirect port associated with a network service configured to return a redirected data packet to the switching device based on an analysis of the redirected data packet;
a flow handler to determine whether a received data packet is to be flooded from the multiple ports of the switching device, wherein the received data packet is to be flooded from the multiple ports of the switching device if it is determined that the received data packet includes a broadcast destination address, or if it is determined that the received data packet includes a destination address which fails to correspond to any entry in a forwarding database;
a traffic selector to determine whether a condition of a network indicates that the received data packet is associated with the redirect port; and
a switching mechanism coupled to the traffic selector and to the flow handler, wherein:
where it is determined that the condition of the network indicates that the received data packet is associated with the redirect port, and where it is determined that the received data packet is not to be flooded from the switching device, the switching mechanism to redirect the received data packet to the redirect port; and
where it is determined that the received data packet is to be flooded from the multiple ports of the switching device, the switching mechanism to flood the received data packet, wherein the switching mechanism to isolate the redirect port from the flooding of the received data packet.
18. The switching device of claim 17 , wherein the condition of the network includes a traffic type of the recieved data packet.
19. The switching device of claim 17 , wherein determining whether the received data packet is to be flooded from the switching device comprises at least one of,
determining whether the received data packet includes a broadcast media access control (MAC) destination address,
determining whether the received data packet includes a media access control (MAC) destination address which fails to correspond to any entry in a forwarding database, and
determining whether the received data packet includes an internet protocol (IP) multicast destination address.
20. The switching device of claim 17 , wherein flooding the received data packet from the switching device without sending the received data packet to the redirect port comprises excluding the redirect port from a set of ports supporting a Virtual Local Area Network (VLAN).
21. The switching device of claim 17 , wherein it is determined that the condition of the network indicates that the received data packet is associated with a redirect port of the switching device, and wherein flooding the received data packet from the switching device comprises replacing an indication that the received data packet is to be sent to the redirect port of the switching device with an indication that the received data packet is to be flooded to at least one other port of the switching device.
22. A system comprising:
a switching device having,
multiple ports;
a redirect port, and
a switching mechanism coupled to the multiple ports and to the redirect port, wherein:
where it is determined that a condition of a network indicates that a received data packet is associated with the redirect port, and where it is determined that the received data packet is not to be flooded from the switching device, the switching mechanism to redirect the received data packet to the redirect port; and
where it is determined that the received data packet is to be flooded from the switching device, the switching mechanism to flood the received data packet from the switching device, wherein the switching mechanism to isolate the redirect port from the flooding of the received data packet, wherein the received data packet is to be flooded from the multiple ports of the switching device if it is determined that the received data packet includes a broadcast destination address, or if it is determined that the received data packet includes a destination address which fails to correspond to any entry in a forwarding database;
a network service to receive the redirected data packet from the redirect port of the switching device, the network service further to return the redirected data packet to the switching device based on an analysis of the redirected data packet; and
a serial bus coupling the switching device to the network service.
23. The system of claim 22 , wherein the condition of the network includes a traffic type of the received data packet.
24. The system of claim 22 , wherein the received data packet is not to be flooded from the switching device unless:
the received data packet includes a broadcast media access control (MAC) destination address,
the received data packet includes a media access control (MAC) destination address which does not correspond to any entry in a forwarding database of the switching device, or
the received data packet includes an internet protocol (IP) multicast destination address.
25. The system of claim 22 , wherein the redirect port is excluded from a set of ports supporting a Virtual Local Area Network (VLAN).
26. The system of claim 22 , wherein it is determined that the condition of the network indicates that the received data packet is associated with a redirect port of the switching device, and wherein flooding the received data packet from the switching device comprises replacing an indication that the received data packet is to be sent to the redirect port of the switching device with an indication that the received data packet is to be flooded to at least one other port of the switching device.
27. The system of claim 26 , wherein replacing an indication that the received data packet is to be sent to the redirect port of the switching device with an indication that the received data packet is to be flooded to at least one other port of the switching device comprises executing one or more commands stored in a sequence control table (SCT) to retrieve an identifier of the at least one other port of the switching device.
28. The system of claim 22 , wherein it is determined that the condition of the network indicates that the received data packet is associated with a redirect port of the switching device, and wherein flooding the received data packet from the switching device comprises enforcing a rule of an access control list for the redirect port of the switching device, the rule to prevent redirection to the redirect port of the switching device of any data packets having an internet protocol (IP) multicast destination address.