System and method and computer program for filtering using tree structure
    1.
    发明授权
    System and method and computer program for filtering using tree structure 失效
    使用树结构进行过滤的系统和方法以及计算机程序

    公开(公告)号:US06298340B1

    公开(公告)日:2001-10-02

    申请号:US09312148

    申请日:1999-05-14

    IPC分类号: G06F1730

    摘要: A classification system includes a software managed tree testing bits from a key which labels an item. The bits are chosen by application of the Choice Bit Algorithm to the Rules in a Database of Rules. A controller including logic parses an unknown Key for bits to be tested in the decision nodes of a binary tree. Tests dictated by the tree are conducted in a predetermined way until all but one Rule from the database or all but a few Rules from the database are eliminated from consideration, whereupon the Key is fully tested by the one remaining Rule or in a lattice constructed of the remaining plurality of Rules, to determine an action to enforce on the item. Certain compare tests are used in the binary tree for the case that otherwise identical or similar rules are applied to integer ranges of key values which do not fall upon power of 2 boundaries. Furthermore, some very frequently occurring rules in such final tests might be designated as secondary rules, the remaining rules designated as primary rules, the entire decision tree recalculated using only primary rules, and the primary rules then connected to secondary rules only when logically necessary by means of a system of pointers making use of relative priorities of rules.

    摘要翻译: 分类系统包括从标签项目的键的软件管理树测试位。 通过将选择位算法应用于规则数据库中的规则来选择位。 包含逻辑的控制器在二叉树的决策节点中解析要测试的位的未知密钥。 由树进行的测试以预定的方式进行,直到从数据库中除了一个规则之外的所有除了数据库中的所有规则或从数据库中除了少数几个规则之外的所有测试都被消除,由此Key被完整的一个规则或由 剩余的多个规则,以确定对该项目执行的操作。 在二叉树中使用某些比较测试,否则相同或相似的规则应用于不落在2边界的幂的关键值的整数范围。 此外,这些最终测试中的一些非常频繁出现的规则可能被指定为次要规则,剩余的规则被指定为主要规则,仅使用主要规则重新计算的整个决策树,然后仅在逻辑上必要时连接到次级规则的主要规则 使用指针的相对优先级的指针系统的手段。

    Network processor/software control architecture
    2.
    发明授权
    Network processor/software control architecture 失效
    网络处理器/软件控制架构

    公开(公告)号:US06898179B1

    公开(公告)日:2005-05-24

    申请号:US09544896

    申请日:2000-04-07

    CPC分类号: G06F15/17

    摘要: The transport protocol for communicating between general purpose processors acting as contact points and network processors in a packet processing environment such as Ethernet is provided. In such an environment, there is at least one single control point processor (CP) and a plurality of network processors (NP), sometimes referred to as blades. A typical system could contain two to sixteen network processors, and each network processor connects to a plurality of devices which communicate with each other over a network transport, such as Ethernet. The CP typically controls the functionality and the functioning of the network processors to function in a way that connects one end user with another, whether or not the end user is on the same network processor or a different network processor. There are three types of communication provided; first, there is communication generally referred to as control services and normally there will be only one pico processor which operates as a GCH (guided cell handler) and only one that operates as a guided tree handler (GTH). A path is provided for the controls to the GCH and the GTH commands, and a separate path is provided for the data frames between the GDH's (general data handler) and the CP.

    摘要翻译: 提供了用于在诸如以太网的分组处理环境中用作接触点的通用处理器和网络处理器之间进行通信的传输协议。 在这样的环境中,存在至少一个单个控制点处理器(CP)和多个网络处理器(NP),有时称为刀片。 典型的系统可以包含两到十六个网络处理器,并且每个网络处理器连接到通过诸如以太网的网络传输彼此通信的多个设备。 CP通常控制网络处理器的功能和功能,以使终端用户与另一终端用户相连的方式起作用,无论终端用户是否在同一个网络处理器或不同的网络处理器上。 提供三种通讯方式; 首先,通常被称为控制服务的通信,并且通常将只有一个微微处理器作为GCH(引导的单元处理器)操作,并且只有一个作为引导树处理器(GTH)操作。 为GCH和GTH命令的控制提供路径,并为GDH(通用数据处理程序)和CP之间的数据帧提供单独的路径。

    System method and computer program for prioritizing filter rules
    3.
    发明授权
    System method and computer program for prioritizing filter rules 失效
    用于优先排序过滤规则的系统方法和计算机程序

    公开(公告)号:US06484171B1

    公开(公告)日:2002-11-19

    申请号:US09540333

    申请日:2000-03-31

    IPC分类号: G06F1730

    摘要: This process accepts rule domination declarations and subjects rules to a computer program which either finds a type of administrative error (cyclic domination) or assigns a priority number to each rule so that any two rules which intersect (some key fits both rules) have necessarily different priority numbers. In the case that priority numbers are assigned, the process goes on to check for a second type of administrative error, namely inclusion of a first rule in a second (every key which fits the first rule also fits the second), and with the second having higher priority (so that the first is never referenced). If neither error occurs, then the number of different priority numbers is minimized. Every key when tested by such a rule set with neither error must fit either no rules at all or must fit exactly one rule with highest priority. In the latter case, the action of the unambiguously determined rule can then be applied to the packet represented by the key.

    摘要翻译: 该过程接受规则控制声明和主体规则到计算机程序,该计算机程序找到一种管理错误(循环统治)或为每个规则分配一个优先级号,以便相交的任何两个规则(一些关键符合两条规则)必然不同 优先级数字。 在分配优先级编号的情况下,进程继续检查第二种类型的管理错误,即在第二种类型中包括第一规则(适合第一规则的每个密钥也适合第二规则),并且与第二类 具有较高的优先级(使得第一个从未被引用)。 如果没有发生错误,则不同优先级号码的数量被最小化。 每个密钥通过既不具有错误的规则进行测试时,也不能完全符合任何规则,也不能完全符合一个具有最高优先级的规则。 在后一种情况下,明确确定的规则的动作可以应用于由密钥表示的分组。

    System, method and computer program for filtering multi-action rule set
    4.
    发明授权
    System, method and computer program for filtering multi-action rule set 失效
    用于过滤多动作规则集的系统,方法和计算机程序

    公开(公告)号:US06473763B1

    公开(公告)日:2002-10-29

    申请号:US09540921

    申请日:2000-03-31

    IPC分类号: G06F1730

    摘要: A method and system for testing a plurality of filter rules in a computer system is disclosed. The plurality of filter rules is used with a key. Each of the plurality of filter rules is capable of being described using a plurality of bits corresponding to a portion of the key. The plurality of bits can include at least one binary value, at least one wildcard, and at least one boundary symbol. The at least one binary value can be a zero or a one. The method and system include selecting a portion of the plurality of filter rules that the key can match by testing part of the key against a portion of the plurality of bits and explicitly testing the key against the portion of the plurality of filter rules. A first bit of the portion of the plurality of bits has a first maximum number of the at least one binary symbol for the plurality of filter rules. Each subsequent bit of the portion plurality of bits has a second maximum number of the at least one binary symbol for a plurality of remaining bits and is selected based on testing of a prior bit. Preferably, the portion of the plurality of bits is tested using a decision tree which includes nodes corresponding to a second portion of the plurality of bits.

    摘要翻译: 公开了一种用于测试计算机系统中的多个过滤规则的方法和系统。 多个过滤器规则与密钥一起使用。 多个滤波器规则中的每一个能够使用与密钥的一部分相对应的多个比特来描述。 多个比特可以包括至少一个二进制值,至少一个通配符和至少一个边界符号。 至少一个二进制值可以是零或一个。 所述方法和系统包括通过根据多个比特的一部分测试部分密钥来选择密钥可以匹配的多个过滤规则的一部分,并针对多个过滤规则的部分显式测试密钥。 多个位的部分的第一位具有用于多个滤波器规则的至少一个二进制符号的第一最大数目。 部分多个比特的每个后续比特具有多个剩余比特的至少一个二进制符号的第二最大数目,并且基于先前比特的测试来选择。 优选地,使用包括对应于多个比特的第二部分的节点的决策树来测试多个比特的部分。

    Method and system for downloading software managed trees in a network processing system
    5.
    发明授权
    Method and system for downloading software managed trees in a network processing system 失效
    在网络处理系统中下载软件管理树的方法和系统

    公开(公告)号:US06799207B1

    公开(公告)日:2004-09-28

    申请号:US09546343

    申请日:2000-04-10

    IPC分类号: G06F15173

    摘要: A method and system for downloading software managed trees (SMTs) in a network processing system provides dynamic update of frame classifiers while maintaining proper network protocol processing. The network processing system includes a general purpose processor acting as control point processor and a plurality of network processors. The new SMT is built by an application on the control point processor and downloaded to one or more of the network processors. The new SMT is placed in a separate memory location accessible to the network processors, rather then overwriting the existing SMT. The active tree pointers are then changed to transfer control to the new SMT.

    摘要翻译: 在网络处理系统中下载软件管理树(SMT)的方法和系统提供帧分类器的动态更新,同时保持适当的网络协议处理。 网络处理系统包括充当控制点处理器的通用处理器和多个网络处理器。 新的SMT由控制点处理器上的应用程序构建并下载到一个或多个网络处理器。 新的SMT放置在网络处理器可访问的单独内存位置,而不是覆盖现有的SMT。 然后更改活动树指针,将控件转移到新的SMT。

    Hybrid longest prefix match and fixed match searches
    6.
    发明授权
    Hybrid longest prefix match and fixed match searches 失效
    混合最长前缀匹配和固定匹配搜索

    公开(公告)号:US06792423B1

    公开(公告)日:2004-09-14

    申请号:US09723717

    申请日:2000-11-28

    IPC分类号: G06T1730

    摘要: A method and system for finding a longest matching prefix for an input keyword from among multiple prefixes. The prefixes are data strings of varying lengths wherein prefixes of length n or greater are probabilistically a longest prefix match. The method of the present invention begins by mapping the prefixes of length greater than or equal to n1, that is, in the interval [n1, L], into a first lookup system. Remaining prefixes of length less than n1 but greater than or equal to n2, that is, in the interval [n2, n1−1], are mapped into a second index utilizing a second hash function, wherein n2 is less than n1. Further lookup systems on prefixes having lengths in the intervals [n3, n2−1], [n4, n3−1], and so on, may also be utilized, as determined by optimization studies and the statistics of routing tables.

    摘要翻译: 一种用于从多个前缀中为输入关键字找到最长匹配前缀的方法和系统。 前缀是具有不同长度的数据串,其长度为n或更大的前缀概率地是最长前缀匹配。 本发明的方法首先将长度大于或等于n1的前缀,即间隔[n1,L]映射到第一查找系统中。 长度小于n1但大于或等于n2的剩余前缀,即在间隔[n2,n1-1]中,使用第二散列函数映射到第二索引,其中n2小于n1。 还可以利用在间隔[n3,n2-1],[n4,n3-1]等中具有长度的前缀上的进一步查找系统,如通过优化研究和路由表的统计确定的。

    Classification support system and method for fragmented IP packets
    8.
    发明授权
    Classification support system and method for fragmented IP packets 失效
    分片支持系统和分片IP分组的方法

    公开(公告)号:US07870278B2

    公开(公告)日:2011-01-11

    申请号:US12118090

    申请日:2008-05-09

    IPC分类号: G06F15/16 G06F7/00 H04L12/50

    摘要: A wire-speed forwarding platform and method for supporting multifield classification of a packet fragmented into a plurality of fragments in the wire-speed forwarding platform, comprising: receiving a fragment of the fragmented packet at the forwarding platform and deriving a key from one or more fields of the received fragment; and performing multifield classification of the received fragment by matching the key to a rule out of a plurality of rules, the rule comprising a plurality of fields including at least one field for specifying whether the received fragment's fragmentation characteristics are to be applied when performing the multifield classification.

    摘要翻译: 一种线速转发平台和方法,用于支持分片到线速转发平台中的多个片段的分组的多帧分类,包括:在转发平台处接收分片分组的片段,并从一个或多个 收到的片段的字段; 以及通过将所述密钥与多个规则中的规则进行匹配来对所接收的片段进行多字段分类,所述规则包括多个字段,所述多个字段包括至少一个字段,用于指定在执行所述多字段时是否应用所接收的片段的分片特征 分类。

    Configurable classification interface for networking devices supporting multiple action packet handling rules
    9.
    发明授权
    Configurable classification interface for networking devices supporting multiple action packet handling rules 失效
    支持多个动作包处理规则的网络设备的可配置分类界面

    公开(公告)号:US06772223B1

    公开(公告)日:2004-08-03

    申请号:US09546486

    申请日:2000-04-10

    IPC分类号: G06F15173

    CPC分类号: H04L29/06 H04L69/22

    摘要: A method and apparatus for defining the types of actions that are to be applied to packets processed by a network processor device such as an IP router, switch, and the like. The apparatus includes an interface for configuring a packet classifier device in the network processor by enabling user specification of packet classification rules, each rule having one or more action types, and further, by enabling definition of one or more associated set of action attributes (characteristics) that may be associated with individual action types.

    摘要翻译: 一种用于定义要应用于由诸如IP路由器,交换机等网络处理器设备处理的分组的动作的类型的方法和装置。 该装置包括用于通过使用户能够指定分组分类规则来配置网络处理器中的分组分类器设备的接口,每个规则具有一个或多个动作类型,并且还通过使得能够定义一个或多个相关联的动作属性集(特征 )可能与单个动作类型相关联。

    Classification support system and method for fragmented IP packets
    10.
    发明授权
    Classification support system and method for fragmented IP packets 失效
    分片支持系统和分片IP分组的方法

    公开(公告)号:US07403999B2

    公开(公告)日:2008-07-22

    申请号:US10034470

    申请日:2001-12-28

    IPC分类号: G06F15/16 G06F7/00 H04L12/50

    摘要: A wire-speed forwarding platform and method for supporting multifield classification of a packet fragmented into a plurality of fragments in the wire-speed forwarding platform, comprising: receiving a fragment of the fragmented packet at the forwarding platform and deriving a key from one or more fields of the received fragment; and performing multifield classification of the received fragment by matching the key to a rule out of a plurality of rules, the rule comprising a plurality of fields including at least one field for specifying whether the received fragment's fragmentation characteristics are to be applied when performing the multifield classification.

    摘要翻译: 一种线速转发平台和方法,用于支持分片到线速转发平台中的多个片段的分组的多帧分类,包括:在转发平台处接收分片分组的片段,并从一个或多个 收到的片段的字段; 以及通过将所述密钥与多个规则中的规则进行匹配来对所接收的片段进行多字段分类,所述规则包括多个字段,所述多个字段包括至少一个字段,用于指定在执行所述多字段时是否应用所接收的片段的分片特征 分类。