CN115412431B

CN115412431B - Network switch and abnormality detection method

Info

Publication number: CN115412431B
Application number: CN202110504048.6A
Authority: CN
Inventors: 王思翰; 郑凯文; 陈明道
Original assignee: Realtek Semiconductor Corp
Current assignee: Realtek Semiconductor Corp
Priority date: 2021-05-10
Filing date: 2021-05-10
Publication date: 2024-10-01
Anticipated expiration: 2041-05-10
Also published as: CN115412431A

Abstract

A network switch is configured to receive a plurality of packet data and includes a memory and a processor. The memory is used for storing an access control table and an abnormality detection program, filtering the packet data according to the access control table, and executing an abnormality detection process on the packet data according to the abnormality detection program. If at least one abnormal event occurs in one of the time intervals, the count value is increased. When the count value reaches the count threshold, the memory issues an exception notification to the processor to cause the processor to perform an exception handling process on the packet data.

Description

Network switch and abnormality detection method

Technical Field

The disclosure relates to a network technology, and more particularly, to a network switch and an anomaly detection method.

Background

With the development of technology, network systems have been widely used in business or life. In general, a network switch is configured in a network system. The network switch is mainly used for switching data of different network devices. In some related art, the network switch performs an exception handling process immediately upon occurrence of an exception event. However, this may cause the processor in the network switch to perform exception handling too frequently, thereby reducing its utilization.

Disclosure of Invention

Some embodiments of the present disclosure relate to a network switch. The network switch is used for receiving a plurality of packet data and comprises a memory and a processor. The memory is used for storing an access control table and an abnormality detection program, filtering the packet data according to the access control table, and executing an abnormality detection process on the packet data according to the abnormality detection program. If at least one abnormal event occurs in one of the time intervals, the count value is increased. When the count value reaches the count threshold, the memory issues an exception notification to the processor to cause the processor to perform an exception handling process on the packet data.

Some embodiments of the present disclosure relate to an anomaly detection method. The abnormality detection method includes: receiving a plurality of packet data by a network switch; filtering the packet data according to the access control table by a memory in the network switch, and executing an anomaly detection process on the packet data according to an anomaly detection program; if at least one abnormal event occurs in one of the time intervals, increasing the count value; and when the count value reaches the count threshold, sending an exception notification to a processor in the network switch by the memory so that the processor performs an exception handling process on the packet data.

Drawings

The foregoing and other objects, features, advantages and embodiments of the present disclosure will be apparent from the following description of the drawings in which:

FIG. 1 is a schematic diagram of a network switch according to some embodiments of the present disclosure;

FIG. 2 is a timing diagram of an anomaly detection process according to some embodiments of the present disclosure;

FIG. 3 is a schematic diagram of a parameter configuration depicted in accordance with some embodiments of the present disclosure; and

FIG. 4 is a flow chart of an anomaly detection method according to some embodiments of the present disclosure.

Detailed Description

The term "coupled" as used herein may also refer to "electrically coupled" and the term "connected" may also refer to "electrically connected". "coupled" or "connected" may also mean that two or more elements cooperate or interact with each other.

Reference is made to fig. 1. Fig. 1 is a schematic diagram of a network switch 100 according to some embodiments of the present disclosure. In some embodiments, network switch 100 is an ethernet network switch.

For example, in fig. 1, the network switch 100 includes ports P1, P2, and P3. The network switch 100 is coupled to the network device D1 through the port P1, the network device D2 through the port P2, and the external analysis device D3 through the port P3. The network switch 100 can receive the packet data PK from the networking device D1 through the port P1 and output the packet data PK' to the networking device D2 through the port P2 according to the destination address. And the external analysis device D3 may perform an analysis process on the packet data PK.

For the example of fig. 1, network switch 100 includes memory 110, processor 120, counter 130, and register 140. In addition to ports P1-P3, memory 110 is further coupled to processor 120, counter 130, and register 140. Register 140 is coupled to processor 120.

The memory 110 is used for storing an access control table AL and an anomaly detection program AD. Memory 110 may filter packet data PK according to access control table AL. For example, the access control table AL may include a plurality of entries (entries). Each entry may correspond to a rule as well as a behavior (action). The memory 110 may compare the packet data PK with the rules and perform corresponding actions on the packet data PK according to the comparison result to complete the filtering process and thereby generate the packet data PK'. The "behavior" may be, for example, notification, speed limiting, dropping packets, forwarding packets, etc.

In some embodiments, memory 110 is a ternary content addressable memory (Ternary Content Addressable Memory, TCAM). In these embodiments, the packet data PK is compared to these rules in a "parallel" fashion. That is, packet data PK may be simultaneously compared to these rules.

For example, in fig. 1, the access control table AL includes a control block AL1 and a control block AL2. The control block AL1 and the control block AL2 each include a plurality of entries. In some embodiments, the control block AL1 is an ingress (ingress) control block, and the control block AL2 is an egress (egress) control block. In other words, the control block AL1 (ingress control block) may be used to filter packet data PK that is input into the network switch 100 and has not yet been processed by the network switch 100. The control block AL2 (egress control block) is used for filtering the packet data PK processed by the network switch 100.

Taking the control block AL1 as an example, the header of the packet data PK that has just been input into the network switch 100 and has not been processed by the network switch 100 may be first truncated. Then, the truncated header is compared with the rule of the entry in the control block AL1, and the corresponding actions are executed on the packet data PK according to the comparison result, so as to complete the ingress filtering process. The control block AL2 has similar operations to complete the outlet filtering process, and thus is not described herein.

Because control block AL1 and control block AL2 share the storage space of memory 110, the architecture of FIG. 1 is also referred to as the "shared ternary content addressable memory (SHARE TCAM) architecture". In some embodiments, the duty ratio of the control block AL1 and the control block AL2 in the memory 110 can be adjusted by a user according to actual requirements. For example, when the user inputs (sets) the ratio of the control block AL1 to the control block AL2 through the input device, the network switch 100 generates a corresponding partition number (partition number) command PN. Then, the duty ratio of the control block AL1 and the control block AL2 in the memory 110 is configured according to the discrimination value command PN.

On the other hand, the memory 110 may perform an abnormality detection process on the packet data PK in accordance with the abnormality detection program AD. The abnormality detection program AD includes a detection block AD1 and a detection block AD2.

For example, in fig. 1, the detection block AD1, the control block AL2, and the detection block AD2 are sequentially disposed in the memory 110. Stated another way, the detection block AD1 is adjacent to the control block AL1, and the detection block AD2 is adjacent to the control block AL2. In this configuration, the detection block AD1 may be used to enable the control block AL1 to support the anomaly detection process, and the detection block AD2 may be used to enable the control block AL2 to support the anomaly detection process. Accordingly, the detection block AD1 and the detection block AD2 can support the anomaly detection process.

In some related art, only one abnormality detection process is configured and this abnormality detection process is adjacent to the control block AL1 (or the control block AL 2). Accordingly, only control block AL1 (or control block AL 2) may support the anomaly detection process.

In comparison with the above-mentioned related arts, in the present disclosure, the detection block AD1 and the detection block AD2 are simultaneously configured. Accordingly, the detection blocks AD1 and AD2 can be used to support the anomaly detection process for both the control block AL1 and the control block AL 2.

Next, refer to fig. 1 and fig. 2 simultaneously. FIG. 2 is a timing diagram of an anomaly detection process, according to some embodiments of the present disclosure.

The following will take the detection block AD1 as an example to make the control block AL1 support the abnormality detection process. Since the detection block AD2 and the control block AL2 have similar operations, the description thereof is omitted.

In operation, when the network switch 100 receives the packet data PK, the control block AL1 filters the packet data PK and the detection block AD1 enables the control block AL1 to support the anomaly detection process.

First, a plurality of time intervals T1-T4 (e.g., 1 millisecond) may be set for a particular type of packet data PK. In practical applications, different types of packet data PK may correspond to different time interval lengths. In addition, an upper limit of the flow (e.g., 10 Mbits per second) may be set for this particular type of packet data PK. In practical applications, different types of packet data PK may correspond to different upper limit values of traffic.

In some embodiments, an exception event occurs when the flow value of this particular type of packet data PK reaches the upper flow limit value. For the example of fig. 2, two anomalies occur in time interval T1, while five anomalies occur in time interval T3. In some embodiments, the count value of the counter 130 is incremented by 1 whenever several abnormal events occur within a time interval. Accordingly, in the example of fig. 2, the initial count value of the counter 130 is 0, and after the time period T1 has elapsed, the count value of the counter 130 is incremented by 1 (the count value becomes 1). Then, after the time period T3 has elapsed, the count value of the counter 130 is increased by 1 again (the count value becomes 2).

In addition, a count threshold may be set for this particular type of packet data PK. In practical applications, different types of packet data PKs may correspond to different count thresholds. The count value of the counter 130 may be compared to a count threshold. When the count value of the counter 130 reaches the count threshold, the memory 110 will issue an exception notification IRT to the processor 120 to notify the processor 120 to perform an exception handling procedure on the packet data PK.

In some embodiments, the length, the upper flow limit or the count threshold of the time intervals T1-T4 may be temporarily stored in the register 140. In some embodiments, the length, the upper limit of the flow, or the count threshold of the time intervals T1-T4 temporarily stored in the register 140 can be adjusted by the user according to the actual requirement (e.g., the importance of the specific type of packet data PK or the influence degree of the specific type of packet data PK on the system). For example, when the user inputs (sets) the length, the flow upper limit value or the count threshold of the time interval T1-T4 through the input device, the corresponding setting command CM is generated in the network switch 100. Then, the processor 120 may issue an update signal US according to the setting command CM to update the length, the flow upper limit or the count threshold of the time intervals T1-T4 temporarily stored in the register 140. Accordingly, flexibility in the application of the network switch 100 may be increased.

It is specifically noted herein that in some other embodiments, the register 140 may be implemented in common by a plurality of registers.

In some embodiments, the exception handling process may be a packet dropping process or a packet forwarding process. In other words, when the count value of the counter 130 reaches the count threshold, the packet data PK may be discarded or forwarded to the port P3.

Regarding the packet dropping process, in some embodiments, when the count value of counter 130 reaches the count threshold, a large number of packet data PKs of a particular type are often received on behalf of network switch 100. This occupies the internal bandwidth of the network switch 100. However, if the packet data PK is discarded when the count value of the counter 130 reaches the count threshold, the internal bandwidth of the network switch 100 can be effectively saved, and the problem that the backend server breaks down due to a large number of packets (e.g., crashes) can be avoided.

Regarding the packet forwarding process, in some embodiments, when the count value of the counter 130 reaches the count threshold, the packet data PK may be forwarded to the external analysis device D3, and the external analysis device D3 may analyze the forwarded packet data PK to generate an analysis result AR (e.g., analyze the current network state). The network switch 100 can then automatically adjust the parameters (e.g., the flow upper limit or the count threshold) temporarily stored in the register 140 according to the analysis result AR. For example, if the analysis result AR shows that the specific type of packet data PK does need a larger bandwidth in the network state, the processor 120 may send the update signal US according to the analysis result AR to raise the upper limit value of the traffic registered in the register 140. Accordingly, the network switch 100 can achieve the effects of self-learning and dynamic adjustment.

In some other embodiments, processor 120 may adjust the buffered count threshold in register 140 based on the frequency at which the exception notification IRT is received. For example, if the frequency of the received exception notification IRT is too high, the processor 120 may issue an update signal US to raise the count threshold temporarily stored in the register 140. If the frequency of the received exception notification IRT is too low, the processor 120 may issue an update signal US to lower the count threshold temporarily stored in the register 140. Accordingly, the utilization of the processor 120 may be improved.

In some related art, the network switch performs an exception handling process immediately upon occurrence of an exception event. This may cause the processor in the network switch to perform exception handling too frequently, thereby reducing processor utilization.

In contrast to the above-described related art, in the present disclosure, if an exception event occurs within a time interval, the count value is increased and an exception notification IRT is issued to the processor 120 to perform an exception process on the packet data PK when the count value reaches the count threshold. Accordingly, the processor 120 can be prevented from performing the exception processing too frequently, thereby improving the utilization of the processor 120. In addition, since in some embodiments of the present disclosure, the count value is incremented by 1 regardless of the occurrence of several abnormal events within one time interval. Accordingly, the number of bits required for the counter 130 may be reduced to reduce hardware costs.

Reference is made to fig. 1, 2 and 3. Fig. 3 is a schematic diagram of a parameter configuration 300, depicted in accordance with some embodiments of the present disclosure.

For example, as shown in FIG. 3, the parameter configuration 300 may be stored in the register 140 and used for the user to set the time interval length TS, the count threshold MT, and the exception handling RD. The time interval TS represents the length of the time intervals T1-T4 for detecting whether an abnormal event occurs. The count threshold MT represents that if the count value of the counter 130 reaches this value, an exception notification IRT will be issued to the processor 120. Exception handling RD represents the discarding or forwarding of packet data PK. For example, if the exception handling procedure RD is 0, it represents that the currently set exception handling procedure RD is to discard the packet data PK, and if the exception handling procedure RD is 0x000A, it represents that the currently set exception handling procedure RD is to forward the packet data PK to the port P3. In some embodiments, the parameter configuration 300 further includes the flow upper limit value for the user to set the flow upper limit value. The flow upper limit value is a judgment standard for whether an abnormal event occurs.

Refer to fig. 4. FIG. 4 is a flow chart of an anomaly detection method 400 according to some embodiments of the present disclosure. In some embodiments, the anomaly detection method 400 is applied to the network switch 100 in fig. 1, but the disclosure is not limited thereto. Taking the example of fig. 4, the anomaly detection method 400 includes operations S402, S404, S406, and S408.

In operation S402, a plurality of packet data PKs are received by the network switch 100. In some embodiments, network switch 100 is an ethernet network switch.

In operation S404, the packet data PK is filtered by the memory 110 according to the access control table AL, and an anomaly detection process is performed on the packet data PK according to the anomaly detection program AD. In some embodiments, memory 110 is a ternary content addressable memory.

In operation S406, if at least one abnormal event occurs in one of the time intervals T1-T4, the count value is incremented. In some embodiments, the count value of the counter 130 is incremented by 1 whenever several abnormal events occur within a time interval.

In operation S408, when the count value reaches the count threshold, an exception notification IRT is issued to the processor 120 by the memory 110 to cause the processor 120 to perform an exception handling procedure on the packet data PK. In some embodiments, the exception handling process may be a packet dropping process or a packet forwarding process.

In summary, in the network switch and the anomaly detection method of the present disclosure, if an anomaly event occurs in a time interval, the count value is increased, and when the count value reaches the count threshold, an anomaly notification is sent to the processor to perform an anomaly processing process on the packet data. Therefore, the processor can be prevented from executing the exception handling process too frequently, and the utilization rate of the processor is further improved.

Various functional elements and blocks are disclosed herein. It will be appreciated by those of ordinary skill in the art that the functional blocks may be implemented by circuits, whether special purpose circuits or general purpose circuits operating under the control of one or more processors and code instructions, which generally include transistors or other circuit elements to control the operation of electrical circuits in accordance with the functions and operations described herein. It will further be appreciated that the specific structure and interconnection of circuit elements in general may be determined by a compiler, such as a Register Transfer Language (RTL) compiler. The register transfer language compiler operates on instruction codes (scripts) that are quite similar to assembly language code (assembly language code), compiling the instruction codes into a form for layout or making the final circuit.

While the present disclosure has been described with reference to the embodiments, it should be understood that the invention is not limited thereto, but may be variously modified and modified by one of ordinary skill in the art without departing from the spirit and scope of the present disclosure, and the scope of the present disclosure is therefore intended to be limited only by the appended claims.

Description of the reference numerals

100 Network switch

110 Memory

120 Processor

130 Counter

140 Register

300 Parameter configuration

Abnormality detection method 400

P1, P2, P3 ports

D1, D2 networking device

D3 external analysis device

PK, PK': packet data

AL Access control Table

AL1, AL2 control block

AD abnormality detection program

AD1, AD2 detection block

PN differential value instruction

T1-T4 time interval

IRT anomaly notification

AR analysis results

CM setting instruction

US update Signal

TS: time interval Length

MT count threshold

RD exception handling procedure

S402, S404, S406, S408 operation

Claims

1. A network switch for receiving a plurality of packet data, wherein the network switch comprises:

The memory is used for storing an access control table and an abnormality detection program, filtering the plurality of packet data according to the access control table and executing an abnormality detection process on the plurality of packet data according to the abnormality detection program; and

A processor, wherein if one of the time intervals has an abnormal event, the count value is increased, and no matter how many times of abnormal events occur in one time interval, the count value is increased by 1; the abnormal event is that the flow value of the plurality of packet data reaches the flow upper limit value;

Wherein when the count value reaches the count threshold, the memory issues an exception notification to the processor to cause the processor to perform an exception handling procedure on the plurality of packet data.

2. The network switch of claim 1, wherein the network switch further comprises:

At least one register for storing the length of the time intervals, the count threshold or the flow upper limit.

3. The network switch of claim 2, wherein the length, count threshold, or flow upper limit of the plurality of time intervals is updated according to a set command corresponding to a user input.

4. The network switch of claim 1, wherein the processor is to adjust the count threshold based on a frequency at which the anomaly notification is received.

5. The network switch of claim 1, wherein the exception handling procedure comprises a packet dropping procedure or a packet forwarding procedure.

6. The network switch of claim 5, wherein the packet forwarding process is forwarding the plurality of packet data to a port of the network switch coupled to an external analysis device, and wherein the processor is further configured to adjust the upper limit of traffic according to an analysis result of the external analysis device.

7. The network switch of claim 1, wherein the access control table comprises a first control block and a second control block, the anomaly detection procedure comprises a first detection block and a second detection block, wherein the first detection block, the first control block, the second control block and the second detection block are sequentially arranged in the memory, and the first detection block and the second detection block are respectively used for enabling the first control block and the second control block to support the anomaly detection process.

8. The network switch of claim 1, wherein the memory is a ternary content addressable memory.

9. An anomaly detection method comprising:

receiving a plurality of packet data by a network switch;

Filtering the plurality of packet data according to an access control table by a memory in the network switch, and executing an anomaly detection process on the plurality of packet data according to an anomaly detection program;

If one of the time intervals has an abnormal event, the count value is increased, and no matter how many times of abnormal events occur in one time interval, the count value is increased by 1; the abnormal event is that the flow value of the plurality of packet data reaches the flow upper limit value; and

When the count value reaches the count threshold, an exception notification is issued to a processor in the network switch via the memory to cause the processor to perform an exception handling process on the plurality of packet data.