CN104426768B - A kind of data message forwarding method and device - Google Patents

Abstract

The embodiment of the invention discloses a data message forwarding method and device, which are used to improve the matching efficiency of the data message when performing flow table matching. The method in the embodiment of the present invention includes: acquiring the attribute identifier of the data message; searching for the first flow entry in the first flow table according to the attribute identifier, the first flow entry includes: an action set, and the action set is a kind of data Each attribute identifier of the message corresponds to the specified operation in the multi-level flow table; if the first flow entry is found successfully, the datagram is processed according to the action set corresponding to the first flow entry matching the attribute identifier The text is forwarded.

Description

A data message forwarding method and device

technical field

The invention relates to the communication field, in particular to a data message forwarding method and device.

Background technique

OpenFlow and Software Defined Networking (SDN, Software Defined Network) allow a network to be programmed as if it were a computer. It provides the abstraction layer of the physical network directly to the control element, allowing the network to be set up and operated through software. This will open the door for further innovation.

The OpenFlow technology was first proposed by Stanford University, aiming to solve the current problems of the current network in the face of new services based on the technical conditions of the existing Transmission Control Protocol/Internet Protocol (TCP/IP, Transmission Control Protocol/Internet Protocol) with innovative network interconnection concepts. Various bottlenecks have been rated as one of the top ten future technologies by the prestigious "MIT Technology Review" magazine. Its core idea is very simple, which is to transform the data packet forwarding process that was originally completely controlled by the switch/router into an independent process completed by the OpenFlow switch (OpenFlow switch) and the control server (Controller). Behind the transformation is actually the change of control rights: the flow direction of data packets in traditional networks is artificially designated. Although switches and routers have control rights, they do not have the concept of data packets, and only exchange at the level of data packets; In the OpenFlow network, the unified control server replaces the router and determines the transmission path of all data packets in the network. The OpenFlow switch will maintain a flow table (Flow Table) that is different from the flow table locally. If the data packet to be forwarded has a corresponding item in the flow table, it will directly perform fast forwarding; if there is no item in the flow table, the data packet The text will be sent to the control server to confirm the transmission path, and then forwarded according to the sending result.

The OpenFlow version has evolved from OFP1.0 to OFP1.2. It mainly expands several important features such as multi-controller, multi-flow table, and group table. The multi-flow table allows the controller to divide different services into different tables for processing. At the same time, the feature of multiple flow tables also increases the difficulty of hardware to implement fast forwarding, as well as the forwarding delay. The main reasons are: 1. There is a sequence requirement among multiple flow tables; 2. When each data packet is transferred between standards, the matching field will change. (applyinstruction+set field, write metadata); 3. The above relationship makes it impossible for multiple tables to be decoupled and searched concurrently.

Run an OpenFlow switch software on the host to support information exchange with the Controller and flow table management. At the same time, part of the data table lookup and forwarding function of the data plane is transferred to a field-programmable gate array (FPGA, Field-Programmable Gate Array) board. The capability of the system is effectively improved by utilizing the tri-state content addressable memory (TCAM, ternary content addressable memory) search function of the hardware and the concurrent processing capability of the hardware. Although this solution puts a subset of the flow table of the switch in the hardware board to work. However, due to the limitation of TCAM resources, the number of flow entries it supports is limited. At the same time, directly using the method to accelerate the hardware of multiple flow tables needs to add multiple lookup tables and execution engines, which is relatively expensive.

Contents of the invention

The embodiment of the present invention provides a data message forwarding method and device, which are used to improve the matching efficiency of the data message when performing flow table matching.

The data packet forwarding method provided in the first aspect of the embodiments of the present invention includes:

Obtain the attribute identification of the data message; search the first flow entry in the first flow table according to the attribute identification, the first flow entry includes: an action set, and the action set is that each attribute identification of a data message is in the A set of corresponding specified operations in the multi-level flow table; if the first flow entry is successfully searched, the data packet is forwarded according to the action set corresponding to the first flow entry matching the attribute identifier.

In a first possible implementation manner of the first aspect, the first flow entry further includes: an exact match domain;

The searching for the first flow entry in the first flow table according to the attribute identification includes:

Find an exact matching field that matches each attribute identifier of the data packet in the first flow table, and the first flow entry corresponding to the exact matching field is the first flow entry to be searched.

In a second possible implementation manner of the first aspect, after searching the first flow entry in the first flow table according to the attribute identifier, it includes:

If the lookup of the first flow entry fails, search for the second flow entry in the multi-level second flow table sequentially according to the attribute identifier, and sequentially perform operations on the data according to the specified operations in each of the second flow entries. The packet is forwarded, and the first flow entry is generated according to each of the found second flow entries, and the first flow entry is recorded in the first flow table.

With reference to the second possible implementation of the first aspect, in a third possible implementation of the first aspect, the second flow entry includes: a wildcard matching domain and a specified operation;

The generating the first flow entry according to each found second flow entry includes:

After sequentially forwarding the data packet according to the specified operations in each of the second flow entries, record the executed specified operations to obtain an action set of the data packet;

Analyzing the data message to obtain the exact matching field of the data message;

Generate a first flow entry corresponding to the data packet according to the action set of the data packet and the exact matching field.

With reference to the second possible implementation of the first aspect, in a fourth possible implementation of the first aspect, after generating the first flow entry according to each of the found second flow entries, include :

When the second flow entry in the second flow table is aged, delete the first flow entry associated with the second flow entry in the first flow table;

or,

When the second flow entry in the second flow table is modified, delete the first flow entry associated with the second flow entry in the first flow table;

or,

When the second flow entry in the second flow table is deleted, delete the first flow entry associated with the second flow entry in the first flow table;

or,

When adding a new second flow entry in the second flow table, detecting whether the priority of the first flow entry associated with the second flow table in the first flow table is lower than that of the newly added second flow entry, if , then delete the first flow entry associated with the second flow table in the first flow table.

With reference to the second possible implementation of the first aspect, in a fifth possible implementation of the first aspect, after generating the first flow entry according to each of the found second flow entries, include :

Sending the traffic statistics message of the first flow table to the second flow table in real time or regularly, so that the second flow table records the traffic of the data packet according to the traffic statistics message, and updates the corresponding second flow table The idle time of the flow entry.

The switch provided by the second aspect of the embodiment of the present invention includes:

A data acquisition unit, configured to acquire the attribute identification of the data message;

A matching search unit, configured to search for a first flow entry in the first flow table according to the attribute identification, the first flow entry includes: an action set, the action set is a multi-level identification of each attribute of a data packet A set of corresponding specified operations in the flow table;

A forwarding unit, configured to forward the data message according to the action set corresponding to the first flow entry matching the attribute identifier if the first flow entry is searched successfully.

In a first possible implementation manner of the second aspect, the matching search unit is specifically configured to:

Find an exact matching field that matches each attribute identifier of the data packet in the first flow table, and the first flow entry corresponding to the exact matching field is the first flow entry to be searched.

In a second possible implementation manner of the second aspect, the switch further includes:

A flow table generation unit, configured to search for second flow entries in the multi-level second flow table sequentially according to the attribute identification if the search for the first flow entry fails, and sequentially according to each of the second flow entries After the specified operation in the method forwards the data packet, the first flow entry is generated according to each of the found second flow entries, and the first flow entry is recorded in the first flow table.

With reference to the second possible implementation of the second aspect, in a third possible implementation of the second aspect, the flow table generation unit includes:

An operation recording module, configured to, after sequentially forwarding the data message according to the specified operation in each of the second flow entries, record the specified operation performed to obtain an action set of the data message;

A message analysis module, configured to analyze the data message to obtain an exact matching domain of the data message;

A flow table generating module, configured to generate a first flow entry corresponding to the data message according to the action set of the data message and the exact matching field.

With reference to the second possible implementation manner of the second aspect, in a fourth possible implementation manner of the second aspect, the switch further includes:

A flow entry deletion unit, configured to delete the first flow entry associated with the second flow entry in the first flow table when the second flow entry in the second flow table is aged; or, when the second When the second flow entry in the flow table is modified, delete the first flow entry associated with the second flow entry in the first flow table; or, when the second flow entry in the second flow table is deleted , deleting the first flow entry associated with the second flow entry in the first flow table; or, when adding a new second flow entry in the second flow table, detecting the first flow entry in the first flow table associated with the second flow entry Whether the priority of the first flow entry associated with the second flow table is lower than that of the newly added second flow entry, and if so, delete the first flow entry associated with the second flow table in the first flow table.

With reference to the second possible implementation of the second aspect, in a fifth possible implementation of the second aspect, the switch further includes: a synchronization unit, configured to send the The traffic statistics message of the first flow table enables the second flow table to record the traffic of the data packet according to the traffic statistics message, and update the idle time of the corresponding second flow entry.

It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

In the embodiment of the present invention, the specified operations corresponding to each attribute identifier of a data message in the multi-level flow table are combined into an action set, and the action sets corresponding to various data messages are stored in the first flow table, In the process of flow table matching, the first flow table is preferentially searched for a flow entry, and if the first flow entry is found successfully, the action set corresponding to the first flow entry matched with the attribute identifier is executed The data message is forwarded, so that the flow table matching search process of the data message can be completed at one time, without matching each flow table level by level, and the efficiency of data message forwarding is improved.

Description of drawings

FIG. 1 is a schematic flow diagram of a data packet forwarding method according to an embodiment of the present invention;

FIG. 2 is another schematic flowchart of a data packet forwarding method according to an embodiment of the present invention;

FIG. 3 is another schematic flowchart of a data packet forwarding method according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a logical structure of a switch according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a computer device in an embodiment of the present invention.

Detailed ways

The embodiment of the present invention provides a data message forwarding method and device, which are used to improve the matching efficiency of the data message when performing flow table matching.

Referring to Fig. 1, an embodiment of the data packet forwarding method in the embodiment of the present invention includes:

101. Obtain the attribute identifier of the data message;

The switch obtains the attribute identifier of the data message; the attribute identifier may specifically include: source MAC address, destination MAC address, Ethernet type, source IP address, destination IP address, and the like.

102. Search for a first flow entry in the first flow table according to the attribute identifier;

The switch searches for the first flow entry in the first flow table according to the attribute identifier, and the first flow entry includes: an action set, and the action set is that each attribute identifier of a data packet corresponds to each in the multi-level flow table The specified operation; if the first flow entry is found successfully, step 103 is executed.

In practical applications, the specified operation may be: forwarding data from a port, or modifying a specific field (such as: destination IP address), etc.

In the existing multi-level flow table matching process, each time a flow table entry is successfully found, the switch will perform the specified operation corresponding to the flow table entry on the data packet; in practical applications, a data packet enters the After the switch, no matter how many times the data message has been checked in the switch and what changes have been made, the execution result of the same flow is the same every time; therefore, in the embodiment of the present invention, the The specified operations corresponding to each attribute identifier in the multi-level flow table are combined into an action set, and the action sets corresponding to various data packets are stored in the first flow table. During the flow table matching process, priority is given to the first flow table Find flow entries in .

103. Forward the data packet according to the action set corresponding to the first flow entry matching the attribute identifier.

When the first flow entry corresponding to the data packet is found in the first flow table, the switch forwards the data packet according to an action set corresponding to the first flow entry matching the attribute identifier.

In the embodiment of the present invention, the specified operations corresponding to each attribute identifier of a data message in the multi-level flow table are combined into an action set, and the action sets corresponding to various data messages are stored in the first flow table, In the process of flow table matching, the first flow table is preferentially searched for a flow entry, and if the first flow entry is found successfully, the action set corresponding to the first flow entry matched with the attribute identifier is executed The data message is forwarded, so that the flow table matching search process of the data message can be completed at one time, without matching each flow table level by level, and the efficiency of data message forwarding is improved.

In practical applications, there may be data packets that are not recognized by the switch. Such data packets do not have corresponding action sets stored in the switch. The embodiment of the present invention proposes a corresponding solution. Please refer to Figure 2 for details. Another embodiment of the data packet forwarding method in the embodiment of the invention includes:

201. Obtain the attribute identifier of the data message;

The switch obtains the attribute identifier of the data message; the attribute identifier may specifically include: source MAC address, destination MAC address, Ethernet type, source IP address, destination IP address, and the like.

202. Search for a first flow entry in the first flow table according to the attribute identifier;

The switch searches for the first flow entry in the first flow table according to the attribute identifier, and the first flow entry includes: an action set, and the action set is that each attribute identifier of a data packet corresponds to each in the multi-level flow table specified operation.

If the search for the first flow entry is successful, execute step 203;

If the lookup of the first flow entry fails, step 204 is performed.

In practical applications, the first flow entry includes an exact match field, and the exact match field is composed of multiple wildcard match fields, and the multiple wildcard match fields respectively correspond to attribute identifiers of a type of data packet. Exemplarily, the search process of the first flow entry may specifically be: searching the first flow table for an exact matching field that matches each attribute identifier of the data packet, and the first flow entry corresponding to the exact matching field is The first flow entry to look up.

203. Forward the data packet according to an action set corresponding to the first flow entry matching the attribute identifier;

When the first flow entry corresponding to the data packet is found in the first flow table, the switch forwards the data packet according to an action set corresponding to the first flow entry matching the attribute identifier.

204. Search for the second flow entry in the multi-level second flow table sequentially according to the attribute identifier;

When the first flow table entry corresponding to the data packet cannot be found in the first flow table, the switch sequentially searches the second flow table item in the multi-level second flow table according to the attribute identifier, and sequentially according to each of the second flow table entries The specified operation in the flow entry forwards the data packet, and step 205 is executed.

The second flow entry includes: a wildcard matching field, and a specified operation corresponding to the wildcard matching field.

205. Generate the first flow entry according to each of the found second flow entries.

When the switch forwards the data packet according to the specified operation in each of the second flow entries, the switch generates the first flow entry according to each of the found second flow entries, and sends The first flow entry is recorded in the first flow table. After the first flow entry corresponding to the data packet is generated, when the switch receives the same type of data packet next time, it can directly complete the process of searching the flow entry and forwarding in the first flow table.

Exemplarily, the generation process of the first flow entry may specifically be: after the second flow entry of the target is found, record the wildcard matching domain and the specified operation corresponding to the second flow entry; The wildcard matching fields corresponding to the second flow entries are merged into an exact matching field, and the specified operations corresponding to each of the second flow entries are combined into an action set to generate the first flow entry corresponding to the data packet.

It can be understood that the first process in the embodiment of the present invention is relative to the second process, that is, relative to the second process, the first process is a fast forwarding table (that is, the speed at which data packets are forwarded) faster than the second flow table); that is, relative to the first flow, the second flow is a slow forwarding table. The first flow entry is a flow entry corresponding to the first flow, and the second flow entry is a flow entry corresponding to the second flow.

In the embodiment of the present invention, after a data message has been searched once, the search of the first flow table can be used to replace the search of the multi-level second flow table, which improves the efficiency of data message forwarding.

For ease of understanding, the data packet forwarding method in the embodiment of the present invention is described in detail below, please refer to FIG. 3, another embodiment of the data packet forwarding method in the embodiment of the present invention includes:

301. Obtain the attribute identifier of the data message;

The switch obtains the attribute identifier of the data message; the attribute identifier may specifically include: source MAC address, destination MAC address, Ethernet type, source IP address, destination IP address, and the like.

In the embodiment of the present invention, the flow table in the switch is divided into a first flow table and a second flow table, wherein, the slow forwarding surface of the switch (the forwarding surface corresponding to the second flow table) realizes the flow table structure of OpenFlow, and the Controller The interaction between and the management of the flow table.

302. Search for a first flow entry in the first flow table according to the attribute identifier;

The switch searches for the first flow entry in the first flow table according to the attribute identifier, and the first flow entry includes: an action set, and the action set is that each attribute identifier of a data packet corresponds to each in the multi-level flow table specified operation. In practical applications, the specified operation may be: forwarding data from a port, or modifying a specific field (such as: destination IP address), etc.

If the search for the first flow entry is successful, execute step 303;

If the lookup of the first flow entry fails, step 304 is performed.

In practical applications, the first flow entry includes an exact match field, and the exact match field is composed of multiple wildcard match fields, and the multiple wildcard match fields respectively correspond to attribute identifiers of a type of data packet. Exemplarily, the search process of the first flow entry may specifically be: searching the first flow table for an exact matching field that matches each attribute identifier of the data packet, and the first flow entry corresponding to the exact matching field is The first flow entry to look up.

303. Forward the data packet according to an action set corresponding to the first flow entry matching the attribute identifier;

When the first flow entry corresponding to the data packet is found in the first flow table, the switch forwards the data packet according to an action set corresponding to the first flow entry matching the attribute identifier.

304. Search for the second flow entry in the multi-level second flow table sequentially according to the attribute identifier;

When the first flow table entry corresponding to the data packet cannot be found in the first flow table, the switch sequentially searches the second flow table item in the multi-level second flow table according to the attribute identifier, and sequentially according to each of the second flow table entries The specified operation in the flow entry forwards the data packet, and step 205 is executed.

The second flow entry includes: a wildcard matching field, and a specified operation corresponding to the wildcard matching field.

305. Generate the first flow entry according to each of the found second flow entries;

When the switch forwards the data packet according to the specified operation in each of the second flow entries, the switch generates the first flow entry according to each of the found second flow entries, and sends The first flow entry is recorded in the first flow table. After the first flow entry corresponding to the data packet is generated, when the switch receives the same type of data packet next time, it can directly complete the process of searching the flow entry and forwarding in the first flow table.

Exemplarily, after the data message enters the slow forwarding plane, during the first forwarding process, the slow forwarding plane records the actions performed by the switch on the data message. These actions are converted into an action set (action list group), and the action list group is downloaded to the fast forwarding plane (the forwarding plane corresponding to the first flow table) together with the exact match field.

Since the controller can only know the information of the slow forwarding plane but not the fast forwarding plane, it is necessary to associate the two tables of the fast forwarding plane and the slow forwarding plane. Specifically, the first flow entry in each first flow table is associated with N second flow entries in the surface table (N is the number of the second flow table), and the first flow entry in the first flow table is not actively aged. When the second flow entry in the second flow table is aged out, the first flow entry associated with the second flow entry is deleted at the same time. The same second flow entry in the second flow table may be referenced by multiple first flow entries in the first flow table, so a referenced link list structure is established in the second flow entry of each slow forwarding plane. The first flow entry in the first flow table references at most N second flow entries in the second flow table, and the full table represents N reference marks. In practical applications, each flow table has a life cycle, and it does not work for a period of time, or it does not work after a certain amount of time; the aging refers to reducing the long-term occupied space of useless flow tables in the switch, Think of it as garbage removal.

306. Send the traffic statistics message of the first flow table to the second flow table in real time or periodically;

The switch sends the traffic statistics message of the first flow table to the second flow table in real time or regularly, so that the second flow table records the traffic of the data packet according to the traffic statistics message, and updates the corresponding first flow table The idle time of the second-stream entry.

In practical applications, since the data packets directly pass through the first flow table without passing through the second flow table, the second flow table cannot know the traffic of the data packets; The traffic statistics message of the first flow table, so that the second flow table records the traffic of the data packet according to the traffic statistics message, and the first flow table can clear the local traffic statistics after sending.

In practical applications, since data packets directly pass through the first flow table without passing through the second flow table, the idle time in the second flow table is aged; therefore, the switch will send the second flow table to the second flow table in real time or at regular intervals. The traffic statistics message of the first flow table enables the second flow table to update the idle time of the corresponding second flow entry according to the traffic statistics message.

307. Operate and manage the first flow table and the second flow table.

When the second flow entry in the second flow table is aged, delete the first flow entry associated with the second flow entry in the first flow table;

or,

When the second flow entry in the second flow table is modified, delete the first flow entry associated with the second flow entry in the first flow table;

or,

When the second flow entry in the second flow table is deleted, delete the first flow entry associated with the second flow entry in the first flow table;

or,

When a new second flow entry is added to the second flow table, since the newly added second flow entry may cause a change in the flow rule, the switch will detect the flow associated with the second flow table in the first flow table Whether the priority of the first flow entry is lower than that of the newly added second flow entry, and if so, delete the first flow entry associated with the second flow table in the first flow table.

The application scenarios in the embodiments of the present invention are described above using only some examples, and it can be understood that in actual applications, there may be more application scenarios, which are not specifically limited here.

An embodiment of the switch of the present invention for performing the above-mentioned data message forwarding method is described below. Please refer to FIG. 4 for its logical structure. An embodiment of the switch in the embodiment of the present invention includes:

A data acquisition unit 401, configured to acquire an attribute identifier of a data message;

A matching search unit 402, configured to search for a first flow entry in the first flow table according to the attribute identifier, the first flow entry includes: an action set, the action set is that each attribute identifier of a data packet is in multiple The corresponding specified operations in the level flow table;

The forwarding unit 403 is configured to forward the data packet according to the action set corresponding to the first flow entry matching the attribute identifier if the first flow entry is searched successfully.

Further, in the embodiment of the present invention, the matching search unit 402 is specifically configured to search the first flow table for an exact matching field that matches each attribute identifier of the data packet, and the first flow corresponding to the exact matching field The entry is the first flow entry to be searched.

Further, in the embodiment of the present invention, the switch further includes:

The flow table generation unit 404 is configured to search for the second flow table item in the multi-level second flow table sequentially according to the attribute identification if the search of the first flow table item fails, and sequentially according to each of the second flow table items After the specified operation in the item forwards the data packet, generate the first flow entry according to each of the found second flow entries, and record the first flow entry in the first flow table .

Further, in the embodiment of the present invention, the flow table generation unit 404 includes:

An operation recording module 4041, configured to record the specified operations performed after sequentially forwarding the data packets according to the specified operations in each of the second flow entries, and obtain an action set of the data packets ;

A message analysis module 4042, configured to analyze the data message to obtain the exact matching field of the data message;

A flow table generation module 4043, configured to generate a first flow entry corresponding to the data packet according to the action set of the data packet and the exact matching field.

Further, in the embodiment of the present invention, the switch further includes:

The flow entry deletion unit 405 is configured to delete the first flow entry associated with the second flow entry in the first flow table when the second flow entry in the second flow table is aged; or, when the second flow entry is aged When the second flow entry in the second flow table is modified, delete the first flow entry associated with the second flow entry in the first flow table; or, when the second flow entry in the second flow table is modified When deleting, delete the first flow entry associated with the second flow entry in the first flow table; or, when adding a new second flow entry in the second flow table, detect the connection between the first flow table and the second flow entry Whether the priority of the first flow entry associated with the second flow table is lower than that of the newly added second flow entry, and if so, delete the first flow entry associated with the second flow table in the first flow table.

Further, in the embodiment of the present invention, the switch further includes:

a synchronizing unit 406, configured to send the traffic statistics message of the first flow table to the second flow table in real time or periodically, so that the second flow table records the traffic of the data packet according to the traffic statistics message, And update the idle time of the corresponding second flow entry.

The following is a detailed description of the interaction of the above-mentioned unit modules:

The data acquiring unit 401 acquires the attribute identifier of the data message; the attribute identifier may specifically include: source MAC address, destination MAC address, Ethernet type, source IP address, destination IP address, and the like.

The matching search unit 402 searches for a first flow entry in the first flow table according to the attribute identification, the first flow entry includes: an action set, and the action set is each attribute identification of a data packet in the multi-level flow table specified operations respectively corresponding to the above; if the first flow entry is searched successfully, the forwarding unit 403 is executed. If the lookup of the first flow entry fails, the flow table generation unit 404 is executed.

In practical applications, the specified operation may be: forwarding data from a port, or modifying a specific field (such as: destination IP address), etc.

In practical applications, the first flow entry includes an exact match field, and the exact match field is composed of multiple wildcard match fields, and the multiple wildcard match fields respectively correspond to attribute identifiers of a type of data packet. Exemplarily, the search process of the first flow entry may specifically be: searching the first flow table for an exact matching field that matches each attribute identifier of the data packet, and the first flow entry corresponding to the exact matching field is The first flow entry to look up.

In the existing multi-level flow table matching process, each time a flow table entry is successfully found, the switch will perform the specified operation corresponding to the flow table entry on the data packet; in practical applications, a data packet enters the After the switch, no matter how many times the data message has been checked in the switch and what changes have been made, the execution result of the same flow is the same every time; therefore, in the embodiment of the present invention, the The specified operations corresponding to each attribute identifier in the multi-level flow table are combined into an action set, and the action sets corresponding to various data packets are stored in the first flow table. During the flow table matching process, priority is given to the first flow table Find flow entries in .

When the first flow entry corresponding to the data packet is found in the first flow table, the forwarding unit 403 forwards the data packet according to an action set corresponding to the first flow entry matching the attribute identifier.

When the first flow entry corresponding to the data message cannot be found in the first flow table, the flow table generating unit 404 sequentially searches for the second flow entry in the multi-level second flow table according to the attribute identifier, and sequentially according to each The specified operation in the second flow table entry forwards the data message, and while performing the forwarding operation on the data message according to the specified operation in each of the second flow table items, the switch according to the found Each of the second flow entries generates the first flow entry, and records the first flow entry in the first flow table. After the first flow entry corresponding to the data packet is generated, when the switch receives the same type of data packet next time, it can directly complete the process of searching the flow entry and forwarding in the first flow table.

Exemplarily, the generation process of the first flow entry may specifically be: after the second flow entry of the target is found, record the wildcard matching domain and the specified operation corresponding to the second flow entry; The wildcard matching fields corresponding to the second flow entries are merged into an exact matching field, and the specified operations corresponding to each of the second flow entries are combined into an action set to generate the first flow entry corresponding to the data packet.

It can be understood that the first process in the embodiment of the present invention is relative to the second process, that is, relative to the second process, the first process is a fast forwarding table (that is, the speed at which data packets are forwarded) faster than the second flow table); that is, relative to the first flow, the second flow is a slow forwarding table. The first flow entry is a flow entry corresponding to the first flow, and the second flow entry is a flow entry corresponding to the second flow.

In the embodiment of the present invention, after a data message has been searched once, the search of the first flow table can be used to replace the search of the multi-level second flow table, which improves the efficiency of data message forwarding.

Further, in the process of generating the flow table, the operation recording module 4041 may record the specified operations performed after sequentially forwarding the data packets according to the specified operations in each of the second flow entries, and obtain the The action set of the data message; then analyze the data message by the message analysis module 4042 to obtain the exact matching domain of the data message; finally, the flow table generation module 4043 according to the action set of the data message Generate a first flow entry corresponding to the data packet with the exact match field.

Exemplarily, after the data message enters the slow forwarding plane, during the first forwarding process, the slow forwarding plane records the actions performed by the switch on the data message. These actions are converted into an action set (action list group), and the action list group is downloaded to the fast forwarding plane (the forwarding plane corresponding to the first flow table) together with the exact match field.

Since the controller can only know the information of the slow forwarding plane but not the fast forwarding plane, it is necessary to associate the two tables of the fast forwarding plane and the slow forwarding plane. Specifically, the first flow entry in each first flow table is associated with N second flow entries in the surface table (N is the number of the second flow table), and the first flow entry in the first flow table is not actively aged. When the second flow entry in the second flow table is aged out, the first flow entry associated with the second flow entry is deleted at the same time. The same second flow entry in the second flow table may be referenced by multiple first flow entries in the first flow table, so a referenced link list structure is established in the second flow entry of each slow forwarding plane. The first flow entry in the first flow table references at most N second flow entries in the second flow table, and the full table represents N reference marks. In practical applications, each flow table has a life cycle, and it does not work for a period of time, or it does not work after a certain amount of time; the aging refers to reducing the long-term occupied space of useless flow tables in the switch, Think of it as garbage removal.

The synchronization unit 406 sends the traffic statistics message of the first flow table to the second flow table in real time or regularly, so that the second flow table records the traffic of the data packet according to the traffic statistics message, and updates the corresponding The idle time of the second flow entry.

In practical applications, since the data packets directly pass through the first flow table without passing through the second flow table, the second flow table cannot know the traffic of the data packets; The traffic statistics message of the first flow table, so that the second flow table records the traffic of the data packet according to the traffic statistics message, and the first flow table can clear the local traffic statistics after sending.

In practical applications, since data packets directly pass through the first flow table without passing through the second flow table, the idle time in the second flow table is aged; therefore, the switch will send the second flow table to the second flow table in real time or at regular intervals. The traffic statistics message of the first flow table enables the second flow table to update the idle time of the corresponding second flow entry according to the traffic statistics message.

Further, the switch in the embodiment of the present invention can also delete the flow entry through the flow entry deletion unit 405. Specifically, when the second flow entry in the second flow table is aged out, delete the flow entry in the first flow table. the first flow entry associated with the second flow entry; or, when the second flow entry in the second flow table is modified, delete the first flow entry associated with the second flow entry in the first flow table the first flow entry; or, when the second flow entry in the second flow table is deleted, delete the first flow entry associated with the second flow entry in the first flow table; or, when the second flow When adding a new second flow table entry in the table, detect whether the priority of the first flow table entry associated with the second flow table in the first flow table is lower than that of the newly added second flow table entry, and if so, delete the first flow table entry A first flow entry associated with the second flow table in the flow table.

Referring to Fig. 5, an embodiment of the present invention also provides a switch, which may include:

Input device 501, output device 502, memory 503 and processor 504 (the number of processors in the switch can be one or more, one processor is taken as an example in Fig. 5) In some embodiments of the present invention, the input device 501, an output device 502, a memory 503, and a processor 504 may be connected through a bus or in other ways, where connection through a bus is used as an example in FIG. 5 .

Wherein, the processor 504 performs the following steps:

After the input device 501 obtains the attribute identifier of the data packet, it searches the first flow table for the first flow entry according to the attribute identifier, and the first flow entry includes: an action set, the action set is a data packet Each attribute of identifies the corresponding specified operation in the multi-level flow table. In practical applications, the specified operation may be: forwarding data from a port, or modifying a specific field (such as: destination IP address), etc.

If the first flow entry is searched successfully, the trigger output device 502 forwards the data packet according to the action set corresponding to the first flow entry matching the attribute identifier;

If the lookup of the first flow entry fails, the second flow entry is sequentially searched in the multi-level second flow table according to the attribute identifier, and the trigger output device 502 sequentially performs operations according to the specified operation in each of the second flow entries Forward the data packet.

When the switch forwards the data packet according to the specified operation in each of the second flow entries, the switch generates the first flow entry according to each of the found second flow entries, and sends The first flow entry is recorded in the first flow table. After the first flow entry corresponding to the data packet is generated, when the switch receives the same type of data packet next time, it can directly complete the process of searching the flow entry and forwarding in the first flow table.

In practical applications, the first flow entry includes an exact match field, and the exact match field is composed of multiple wildcard match fields, and the multiple wildcard match fields respectively correspond to attribute identifiers of a type of data packet. Exemplarily, the search process of the first flow entry may specifically be: searching the first flow table for an exact matching field that matches each attribute identifier of the data packet, and the first flow entry corresponding to the exact matching field is The first flow entry to look up.

Since the controller can only know the information of the slow forwarding plane but not the fast forwarding plane, it is necessary to associate the two tables of the fast forwarding plane and the slow forwarding plane. Specifically, the first flow entry in each first flow table is associated with N second flow entries in the surface table (N is the number of the second flow table), and the first flow entry in the first flow table is not actively aged. When the second flow entry in the second flow table is aged out, the first flow entry associated with the second flow entry is deleted at the same time. The same second flow entry in the second flow table may be referenced by multiple first flow entries in the first flow table, so a referenced link list structure is established in the second flow entry of each slow forwarding plane. The first flow entry in the first flow table references at most N second flow entries in the second flow table, and the full table represents N reference marks. In practical applications, each flow table has a life cycle, and it does not work for a period of time, or it does not work after a certain amount of time; the aging refers to reducing the long-term occupied space of useless flow tables in the switch, Think of it as garbage removal.

Further, the switch sends the traffic statistics message of the first flow table to the second flow table in real time or regularly, so that the second flow table records the traffic of the data packet according to the traffic statistics message, and updates The idle time of the corresponding second flow entry.

In practical applications, since the data packets directly pass through the first flow table without passing through the second flow table, the second flow table cannot know the traffic of the data packets; The traffic statistics message of the first flow table, so that the second flow table records the traffic of the data packet according to the traffic statistics message, and the first flow table can clear the local traffic statistics after sending.

In practical applications, since data packets directly pass through the first flow table without passing through the second flow table, the idle time in the second flow table is aged; therefore, the switch will send the second flow table to the second flow table in real time or at regular intervals. The traffic statistics message of the first flow table enables the second flow table to update the idle time of the corresponding second flow entry according to the traffic statistics message.

When the second flow entry in the second flow table is aged, delete the first flow entry associated with the second flow entry in the first flow table; or, when the second flow table in the second flow table When the item is modified, delete the first flow entry associated with the second flow entry in the first flow table; or, when the second flow entry in the second flow table is deleted, delete the first flow table associated with the The first flow entry associated with the second flow entry or, when a new second flow entry is added to the second flow table, since the newly added second flow entry may cause a change in the flow rule, the switch It will detect whether the priority of the first flow entry associated with the second flow table in the first flow table is lower than that of the newly added second flow table entry, and if so, delete the first flow table related to the second flow table The first flow entry of the association.

Wherein, the content stored in the memory 503 includes: the attribute identifier may specifically include: source MAC address, destination MAC address, Ethernet type, source IP address, destination IP address, and the like. The specified operation may be: forwarding data from a port, or modifying a specific field (such as: destination IP address), etc. The second flow entry includes: a wildcard matching field, and a specified operation corresponding to the wildcard matching field.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, and other media that can store program codes.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. A data packet forwarding method, characterized in that, comprising: Obtain the attribute identifier of the data packet; Search the first flow entry in the first flow table according to the attribute identification, the first flow entry includes: an action set, the action set is the corresponding designation of each attribute identification of a data packet in the multi-level flow table collection of operations; If the first flow entry is searched successfully, forward the data message according to the action set corresponding to the first flow entry matching the attribute identifier; If the lookup of the first flow entry fails, search for the second flow entry in the multi-level second flow table sequentially according to the attribute identifier, and sequentially perform operations on the data according to the specified operations in each of the second flow entries. The packet is forwarded, and the first flow entry is generated according to each of the found second flow entries, and the first flow entry is recorded in the first flow table. 2. The method of claim 1, wherein, The first flow entry further includes: an exact match domain; The searching for the first flow entry in the first flow table according to the attribute identification includes: Find an exact matching field that matches each attribute identifier of the data packet in the first flow table, and the first flow entry corresponding to the exact matching field is the first flow entry to be searched. 3. The method according to claim 1, wherein the second flow entry includes: a wildcard matching domain and a specified operation; The generating the first flow entry according to each found second flow entry includes: After sequentially forwarding the data packet according to the specified operations in each of the second flow entries, record the executed specified operations to obtain an action set of the data packet; Analyzing the data message to obtain the exact matching field of the data message; Generate a first flow entry corresponding to the data packet according to the action set of the data packet and the exact matching field. 4. The method according to claim 1, wherein after generating the first flow entry according to each of the found second flow entries, the method comprises: When the second flow entry in the second flow table is aged, delete the first flow entry associated with the second flow entry in the first flow table; or, When the second flow entry in the second flow table is modified, delete the first flow entry associated with the second flow entry in the first flow table; or, When the second flow entry in the second flow table is deleted, delete the first flow entry associated with the second flow entry in the first flow table; or, When adding a new second flow entry in the second flow table, detecting whether the priority of the first flow entry associated with the second flow table in the first flow table is lower than that of the newly added second flow entry, if , then delete the first flow entry associated with the second flow table in the first flow table. 5. The method according to claim 1, wherein after generating the first flow entry according to each of the found second flow entries, the method comprises: Sending the traffic statistics message of the first flow table to the second flow table in real time or regularly, so that the second flow table records the traffic of the data packet according to the traffic statistics message, and updates the corresponding second flow table The idle time of the flow entry. 6. A switch, characterized in that, comprising: A data acquisition unit, configured to acquire the attribute identification of the data message; A matching search unit, configured to search for a first flow entry in the first flow table according to the attribute identification, the first flow entry includes: an action set, the action set is a multi-level identification of each attribute of a data packet A set of corresponding specified operations in the flow table; A forwarding unit, configured to forward the data packet according to the action set corresponding to the first flow entry matching the attribute identifier if the first flow entry is searched successfully; A flow table generation unit, configured to search for second flow entries in the multi-level second flow table sequentially according to the attribute identification if the search for the first flow entry fails, and sequentially according to each of the second flow entries After the specified operation in the method forwards the data packet, the first flow entry is generated according to each of the found second flow entries, and the first flow entry is recorded in the first flow table. 7. The switch according to claim 6, wherein the matching search unit is specifically used for: Find an exact matching field that matches each attribute identifier of the data packet in the first flow table, and the first flow entry corresponding to the exact matching field is the first flow entry to be searched. 8. The switch according to claim 6, wherein the flow table generating unit comprises: An operation recording module, configured to, after sequentially forwarding the data message according to the specified operation in each of the second flow entries, record the specified operation performed to obtain an action set of the data message; A message analysis module, configured to analyze the data message to obtain an exact matching domain of the data message; A flow table generating module, configured to generate a first flow entry corresponding to the data message according to the action set of the data message and the exact matching field. 9. The switch according to claim 6, wherein the switch further comprises: A flow entry deletion unit, configured to delete the first flow entry associated with the second flow entry in the first flow table when the second flow entry in the second flow table is aged; or, when the second When the second flow entry in the flow table is modified, delete the first flow entry associated with the second flow entry in the first flow table; or, when the second flow entry in the second flow table is deleted , deleting the first flow entry associated with the second flow entry in the first flow table; or, when adding a new second flow entry in the second flow table, detecting the first flow entry in the first flow table associated with the second flow entry Whether the priority of the first flow entry associated with the second flow table is lower than that of the newly added second flow entry, and if so, delete the first flow entry associated with the second flow table in the first flow table. 10. The switch according to claim 6, further comprising: a synchronization unit, configured to send the traffic statistics message of the first flow table to the second flow table in real time or periodically, so that the The second flow table records the traffic of the data packet according to the traffic statistics message, and updates the idle time of the corresponding second flow entry.